nishang

Nishang Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing. By Nikhil Mittal Founder of Altered Security - Hands-on red team and...

CVE-2022-27925

CVE-2022-27925 Zimbra RCE 2022 Этот репозиторий является частью hgrab-framework dork title: "Zimbra Web Client Sign In" Затронутый продукт Zimbra Collaboration Suite Network Edition 9.0.0 Patch 23 и более ранние версии Zimbra Collaboration Suite Network Edition 8.8.15 Patch 30 и более ранние верс...

interactsh-web

Interactsh 웹 클라이언트 Interactsh를 위한 Next.js 기반 웹 인터페이스 시작하기 사전 요구 사항 Node.js 20+ React 19 필요 npm, yarn 또는 pnpm 설치 1. 저장소를 클론합니다: root@kitploit: git clone https://github.com/projectdiscovery/interactsh-web.git cd interactsh-web 2. 의존성을 설치합니다: root@kitploit: npm install or yarn install 3. 개발 서버를 실행합니...

skyhook

Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...

Zimbra - Cross-Site Scripting via ICS Files

Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event...

CVE-2025-47812

CVE-2025-47812 Как работает этот метод обнаружения? Этот шаблон Nuclei обнаруживает экземпляры Wing FTP Server, уязвимые для CVE-2025-47812, путем выявления версий старше 7.4.4, отображаемых в HTML-ответе веб-клиента. Как запустить этот скрипт? 1. Скачайте Nuclei отсюда 2. Скопируйте шаблон в ваш...

cve-2021-21980-mock-server

Clippy of the Dead - CVE-2021-21980 测试环境与Nuclei模板 本仓库包含一个用于检测 CVE-2021-21980（vSphere Web Client 路径遍历）的高置信度 Nuclei 模板，以及一个模拟该漏洞行为的小型模拟环境，用于安全的本地测试。 文件： cve-2021-21980.yaml：包含多种编码变体和匹配器的 Nuclei 模板 app.py：模拟 /eam/vib 路径遍历漏洞的小型 Flask 应用 Dockerfile：带有自签名 TLS 证书的模拟服务器容器镜像 docker-compose.yml：运行模拟服务器，监听主...

CVE-2025-30349

Horde IMP 취약점 – HTML 인코딩을 통한 난독화 – XSS 페이로드 Horde 5.2.23; IMP 6.2.27 취약점의 세부 사항은 Details.md 파일에 설명되어 있습니다. PoC는 취약점을 악용하는 페이로드가 포함된 이메일을 생성하여 수신자에게 전송합니다. 이러한 이메일은 Horde 웹 클라이언트에서 열람해야 하며, 일반 클라이언트예: 데스크톱 클라이언트에서는 열람할 수 없습니다...

vcenter-cve-2021-21980-lab

CVE-2021-21980 취약한 테스트 환경 개요 VMware vSphere Web Client의 경로 탐색 취약점을 시뮬레이션하는 실제적인 테스트 환경입니다. ⚠️ 경고: 취약한 테스트 환경입니다. 인터넷에 노출하지 마세요! 빠른 시작 빌드 및 실행 root@kitploit: podman build -t vcenter-lab . podman run -d -p 443:443 --name vcenter-lab vcenter-lab 수동 테스트 root@kitploit: curl -k...

Malicious code in analytics-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8893c0594fed4d622c0e347b4e8f899d5b00e11c15fe31e09169a9fae8e82be package.json at line 11 declares a dependency whose key equals this package's own name analytics-web-client and whose source is a bare HTTPS URL...

MAL-2026-15526 Malicious code in analytics-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8893c0594fed4d622c0e347b4e8f899d5b00e11c15fe31e09169a9fae8e82be package.json at line 11 declares a dependency whose key equals this package's own name analytics-web-client and whose source is a bare HTTPS URL...

CVE-2026-73572

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

CVE-2026-73574

Zimbra Collaboration versions before 10.1.17 are affected by a local file inclusion (LFI) vulnerability in the Forward servlet of the Classic Web Client. The root cause is improper validation of the fu request parameter, allowing an unauthenticated attacker to supply a crafted path and disclose p...

EUVD-2026-58071

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

CVE-2026-73572

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

PT-2026-71678

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description A stored cross-site scripting XSS issue exists in the Zimbra Classic Web Client. This occurs because the system does not sufficiently sanitize specific attachment content during...

CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-46714

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-46714

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-14540

A Server-Side Request Forgery SSRF vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client...