py3webfuzz

Py3webFuzz ';-- Python Web Fuzzing module Library Python3 Module Compatible Author Jonathan Angeles @ex0day Github: https://github.com/jangelesg/py3webfuzz Contributors Nathan Hamiel @nathanhamiel DESCRIPTION Based on pywebfuzz, Py3webfuzz is a Python3 module to assist in the identification of...

API-s-for-OSINT

APIs For OSINT This is a Collection of APIs that will be useful for automating various tasks in OSINT. Instruction for total beginners: OSINT automation: using сustom functions for working with API requests in Google Sheets Thank you for following me! https://cybdetective.com Table of contents AP...

CodeChecker <= 6.24.1 - Authentication Bypass

Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. id: CVE-2024-10081 info:...

Frigate < 0.13.0 Beta 3 - Cross-Site Scripting

Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both kn...

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

rewerse-engineering

rewerse engineering An unofficial REWE API client in Go and Python. It implements the publicly accessible unauthenticated endpoints the REWE app uses for querying current discounts Angebote, products, markets and recalls. Current supported APK version: 5.18.1 as of 29.09.26 !CAUTION The...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

py3webfuzz

Py3webFuzz ';-- Python Web Fuzzing 模块库 Python3 模块兼容 作者 Jonathan Angeles @ex0day Github: https://github.com/jangelesg/py3webfuzz 贡献者 Nathan Hamiel @nathanhamiel 描述 基于 pywebfuzz，Py3webfuzz 是一个 Python3 模块，用于通过暴力破解、模糊测试和分析来辅助识别 Web 应用程序和 Web 服务中的漏洞。该模块通过提供常见的测试值、生成器和其他实用程序，在模糊测试 Web 应用程序、API 端点以及开发 W...

EntraTrace

EntraTrace EntraTrace es una herramienta de investigación de seguridad defensiva para documentar e identificar el comportamiento observable de herramientas ofensivas dirigidas a Microsoft Entra ID. El proyecto construye una base de conocimiento automática en torno a herramientas como AzureHound,...

CVE-2025-24893-XWiki-RCE

📜 描述 XWiki 中存在一个严重 RCE 漏洞 ，允许未经身份验证的攻击者 通过易受攻击的 API 端点执行任意系统命令。 利用该漏洞可能导致： 完全接管服务器 数据窃取或破坏 横向渗透内部网络 💥 影响 完全攻陷 受影响的 XWiki 实例及底层操作系统。 丧失机密性、完整性和可用性 。 🛠 修复 / 缓解措施 升级 到最新的修补版本（）。 限制 或禁用易受攻击的 API 端点。 应用 WAF 规则 阻止恶意载荷。 漏洞利用： SHODAN DORK : http.title:"XWiki" 使用方法： git clone...

CVE-2022-36804

CVE-2022-36804 Atlassian Bitbucket Server y Data Center - Vulnerabilidad de Inyección de Comandos CVE-2022-36804 En las versiones afectadas de Atlassian Bitbucket Server y Data Center existe una vulnerabilidad de inyección de comandos en múltiples endpoints de API donde un atacante con acceso a u...

Atlassian-Bitbucket-CVE-2022-36804

Atlassian-Bitbucket-Server-CVE-2022-36804 在 Atlassian Bitbucket Server 和 Data Center 的多个 API 端点中发现了一个严重的命令注入漏洞。该漏洞影响所有低于 、、、、、 和 版本的 Bitbucket Server 和 Data Center。 CVE-2022-36804 实验环境 构建 Docker docker build -t bitbucket . 运行 Docker docker run -it bitbucket 使用 cve-2022-36804.py 检查远程代码执行 RCE pytho...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 is an authentication bypass resulting in an information leak on Joomla! Servers. Although rated as a CVSSv3 5.3 Medium severity by NVD, this vulnerability could allow an attacker to achieve code execution under the right circumstances. That likely justifies the...

NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

CVE-2023-23752

CVE-2023-23752 — Joomla! ⚠️ Aviso: Esta herramienta está destinada exclusivamente a fines educativos y pruebas de penetración autorizadas. Úsala únicamente contra sistemas que te pertenezcan o para los que tengas permiso explícito por escrito. El uso no autorizado es ilegal. Tabla de contenidos...

CVE-2026-100647

A flaw was found in vLLM. An unauthenticated remote attacker can cause a Denial of Service DoS by sending HTTP requests containing an excessively large cachesalt parameter to exposed API endpoints. Because this input lacks maximum length validation, processing the oversized data consumes excessiv...

cve-2022-36804

CVE-2022-36804：Atlassian Bitbucket Server 中的预认证 RCE 在 Atlassian Bitbucket Server 和 Data Center 的多个 API 端点中发现了一个严重命令注入漏洞。该漏洞影响所有版本低于 、、、、、 和 的 Bitbucket Server 和 Data Center。 CVE-2022-36804 实验环境 构建 Docker docker build -t bitbucket . 运行 Docker docker run -it bitbucket cve-2022-36804.py 用法...

CVE-2023-2732

CVE-2023-2732 Mstore WordPress APIs Vulnerable Scanner is a powerful and user-friendly tool designed to identify potential vulnerabilities in WordPress sites by inspecting their API endpoints. The scanner aims to assist website owners, developers, and security professionals in proactively...

CVE-2026-41473-CyberPanel-AI-Scanner-Unauth

CVE-2026-41473 — Acceso no autenticado de lectura/escritura a la API de AI Scanner de CyberPanel Plantilla de detección de Nuclei para CVE-2026-41473 que afecta a versiones de CyberPanel anteriores a 2.4.4. Vulnerabilidad La función AI Scanner de CyberPanel expone dos endpoints de API sin...

halo-cors-csrf-CVE-2026-67921

CVE-2026-67921: Halo CMS CORS Misconfiguration + CSRF Protection Bypass Combined Attack Summary A critical combined attack vulnerability exists in Halo CMS versions up to 2.25.4 due to two security misconfigurations: 1. CORS Misconfiguration : The CORS policy allows any origin with credentials:...