Addon

ClearURLs ClearURLs is an add-on based on the new WebExtensions technology and is optimized for Firefox and some Chrome based browsers. This extension will automatically remove tracking elements from URLs to help protect your privacy when browsing the Internet, which is regularly updated by us an...

CVE-2025-44603-CSRF-Leads_to_Create_FakeUsers

CVE-2025-44603 CSRF Vulnerability: Leads to Creating Fake Clients Project Name & Repo URL : https://phpgurukul.com/client-management-system-using-php-mysql/ Vulnerability Name : Cross-Site Request ForgeryCSRF Affected Version : V1.2 Introduction A Cross-Site Request Forgery CSRF vulnerability...

CVE-2026-127213

LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary userid parameter to the renderbutton callback instead of relying on the session identity...

EUVD-2026-125724

LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary userid parameter to the renderbutton callback instead of relying on the session identity...

log-add-http-post-bodies

Add POST body excerpt to the HTTP log This script gives analysts the ability to peek into what is being sent in HTTP POST bodies. It provides this by simply extending the HTTP log. Installation :: zkg refresh zkg install corelight/log-add-http-post-bodies Usage The HTTP log will have a new field...

CVE-2022-24734

CVE-2022-24734 PoC An RCE can be obtained on MyBB's Admin CP in Configuration - Add New Setting. The user must have a rights to add or update setting. This is tested on MyBB 1.8.29. Sources: https://github.com/mybb/mybb/ https://vulners.com/cve/CVE-2022-24734...

cve-2025-0364

CVE-2025-0364: BigAntSoft BigAnt Server Account Registration Bypass to File Upload RCE The BigAntSoft BigAnt Server, which provides a Windows hosted on-premises chat server that focuses on business use cases, is vulnerable to unauthenticated remote code execution via account registration and PHP...

community-scripts

Community Scripts A collection of ZAP scripts provided by the community, i.e. you lot : The easiest way to use this repo in ZAP is to install the 'Community Scripts' add-on from the ZAP Marketplace. !CAUTION While we do review all scripts to ensure they don't do anything obviously malicious, you...

CVE-2024-51358

CVE-2024-51358: SSRF in Heimdall application A server-side request forgery SSRF vulnerability was discovered in Heimdall version 2.6.1, specifically within the Add Application feature. This flaw allows remote attackers to perform HTTP requests. References: Heimdall GitHub repository:...

CVE-2026-60004-POC

CVE-2026-60004 — Gitea Pre-Auth Remote Code Execution CVSS 9.8 ┌──────────────────────────────────────────────────────────────┐ │ CVE-2026-60004 │ Gitea Pre-Auth RCE │ CVSS 9.8 CRIT │ │ diffpatch → git hook injection │ v1.17–1.27.0 affected │...

-CVE-2023-46450

-CVE-2023-46450 Description Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting XSS via the Add supplier function. Additional Information A video POC stored XSS vulnerability exists in the add supplier functionality in free and open source...

fix-CVE-2020-15228

Fix CVE-2020-15228 set-env, add-path in Github-Actions This script changes lines in your github action file. You give it a directory name, and it searches for all files with the ".sh" or ".yml" extension. It recognizes these lines: echo ::set-env name=FOOBAR::$FOOBAR echo ::set-env...

cve-2023-5966

Poc from CVE-2023-5966 Advisory EspoCRM 2.7.4 and earlier is vulnerable to an arbitrary file upload that can lead to code execution in the add extension functionality. The zip file on this repo upload a web shell to /webshell.php...

acltoolkit

acltoolkit acltoolkit is an ACL abuse swiss-army knife. It implements multiple ACL abuses. Table of Contents acltoolkit Table of Contents Installation Usage Commands get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation pip install acltoolkit-ad or...

CVE-2023-2732

CVE-2023-2732 MStore API = 3.9.2 - Authentication Bypass https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mstore-api/mstore-api-392-authentication-bypass Description The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including...

SquirrelMail Address Add 1.4.2 - Cross-Site Scripting

SquirrelMail Address Add 1.4.2 plugin contains a cross-site scripting vulnerability. It fails to properly sanitize user-supplied input, thus allowing an attacker to execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to...

PT-2026-146342

A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/add category.php of the component Admin Write Handler. Performing a manipulation of the argument title/description/price/current image/featured/active/id results in sql...

CVE-2025-56219

CVE-2025-56219 Lack of Rate Limiting – Add User API Description An attacker can automate the creation of a large number of Users in a short period of time to cause a DoS. CVSS Score: 7.1 High Attack Type Remote Authenticated Affected Versions Versions before 8.6.8 Discovered By: Yazan Abu-Nadi...

cockpit: Cockpit: Local privilege escalation via insecure symlink handling in public key addition helper

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following...

cockpit: Cockpit: Local privilege escalation via insecure symlink handling in public key addition helper

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following...