CVE-2022-27925

CVE-2022-27925 Zimbra RCE 2022 Ce dépôt fait partie du framework hgrab-framework dork title: "Zimbra Web Client Sign In" Produit affecté Zimbra Collaboration Suite Network Edition 9.0.0 Patch 23 et antérieures Zimbra Collaboration Suite Network Edition 8.8.15 Patch 30 et antérieures Installation...

nishang

Nishang Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing. By Nikhil Mittal Founder of Altered Security - Hands-on red team and...

interactsh-web

Interactsh Web Client Веб-интерфейс на Next.js для Interactsh Начало работы Предварительные требования Node.js 20+ требуется для React 19 npm, yarn или pnpm Установка 1. Клонируйте репозиторий: git clone https://github.com/projectdiscovery/interactsh-web.git cd interactsh-web 2. Установите...

skyhook

Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...

Zimbra - Cross-Site Scripting via ICS Files

Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event...

CVE-2025-47812

CVE-2025-47812 Comment fonctionne cette méthode de détection ? Ce modèle Nuclei détecte les instances de Wing FTP Server vulnérables à CVE-2025-47812 en identifiant les versions antérieures à 7.4.4 exposées dans la réponse HTML du client web. Comment exécuter ce script ? 1. Téléchargez Nuclei...

cve-2021-21980-mock-server

Clippy of the Dead - Environnement de test pour CVE-2021-21980 et modèle Nuclei Ce dépôt contient un modèle Nuclei très fiable pour détecter CVE-2021-21980 traversée de chemin de vSphere Web Client et un petit environnement simulé qui reproduit le comportement vulnérable pour des tests locaux en...

Cisco ASA Cross-site Scripting (CVE-2024-20341)

A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a browser that is accessing an affected...

Cisco ASA Inconsistent Interpretation of HTTP Requests (CVE-2022-20713)

A vulnerability in the VPN web client services component of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct browser-based attacks against users of an affected device. This vulnerability is du...

Cisco ASA Basic XSS (CVE-2024-20382)

A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a browser that is accessing an affected...

CVE-2025-30349

Уязвимость Horde IMP – обфускация через HTML-кодирование – XSS нагрузка Horde 5.2.23; IMP 6.2.27 Подробности уязвимости объяснены в файле Details.md. PoC создает и отправляет электронное письмо с нагрузкой, эксплуатирующей уязвимость, получателю. Такое письмо должно быть просмотрено в веб-клиенте...

vcenter-cve-2021-21980-lab

CVE-2021-21980 – Environnement de test vulnérable Aperçu Environnement de test réaliste simulant la vulnérabilité de traversée de chemin du client Web VMware vSphere. ⚠️ AVERTISSEMENT: Environnement de test vulnérable. Ne pas exposer à Internet! Démarrage rapide Compilation et exécution podman...

CVE-2026-104286-POC

Exploit de traversée de chemin FortiMail CVE-2026-104286 Aperçu Exploit avancé d'écriture de fichier arbitraire à distance non authentifié pour CVE-2026-104286 dans FortiMail. Des requêtes HTTP/HTTPS craftées contournent la sanitisation des chemins dans le client web, permettant la création...

Exploit for CVE-2026-104286

FortiMail CVE-2026-104286 Path Traversal Exploit Overview...

CVE-2026-93647 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93647

The Zimbra Collaboration Suite Classic Web Client is vulnerable to a stored Cross-Site Scripting (XSS) flaw. An unauthenticated calendar sender can inject active markup into the RFC From address of a COUNTER message . When a user selects this message within Zimbra Classic, the XSS is triggered, p...

CVE-2026-93647 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93642

The Zimbra Collaboration Suite Modern Web Client is vulnerable to Stored Cross-Site Scripting (XSS) due to a flaw where an unauthenticated sender can forge a share notification. When a signed-in Zimbra Modern recipient clicks the Accept Share button, the XSS is triggered. This allows an attacker ...

CVE-2026-93642 Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93641 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...