CVE-2026-114490

Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server...

CVE-2026-114470

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

CVE-2026-114476

Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manageroles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin...

sj

sj Swagger Jacker sj is a command line tool designed to assist with auditing of exposed Swagger/OpenAPI definition files by checking the associated API endpoints for weak authentication. It also provides command templates for manual vulnerability testing. It does this by parsing the definition fi...

Monitor

Project Description Used for implementing privilege persistence during the post-exploitation testing phase Project Usage Step 1 : Download the project, then compile Monitor.cpp using VS. Of course, you can also use the pre-compiled one. The Monitor.cpp code is as follows: include "Windows.h" int...

Inspeckage

Inspeckage - Android Package Inspector Inspeckage is a tool developed to offer dynamic analysis of Android applications. By applying hooks to functions of the Android API, Inspeckage will help you understand what an Android application is doing at runtime. http://ac-pm.github.io/Inspeckage...

FOFA-API-Threaded-Searcher

FOFA API Threaded Searcher A powerful multi‑threaded Python tool to query the FOFA Fofa.so API, extract selected fields, and save unique results with intelligent formatting. ✨ Features Multi‑threaded – Fetch multiple pages concurrently configurable threads Custom fields – Choose any valid FOFA...

crtsh

crtsh API client for crt.sh crtsh allows to get the information about a HTTPS website. e.g. Search subdoimains. This tool uses Certificate Transparency logs. For more information, check https://crt.sh/ Example Subdomains Search subdomains of example.com Organization In --query, % can be used as...

reposcanner

Reposcanner Reposcanner is a python script to search through the commit history of Git repositories looking for interesting strings such as API keys, inspired by truffleHog. Installation The python Git module is required python3-git on Debian. Docker docker build -t reposcanner . docker run -it...

CVE-2026-22038

CVE-2026-22038 — AutoGPT Stagehand Blocks Log API Keys in Plaintext CVE ID: CVE-2026-22038 Product: AutoGPT Platform Stagehand integration Affected Versions: All versions up to and including autogpt-platform-beta-v0.6.45 Patched In: autogpt-platform-beta-v0.6.46 Vulnerability Type: CWE-532 —...

Exploit for CVE-2026-52887

nocobase-cve-2026-52887 NocoBase security research and exploi...

kong-pwn

kong-pwn Use Exposed KongAPI to act like a proxy and get metadata urls or internal urls. CVE-2020-11710 - It's not a vuln it's a misconfiguration. How to use usage: kong-pwn.py -h -u URL -s SSRF -p PROXY kong-pwn.py: error: the following arguments are required: -u/--url, -s/--ssrf Example $ pytho...

ScratchABit

ScratchABit ScratchABit is an interactive incremental disassembler with data/control flow analysis capabilities. ScratchABit is dedicated to the efforts of the OpenSource reverse engineering community reverse engineering to produce OpenSource drivers/firmware for hardware not properly supported b...

CVE-2026-114490 Incorrect Authorization in hMailServer

Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server...

CVE-2026-114490

Progressive Robot hMailServer versions 6.3.4 through 6.3.6 contain an incorrect authorization vulnerability in the COM administration API . The root cause is that the COM API's server-administrator check fails to respect domain restrictions for accounts with the serveradmin role, treating them as...

EUVD-2026-107329

Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server...

CVE-2026-114489 Missing Authorization in hMailServer

Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A doma...

EUVD-2026-107328

Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A doma...

CVE-2026-114489

Progressive Robot hMailServer versions 6.0.0 through 6.3.6 are vulnerable to missing authorization in the REST and COM administration APIs . This flaw allows a remote authenticated user with credentials confined to named domains to modify mail routing and domain configurations outside their scope...

waf-bypass

WAF Bypass Tool WAF Bypass Tool is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. Check your WAF before an attacker does. WAF Bypass Tool is developed by Nemesida WAF team with the participation of...