DevGuide

OWASP Foundation Developer Guide The Developer Guide is one of the original documents from OWASP and so has a long history. The original DevGuide repository has many of the previous versions going back to the very first version 1.0 release from 2002. This is the content for the Developer Guide...

CheatSheetHost

CheatSheetHost A lightweight, content-driven web server for hosting interactive cheatsheets and reference materials. Perfect for CTF Capture The Flag challenges, reverse engineering, and technical documentation. This is best used in labs where you want to limit or forgo external traffic while sti...

s3_objects_check

S3 Objects Check Description Whitebox evaluation of effective S3 object permissions, in order to identify publicly accessible objects. Allows identifying publicly accessible objects, as well as objects accessible for AuthenticatedUsers by using a secondary profile. A number of tools exist which...

PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion

Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus through 1.11.6507.0. id: CVE-2024-6911 info: name: PerkinElmer ProcessPlus = 1.11.6507.0 - Local File Inclusion author:...

poro

poro Description Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value...

shepard

SHEPARD BITS This is a persistance tool using Windows Background Intelligent Transfer Service BITS. Functionality File Download, File Exfiltration, File Download + Persistent Execution Usage Run shepard.exe as Administrator with the following command line arguments: -d : regular file download to ...

CVE-2026-112067

The Accessible Form Captcha (bw_captcha) extension contains a Captcha Bypass vulnerability because it embeds the correct answer within the CAPTCHA image data. This occurs because the audio feature , which causes the answer to be embedded, is enabled by default. Consequently, any entity capable of...

CVE-2026-112067 Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)

The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature...

TYPO3-EXT-SA-2026-030: Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-030...

CVE-2026-112144: Files or Directories Accessible to External Parties

A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessible. The attack may be performed from remote. The exploit h...

CVE-2026-104798

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public mcs GET parameter is reflected into post content unsanitized before WordPress core's doshortcode filter runs, allowing an unauthenticated...

EUVD-2026-102653

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public mcs GET parameter is reflected into post content unsanitized before WordPress core's doshortcode filter runs, allowing an unauthenticated...

CVE-2026-104798: Improper Privilege Management

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public mcs GET parameter is reflected into post content unsanitized before WordPress core's doshortcode filter runs, allowing an unauthenticated...

CVE-2026-109162

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/userupload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted,...

CVE-2026-109162 TYPO3 CMS - Security Misconfiguration in Form Framework

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/userupload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted,...

CVE-2026-109162 TYPO3 CMS - Security Misconfiguration in Form Framework

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/userupload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted,...

CVE-2026-109162

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/userupload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted,...

CVE-2026-109162

A security misconfiguration in the TYPO3 CMS Form Framework (versions 14.0.0-14.3.8 ) allows uploaded files to be stored in the default 1:/user_upload/ folder instead of the intended destination when using FileUpload or ImageUpload elements with a custom saveToFileMount configuration. This bypass...

EUVD-2026-98091

A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been published and may be used...

PT-2026-111375

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 14.0.0 through 14.3.8 Description Forms utilizing FileUpload or ImageUpload elements with a custom saveToFileMount configuration store uploaded files in the default storage folder 1:/user upload/ instead of the intended...