npcap

Npcap Npcap is a packet capture and injection library for Windows by the Nmap Project. It is a complete update to the unmaintained WinPcap project with improved speed, reliability, and security. Documentation The complete documentation for Npcap is available in the Npcap Guide on npcap.com. There...

nysm

nysm A stealth post-exploitation container. Table of Content 1. Introduction 2. Installation 2.1 Requirements 2.2 Linux headers 2.3 Build 3. Usage 3.1 Examples 4. How it works 4.1 In general 4.2 Hide eBPF objects 4.3 Hide Auditd logs 4.4 Hide PIDs 4.5 Hide sockets 5. Limitations Introduction...

pcc

PHP Secure Configuration Checker Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful...

psudohash

psudohash Cool New Features of v1.1.0 Special thanks to DavidAngelos: ▶️ Added a progress bar in every step to track execution. ▶️ Added options: In-order joins -i / --inorder: join keywords only in the original order e.g. foo,bar,baz → foo, bar, baz, foobar, foobaz, barbaz, foobarbaz. All-order...

espoofer

espoofer espoofer is an open-source testing tool to bypass SPF, DKIM, and DMARC authentication in email systems. It helps mail server administrators and penetration testers to check whether the target email server and client are vulnerable to email spoofing attacks or can be abused to send spoofi...

Skitter Slideshow <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Skitter Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. id: CVE-2025-28906 info: name: Skitter Slideshow = 2.5.2 - Authenticated Administrator+ Stored Cross-Site...

FlatnuX CMS - Directory Traversal

A path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 allows remote administrators to read arbitrary files via a full pathname in the dir parameter in a contents/Files action. id: CVE-2012-4878 info: name: FlatnuX CMS - Directory Traversal author: daffainfo severity:...

CVE-2026-121453

SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other...

CVE-2026-121453

SQLBot versions through 1.10.3 are vulnerable to a path traversal vulnerability in the importToDb endpoint. The root cause is an unsanitized filePath parameter , which allows authenticated workspace administrators to read files from the server or other workspaces. By supplying absolute paths or ....

CVE-2026-121453 SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint

SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other...

CVE-2026-121453: dataease SQLBot: SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated…

SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other...

CVE-2026-120248

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logofile or bannerfile images. Attackers can upload an SVG with an onload payload served from...

EUVD-2026-114745

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logofile or bannerfile images. Attackers can upload an SVG with an onload payload served from...

CVE-2026-120248 Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logofile or bannerfile images. Attackers can upload an SVG with an onload payload served from...

CVE-2026-120248

The Thelia e-commerce platform, prior to version 3.1.1 , is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the lack of sanitization for SVG images uploaded as logo_file or banner_file . Authenticated back-office administrators with store update permissions can exploit t...

vmware_vcenter_cve_2020_3952

Proof of concept for CVE-2020-3952 This is a short piece of code that exploits of CVE-2020-3952, which is described in detail at the Guardicore Labs post over here. This vulnerability was published by VMware in April 2020 with a maximum CVSS score of 10.0. It allows an attacker with a network...

CVE-2026-117572

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks...

EUVD-2026-113727

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks...

PT-2026-133288

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2026-117572: Unknown WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter…

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks...