keeweb

Password Manager KeeWeb Password Manager🔑 KeeWeb is a browser and desktop password manager which is capable of opening up existing KeePass database kdbx files, or creating new vaults to store your important credentials in...

XWiki - Information Disclosure

XWiki 16.7.0 to 16.10.11, 17.4.4, and 17.7.0 using XJetty contains an information disclosure vulnerability caused by exposed context allowing static access to files in webapp/ folder, letting attackers access sensitive files, exploit requires use of XJetty package. id: CVE-2025-55749 info: name:...

Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting

Zarafa WebApp 2.0.1.47791 and earlier contains an unauthenticated reflected cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. id: CVE-2019-7219 info: name: Zarafa WebApp =2.0.1.47791 -...

msmailprobe

msmailprobe Office 365 and Exchange Enumeration It is widely known that OWA Outlook Webapp is vulnerable to time-based user enumeration attacks. This tool leverages all known, and even some lesser-known services exposed by default Exchange installations to enumerate users. It also targets Office...

adapt

Summary ADAPT is a tool that performs Automated Dynamic Application Penetration Testing for web applications. It is designed to increase accuracy, speed, and confidence in penetration testing efforts. ADAPT automatically tests for multiple industry standard OWASP Top 10 vulnerabilities, and outpu...

wig

wig - WebApp Information Gatherer wig is a web application information gathering tool, which can identify numerous Content Management Systems and other administrative applications. The application fingerprinting is based on checksums and string matching of known files for different versions of...

Gallery-Plugin-SQL-Injection

エクスプロイトタイトル: Wordpress Video Gallery - YouTube Gallery and Vimeo Gallery Plugin SQLインジェクション 日付: 2024-07-05 エクスプロイト作者: tmrswrr カテゴリ : Webアプリ ベンダーホームページ: https://total-soft.com/wp-video-gallery/ バージョン 2.3.6 1. 管理パネルにアクセスする: WordPressサイトの管理パネルに移動します。 TS Video Gallery Create Use Theme に移動して保存します。 2...

redjoust

ᵔᴥᵔ RedJoust 빠르고 사용하기 쉬운 보안 정찰 웹앱 도구입니다. OSINT, 분석 및 레드팀 작업을 수동 및 능동 모드 모두에서 수행합니다. nodeJS와 Electron으로 작성되었습니다. 커뮤니티에 참여하세요 Kawaiipantsu / THUGSred 커뮤니티에 가입하여 Redjoust 개발 논의에 참여하거나, 그냥 와서 보안 관련 이야기를 나누세요 : 우리는 보안을 가지고 노는 것을 좋아합니다. 또한 CTF 이벤트와 초보자를 위한 작은 하우투 이벤트도 있습니다. THUGSred Discord :...

domain-to-webapp

domain-to-webapp 도메인 내에서 호스팅되는 웹 애플리케이션을 찾기 위한 간단한 bash 스크립트 요구 사항 curl Subfinder 도커 이미지 사용법 root@kitploit: $./webAppChecker businesssolutions.com ./ouputdir ./scope.txt | \ | | \ \ / /| | / \ | | | |/ | ' \ / | | ' \ | / \ \ \ /\ / / \ ' \ / \ | ' | ' \ | || | | | | | | | | | | | | | | || | \ V...

CVE-2026-58504

CVE-2026-58504 is a Stored XSS in draw.io prior to version 30.2.5 , constituting a patch bypass of CVE-2026-46642 . When a victim opens or imports a crafted .drawio file, a pair of sibling cells triggers the vulnerability: an HTML cell keeps the formatted-label path active while an editable=0 pla...

Mahoraga-Webapp-Defender

Mahoraga 웹앱 디펜더 AI 기반의 반응형 웹앱 방어 시스템으로, AI 기반 해킹을 실시간으로 견딜 수 있도록 설계되었습니다. 목차 Mahoraga 웹앱 디펜더 목차 소개 대상 웹사이트 Mahoraga 디펜더 아키텍처 이중 환경 에이전트 파이프라인 시작 방법 준비하기 전체 디펜더 vs 공격자 실험 대시보드 로그 에이전트 파이프라인 패치 LLM 설정 기술 스택 특별 감사 소개 Mahoraga 디펜더는 반응형, 공격자 유형에 구애받지 않는 실시간 방어 시스템의 PoC개념 증명입니다. 핵심 메커니즘은 적이 무해한 가짜...

webapp-exploits

webapp-exploits Webアプリケーションのエクスプロイト開発...

CVE-2019-7219

CVE-2019-7219 Zarafa Webapp 著者: verifysecurity 少なくともWebapp バージョン1.6-46049から2.0.1.47791までが影響を受けます。 hxxps://127.0.0.1/webapp/?fccc0"5f43d=1...

CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

Astra Linux – Vulnerability in Chromium

In WebApp installations using free after 102.0.5005.61, an attacker who convinced a user to install a malicious extension could potentially exploit heap corruption through a crafted Chrome Extension and specific user interactions...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations in WebApp installations in Google Chrome on Windows prior to version 128.0.6613.84 allowed an attacker who convinced a user to install a malicious application to perform UI spoofing through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the WebApp in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations in WebApp installations in Google Chrome prior to version 113.0.5672.126 allowed an attacker who convinced a user to install a malicious web app to bypass the installation dialog through a crafted HTML page. Chromium security severity: Medium...