CVE-2023-41436-CSZ-CMS-Stored-XSS---Pages-Content

CSZ CMS Stored XSS v1.3.0 Author: Sergio CVE: 2023-41436 Description: Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameter in the Pages Content Menu component. Attack Vectors:...

CVE-2019-16113-Dockerfile

Bludit目录穿越漏洞（CVE-2019--16113） Bludit-3.9.2 是轻量级 CMS，只需要 LAMP 环境便可运行。在图片上传时，Bludit检查文件后缀名后没有及时删除文件，攻击者还可以通过控制uuid参数实现目录穿越。具体参考 漏洞环境 执行如下命令编译镜像并启动Bludit容器 root@kitploit: cd Docker sudo docker build -t bludit:cve . 编译镜像 sudo docker run --name bludit -p 8000:80 -d bludit:cve 启动容器，服务在8000端口...

cPanel-WHM-CVE-2026-41940-auth-bypass-exploit

CVE-2026-41940 - cPanel & WHM Authentication Bypass Exploit Critical Authentication Bypass via CRLF Injection in cPanel/WHM cpsrvd Daemon 📋 Overview CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel & WHM that allows unauthenticated remote attackers to gain root-level...

trivy

Trivy GitLab CI Component A GitLab CI component for Trivy — the all-in-one security scanner covering container images, filesystems, repositories, Kubernetes clusters, SBOMs, and license compliance. Plug these templates directly into your pipelines to get repeatable scans, GitLab-native reports, a...

MilkSad-Mnemonic-Generator

Milk Sad Mnemonic Generator This tool is designed to generate BIP-39 mnemonic phrases 24-word seed phrases based on Unix timestamps, specifically exploring phrases that could be generated through the "Milk Sad" vulnerability CVE2023-39910. What This Tool Does The Milk Sad Mnemonic Generator creat...

CVE-2025-63820

CVE-2025-63820 Submitter: Nicola Giuffrida Information Vendor: TOTOLINK Vendor's website: TOTOLINK Model: A720R Firmware version: V4.1.5cu.630B20250509 Firmware download address: TOTOLINK Vulnerability details When logging into the control panel, the username and password are sent in plain-text:...

cicd-goat

一个故意存在漏洞的CI/CD环境。 破解CI/CD管道，夺取旗帜。🚩 由Cider Security创建 被Palo Alto Networks收购。 目录 描述 下载与运行 Linux & Mac Windows Powershell 使用说明 说明 接受挑战 故障排除 解决方案 贡献 描述 CI/CD Goat 项目让工程师和安全从业者通过一系列11个挑战来学习和实践CI/CD安全，这些挑战是在一个真实的、完整的CI/CD环境中进行的。每个场景难度不同，且每个场景侧重于一个主要的攻击向量。 这些挑战涵盖了 Top 10 CI/CD...

webvm

WebVM This repository hosts the source code for https://webvm.io, a Linux virtual machine that runs in your browser. Try out the new Alpine / Xorg / i3 graphical environment: https://webvm.io/alpine.html WebVM is a server-less virtual environment running fully client-side in HTML5/WebAssembly. It...

javascript-obfuscator

JavaScript obfuscator 🚀 Obfuscator.io with VM Obfuscation Obfuscator.io adds VM-based bytecode obfuscation to this package - your JavaScript functions are compiled to custom bytecode that runs on an embedded virtual machine. Each build produces unique opcodes and VM structure, making reverse...

javascript-obfuscator

JavaScript obfuscator 🚀 Obfuscator.io with VM Obfuscation Obfuscator.io adds VM-based bytecode obfuscation to this package - your JavaScript functions are compiled to custom bytecode that runs on an embedded virtual machine. Each build produces unique opcodes and VM structure, making reverse...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 before 11.3.757 is vulnerable to stored HTML injection in the CrushFTP Admin Panel Reports / "Who Created Folder", enabling persistent HTML execution in admin sessions. CWE CWE-79 — Improper Neutralization of Input During Web Page Generation Cross-site Scripting CVSS v3....

CVE-2024-49138-SOC-Investigation

CVE-2024-49138 Exploitation Investigation Platform: LetsDefend SOC Training Environment Alert: SOC335 - CVE-2024-49138 Exploitation Detected Category: Privilege Escalation | Malware Analysis | Incident Response Status: Investigation Completed ✅ Overview In this investigation, I worked on an alert...

CVE-2026-78088 Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

CVE-2026-78088

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

EUVD-2026-80098

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

CVE-2026-78088 Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

Next.js-RSC-RCE-Scanner-CVE-2025-66478

Next.js-RSC-RCE-Scanner-CVE-2025-66478 CVE-2025-66478 Next.js vulnerability scanner. Detects whether a website is using a version of Next.js affected by the RSC React Server Components RCE vulnerability. Installation and Execution Using uv Recommended uv is a fast Python package manager. 1...

CVE-2025-62506

CVE-2025-62506 Vulnerability Verification Script Overview This repository contains a verification script for CVE-2025-62506, a privilege escalation vulnerability in MinIO service accounts and STS Security Token Service accounts. Vulnerability Description CVE-2025-62506 is a privilege escalation...

fierce

Fierce Fierce は、非連続なIPスペースを見つけるためのDNS偵察ツールです。 便利なリンク： ドメインネームシステム DNS ドメイン名 - 概念と機能 ドメイン名 - 実装と仕様 ドメインネームシステム DNS の脅威分析 ネームサーバ NS 権威レコード SOA ゾーン転送 DNSゾーン転送プロトコル AXFR DNSにおける増分ゾーン転送 IXFR ワイルドカードDNSレコード 概要 まず、功績は功績として、fierce は元々 RSnake と ha.ckers.org の他のメンバーによって書かれました。これは単にコードベースを簡素化し近代化するために Pytho...

CVE-2026-36358

CVE-2026-36358 PoC - Juzaweb CMS v.5.0.0 （XSS） First, set up the platform normally and register an account. Here, the administrator account I registered is [email protected] / 123456. After setting up the platform, you can see the website homepage. Access /admin and log in. After logging in,...