Zimbra - Cross-Site Scripting via ICS Files

Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event...

nishang

Nishang Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing. By Nikhil Mittal Founder of Altered Security - Hands-on red team and...

skyhook

Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...

interactsh-web

Interactsh Web Client A Next.js-based web interface for Interactsh Getting Started Prerequisites Node.js 20+ required for React 19 npm, yarn, or pnpm Installation 1. Clone the repository: git clone https://github.com/projectdiscovery/interactsh-web.git cd interactsh-web 2. Install dependencies: n...

cve-2021-21980-mock-server

Clippy of the Dead - CVE-2021-21980 testing environment and Nuclei template This repository contains a high-confidence Nuclei template to detect CVE-2021-21980 vSphere Web Client path traversal and a small mock environment that reproduces the vulnerable behavior for safe local testing. Files:...

CVE-2025-30349

Horde IMP vulnerability – obfuscation via HTML encoding – XSS payload Horde 5.2.23; IMP 6.2.27 The details of the vulnerability are explained in Details.md file. The PoC creates and send an email with payload exploiting the vulnerability to the recipient. This kind of email has to be viewed in a...

CVE-2026-104286-POC

FortiMail CVE-2026-104286 Path Traversal Exploit Overview Advanced unauthenticated remote arbitrary file write exploit for CVE-2026-104286 in FortiMail. Crafted HTTP/HTTPS requests bypass path sanitization in the web client, enabling arbitrary file creation on the underlying OS. Used for red team...

vcenter-cve-2021-21980-lab

CVE-2021-21980 Vulnerable Test Environment Overview Realistic test environment simulating VMware vSphere Web Client path traversal vulnerability. ⚠️ WARNING: Vulnerable test environment. Do NOT expose to internet! Quick Start Build and Run podman build -t vcenter-lab . podman run -d -p 443:443...

CVE-2022-27925

CVE-2022-27925 Zimbra RCE 2022 This repo is part of the hgrab-framework dork title: "Zimbra Web Client Sign In" Affected product Zimbra Collaboration Suite Network Edition 9.0.0 Patch 23 and earlier Zimbra Collaboration Suite Network Edition 8.8.15 Patch 30 and earlier Installation Install the ap...

CVE-2025-47812

CVE-2025-47812 How does this detection method work? This Nuclei template detects Wing FTP Server instances vulnerable to CVE-2025-47812 by identifying versions older than 7.4.4 exposed in the web client’s HTML response. How do I run this script? 1. Download Nuclei from here 2. Copy the template t...

Wing FTP CVE-2025-47812 Detect

Detects Wing FTP web client authenticated RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Wing FTP web client authenticated RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Wing FTP...

Malware in @sxm-web/client-sdk-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @sxm-web/client-sdk-core (npm)

@sxm-web/client-sdk-core is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7 has a postinstall script th...

Malicious Package

Overview @sxm-web/client-sdk-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @sxm-web/client-sdk-core (npm)

@sxm-web/client-sdk-core is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7 has a postinstall script th...

MAL-2026-18319 Malicious code in @sxm-web/client-sdk-core (npm)

@sxm-web/client-sdk-core is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7 has a postinstall script th...

CVE-2026-50053

A request attribute override vulnerability in Zimbra Collaboration Suite ZCS allows unauthenticated requests to /h/ to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch...

CVE-2026-10632

A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite ZCS allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When...

CVE-2026-50053

The Zimbra Collaboration Suite (ZCS) contains a request attribute override vulnerability where unauthenticated requests to /h/* can populate servlet attributes used for trusted internal dispatch. The RestFilter component improperly copies URL parameters—including authentication tokens , target ac...

EUVD-2026-108962

A request attribute override vulnerability in Zimbra Collaboration Suite ZCS allows unauthenticated requests to /h/ to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch...