CVE-2026-104073

NetBox versions 2.9.5 before 4.7.0 are vulnerable to a server-side template injection vulnerability. A low-privileged user with the "Can add custom links" permission can exploit this by exposing the raw Django HttpRequest object to the Jinja2 template context. An attacker can craft a custom link ...

EUVD-2026-93611

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106422

Google Chrome versions prior to 155.0.8059.39 are vulnerable to an incorrect authorization flaw in an API. This vulnerability allows a remote attacker to bypass web origin policy by using a crafted HTML page. The security severity is rated as Low by Chromium. No specific exploit information is pr...

CVE-2026-106422

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106420

Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-106208

Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-106208

Google Chrome versions prior to 155.0.8059.39 are vulnerable to an improper authorization flaw within its API. A remote attacker can leverage social engineering to trick a user into installing a crafted Chrome extension , which can then be used to leak sensitive information . No specific exploit ...

SearchOrg

SearchOrg En mettant le domaine de messagerie d'une entreprise, on obtient des informations en utilisant le DNS, NMAP et Shodan À noter Sur la machine, NMAP doit être installé pour pouvoir utiliser la commande Vous devez avoir un compte Shodan et charger l'APIKey à l'endroit indiqué dans le scrip...

AuroraStore

Aurora Store Aurora Store позволяет вам искать и скачивать приложения из официального магазина Google Play. Вы можете просматривать описания приложений, скриншоты, обновления, отзывы и загружать APK напрямую с Google Play на ваше устройство. Чтобы использовать Aurora Store, войдите в систему с...

should-i-trust

should-i-trust Résumé should-i-trust est un outil pour évaluer les signaux OSINT d'un domaine. Prérequis should-i-trust nécessite des clés API provenant des sources suivantes : Censys.io - Gratuit pour les 250 premières requêtes par mois VirusTotal - Gratuit GrayHatWarFare - Gratuit avec des...

CVE-2017-5487

PoC - CVE-2017-5487 - WordPress User Enumeration via REST Setup git clone https://github.com/ndr-repo/CVE-2017-5487.git powershell -noexit -ExecutionPolicy Bypass -File .ps1 Usage .\Enumerate-WordPressOrgMembersREST.ps1 Alternate Route 1 for WAF Bypass...

fbchecker

ABANDONNÉ Facebook bloque plusieurs accès via leur API VÉRIFICATEUR DE COMPTES EN MASSE FACEBOOK Vérificateur de comptes en masse Facebook sans compte verrouillé Installation simple : apt install git php -y git clone https://github.com/fdciabdul/fbchecker cd fbchecker php fbcheck.php Utilisation...

godehashed

Godehashed A golang tool that uses the dehashed.com API to search for compromised assets. Results can then be compiled into a CSV for further analysis. Screenshot Dehashed API You must supply the tool an api key. See apikeytemplate.txt for example. Installation To install the tool in CLI run the...

CVE-2020-12593

CVE-2020-12593 CVE-2020-12593 POC Symantec EDR on-prem version prior to "4.5" is prone to an information disclosure vulnerability via the following URL : https://@IPEDR/atpapi/v2/policies/blacklist Reference...

POC_CVE-2026-46716

CVE-2026-46716 — Nezha Monitoring Cross-Tenant RCE via Cron API Authorization Bypass A lab environment for reproducing and detecting CVE-2026-46716 , a critical vulnerability in Nezha Monitoring where the POST /api/v1/cron endpoint lacks admin privilege checks, allowing RoleMember users to achiev...

API-SPY-API-PROBE

API-SPY 🕵️👻 A powerful directory brute-force tool designed for API reconnaissance and penetration testing. Automatically discovers hidden API endpoints, performs recursive subscanning, and probes HTTP methods for deeper API enumeration. Features ✨ Core Capabilities: 🎯 Fast endpoint discovery using...

CVE-2026-63030-Wp2Shell

CVE-2026-63030 wp2shell — WordPress Core Pre-Auth RCE REST API batch route confusion chained with CVE-2026-60137 SQL injection TL;DR — An unauthenticated attacker can chain a WordPress REST API batch-routing bug with a SQL injection in WPQuery to reach full remote code execution on a stock...

CVE-2026-105849

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2025-71384

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...

CVE-2025-71383

Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request from the local Wi-Fi network that lacks a /api/login username or password field. This occurs because of an error in a JSON parser...