GPEWebDefender

GPEWebDefender A web-attack monitor. It sits next to nginx / Caddy / the app, tails access logs, and tells you when a site is being probed or exploited. If this process dies, the site keeps serving. It is not Wazuh, not OSSEC, and not a WAF. The command is gpewebdefender. Hosts, tokens, map pins,...

NginxHunter

NginxHunter Description NginxHunter is a comprehensive tool designed to analyze Nginx access logs for security vulnerabilities and suspicious activities. It detects SQL injection attempts, scanner tools, sensitive path accesses, exploitation attempts, webshells, and more. Ideal for system...

Multi-Stage-Exploitation-and-Detection-Engineering-Analysis-of-CVE-2023-34362-in-MOVEit-Transfer

CVE-2023-34362 MOVEit Transfer Vulnerability Analysis Project Overview This repository contains an academic technical analysis of CVE-2023-34362, a critical SQL injection vulnerability affecting MOVEit Transfer. The project was prepared for CYB625 – Ethical Hacking & Penetration Testing. Importan...

CVE-2022-47966_checker

CVE-2022-47966checker Quick and dirty powershell script to look for ManageEngine CVE-2022-47966 IOCs. The script will parse requests in ME HTTP access logs. If a characteristic SAML request is found, it will attempt to decode and extract the attacker's payload. Findings are written to...

CVE-2026-123512 Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs

Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a user clicks the link. Attackers with re...

CVE-2026-123512

Vikunja versions prior to 2.7.1 are vulnerable to sensitive token exposure due to the application embedding live password-reset , email-confirmation , and account-deletion tokens in the URL query string of emailed links. When a user clicks these links, the full request URI—including the sensitive...

CVE-2026-123512 Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs

Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a user clicks the link. Attackers with re...

weblogchecker

weblogchecker Your web server logs already know if you were attacked. weblogchecker reads them. phpscan tells you whether your PHP is exposed. phpscan hunt searches the webroot for shells. weblogchecker answers the third question — did anyone actually use them? — from the one record most sites...

weblogchecker

weblogchecker Your web server logs already know if you were...

Web-App-Attack-Detection-OWASP-Top-10-SQLi-XSS-vs-DVWA

Web-App-Attack-Detection-OWASP-Top-10-SQLi-XSS-vs-DVWA WAZUH...

CVE-2026-81632

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...

CVE-2026-61614

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a "?token=" URL query parameter as a fallback to the "X-API-TOKEN" header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, brows...

CVE-2026-61614: Use of GET Request Method With Sensitive Query Strings

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser...

PT-2026-80329

Summary Ember's interactive TUI renders fields taken from the monitored Caddy server's access logs — most notably the request URI — straight to the operator's terminal without neutralising terminal escape or control sequences CWE-150. Those log fields are populated from arbitrary, unauthenticated...

CVE-2026-54715

A flaw was found in GoAccess, a real-time web log analyzer. A remote attacker could exploit this vulnerability by providing a specially crafted User-Agent string in an access log. This improper handling by the parsebrowser function leads to a heap out-of-bounds write, a type of memory corruption...

SUSE-SU-2026:3167-1 Security update for tomcat

This update for tomcat fixes the following issues Update to Tomcat 9.0.119. Security issues fixed: - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example bsc1269791. - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caus...

Oracle Linux 10 : tomcat9 (ELSA-2026-36790)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36790 advisory. - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks...

CVE-2026-62386

The Grav API plugin getgrav/grav-plugin-api before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route JwtAuthenticator::extractBearerToken fallback. Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via th...

PT-2026-60650

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.0-rc.16 Description The plugin accepts JWT JSON Web Token access tokens via the token URL query parameter on every API route through the JwtAuthenticator::extractBearerToken fallback. This behavior causes...

tomcat security update

1:9.0.117-1 - Resolves: RHEL-150714 Certificate revocation bypass due to improper OCSP response validation - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled CVE-2026-34500 - Resolves: Tomcat: Cloud membership for clustering component exposed the Kubernet...