interactsh-web

Cliente Web de Interactsh Una interfaz web basada en Next.js para Interactsh Primeros Pasos Requisitos Previos Node.js 20+ requerido para React 19 npm, yarn o pnpm Instalación 1. Clona el repositorio: git clone https://github.com/projectdiscovery/interactsh-web.git cd interactsh-web 2. Instala la...

nishang

Nishang Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing. By Nikhil Mittal Founder of Altered Security - Hands-on red team and...

CVE-2022-27925

CVE-2022-27925 Zimbra RCE 2022 Este repositorio es parte del hgrab-framework dork title: "Zimbra Web Client Sign In" Producto afectado Zimbra Collaboration Suite Network Edition 9.0.0 Patch 23 y anteriores Zimbra Collaboration Suite Network Edition 8.8.15 Patch 30 y anteriores Instalación Instale...

Zimbra - Cross-Site Scripting via ICS Files

Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event...

skyhook

Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...

CVE-2025-47812

CVE-2025-47812 ¿Cómo funciona este método de detección? Esta plantilla de Nuclei detecta instancias de Wing FTP Server vulnerables a CVE-2025-47812 mediante la identificación de versiones anteriores a la 7.4.4 expuestas en la respuesta HTML del cliente web. ¿Cómo ejecuto este script? 1. Descargue...

cve-2021-21980-mock-server

Clippy of the Dead - CVE-2021-21980 测试环境与Nuclei模板 本仓库包含一个用于检测 CVE-2021-21980（vSphere Web Client 路径遍历）的高置信度 Nuclei 模板，以及一个模拟该漏洞行为的小型模拟环境，用于安全的本地测试。 文件： cve-2021-21980.yaml：包含多种编码变体和匹配器的 Nuclei 模板 app.py：模拟 /eam/vib 路径遍历漏洞的小型 Flask 应用 Dockerfile：带有自签名 TLS 证书的模拟服务器容器镜像 docker-compose.yml：运行模拟服务器，监听主...

CVE-2025-30349

Horde IMP 漏洞 – 通过HTML编码混淆 – XSS payload Horde 5.2.23; IMP 6.2.27 漏洞详情在 Details.md 文件中说明。 该 PoC 创建并发送一封包含利用该漏洞的 payload 的电子邮件给收件人。此类邮件需要在 Horde Web 客户端中查看，而非任何其他客户端（如桌面客户端）。...

vcenter-cve-2021-21980-lab

CVE-2021-21980 易受攻击的测试环境 概述 模拟VMware vSphere Web Client路径遍历漏洞的真实测试环境。 ⚠️ 警告： 易受攻击的测试环境。请勿暴露到互联网！ 快速开始 构建并运行 podman build -t vcenter-lab . podman run -d -p 443:443 --name vcenter-lab vcenter-lab 手动测试 curl -k "https://localhost/ui/vic-rest/services/containerView?id=../../../etc/passwd" 使用Nuclei测试...

CVE-2026-93647 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93647 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93647

The Zimbra Collaboration Suite Classic Web Client is vulnerable to a stored Cross-Site Scripting (XSS) flaw. An unauthenticated calendar sender can inject active markup into the RFC From address of a COUNTER message . When a user selects this message within Zimbra Classic, the XSS is triggered, p...

CVE-2026-93642 Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93642

The Zimbra Collaboration Suite Modern Web Client is vulnerable to Stored Cross-Site Scripting (XSS) due to a flaw where an unauthenticated sender can forge a share notification. When a signed-in Zimbra Modern recipient clicks the Accept Share button, the XSS is triggered. This allows an attacker ...

CVE-2026-93641

The Zimbra Collaboration Suite Classic Web Client is vulnerable to Stored Cross-Site Scripting (XSS) . An unauthenticated sender can forge a share notification that, when clicked by a signed-in recipient, executes malicious scripts. This allows an attacker to access mailbox data and act as the vi...

CVE-2026-93641 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

When Business Email Compromise Starts Rewriting Reality

Business Email Compromise BEC operates on a familiar playbook. Threat actors breach a mailbox, silently monitor operations, map approval chains, and ultimately exploit that access to divert funds or exfiltrate sensitive assets. This dynamic is central to our analysis as we kick off a series aroun...

CVE-2026-87253

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Web Client. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require hum...

EUVD-2026-79907

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Web Client. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require hum...

CVE-2026-87253

Oracle Agile PLM (component: Web Client , affected version 9.3.6 ) contains a vulnerability allowing an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation requires human interaction from a person other than the attacker and involves a scope ch...