rewerse-engineering

rewerse engineering An unofficial REWE API client in Go and Python. It implements the publicly accessible unauthenticated endpoints the REWE app uses for querying current discounts Angebote, products, markets and recalls. Current supported APK version: 5.18.1 as of 29.09.26 !CAUTION The...

API-s-for-OSINT

APIs For OSINT This is a Collection of APIs that will be useful for automating various tasks in OSINT. Instruction for total beginners: OSINT automation: using сustom functions for working with API requests in Google Sheets Thank you for following me! https://cybdetective.com Table of contents AP...

EntraTrace

EntraTrace EntraTrace is a defensive security research tool for documenting and identifying the observable behavior of offensive tooling targeting Microsoft Entra ID. The project builds a automatic knowledge base around tools such as AzureHound, AADInternals, O365Enum, PingCastle , and others, wi...

CVE-2026-35616

CVE-2026-35616 — FortiClient EMS Pre-Auth Bypass Proof of Concept PoC for FortiClient Endpoint Management Server authentication bypass CVE-2026-35616 This script exploits an authentication bypass vulnerability in FortiClient EMS that allows unauthenticated access to protected API endpoints...

CVE-2025-24893-XWiki-RCE

📜 Description A critical RCE vulnerability exists in XWiki that allows unauthenticated attackers to execute arbitrary system commands via vulnerable API endpoints. Exploitation can result in: Full server takeover Data theft or destruction Pivoting into internal networks 💥 Impact Complete compromi...

CVE-2023-23752

CVE-2023-23752 — Joomla! ⚠️ Disclaimer: This tool is intended for educational purposes and authorized penetration testing only. Use it only against systems you own or have explicit written permission to test. Unauthorized use is illegal. Table of Contents Overview Vulnerability Details How It Work...

Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

Frigate < 0.13.0 Beta 3 - Cross-Site Scripting

Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both kn...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 is an authentication bypass resulting in an information leak on Joomla! Servers. Although rated as a CVSSv3 5.3 Medium severity by NVD, this vulnerability could allow an attacker to achieve code execution under the right circumstances. That likely justifies the...

py3webfuzz

Py3webFuzz ';-- Python Web Fuzzing module Library Python3 Module Compatible Author Jonathan Angeles @ex0day Github: https://github.com/jangelesg/py3webfuzz Contributors Nathan Hamiel @nathanhamiel DESCRIPTION Based on pywebfuzz, Py3webfuzz is a Python3 module to assist in the identification of...

grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads

A flaw in Grafana's API endpoints allows remote attackers to send excessively large request bodies without authentication. This exhausts server memory, resulting in a complete denial of service DoS...

CVE-2026-102260

HashiCorp Nomad and Nomad Enterprise are susceptible to a cross-namespace authorization bypass in several read-only API endpoints. This vulnerability (linked to CWE-863 ) allows an authenticated user possessing read permissions in one namespace to access and view information about objects located...

EUVD-2026-113317

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability CVE-2026-102260 is...

CVE-2026-102260 Nomad vulnerable to cross-namespace information disclosure in multiple endpoints

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability CVE-2026-102260 is...

CVE-2023-23752-poc

Affected versions: 4.0.0 = 4.2.8 Joomla 3 and below are not affected by this vulnerability. http://127.0.0.1/Joomla/api/index.php/v1/config/application?public=true This API is used to obtain the most important configuration information of the website, including the database username and password...

CVE-2026-35616-detector.py

CVE-2026-35616 - FortiClient EMS Vulnerability Detector Description This tool detects if a FortiClient EMS server is vulnerable to CVE-2026-35616 , a critical improper access control vulnerability affecting versions 7.4.5 through 7.4.6. CVSS Score: 9.1 Critical CWE: CWE-284 Improper Access Contro...

CVE-2023-2732

CVE-2023-2732 Mstore WordPress APIs Vulnerable Scanner is a powerful and user-friendly tool designed to identify potential vulnerabilities in WordPress sites by inspecting their API endpoints. The scanner aims to assist website owners, developers, and security professionals in proactively...

halo-cors-csrf-CVE-2026-67921

CVE-2026-67921: Halo CMS CORS Misconfiguration + CSRF Protection Bypass Combined Attack Summary A critical combined attack vulnerability exists in Halo CMS versions up to 2.25.4 due to two security misconfigurations: 1. CORS Misconfiguration : The CORS policy allows any origin with credentials:...

CVE-2022-36804

CVE-2022-36804 Atlassian Bitbucket Server and Data Center - Command Injection Vulnerability CVE-2022-36804 In affected versions of Atlassian Bitbucket Server and Data Center a Command Injection Vulnerability exists in multiple API endpoints where an attacker with access to a public repository or...