CVE-2026-15916

Drupal core 's Image module suffers from a missing authorization flaw (forceful browsing) that allows information disclosure of image style derivatives. The module does not sufficiently check access when derivative files are served via a file stream other than private://. The vulnerability is mit...

CVE-2026-16644

An incorrect authorization flaw in the Drupal Webform REST contrib module (which exposes webform submissions via REST endpoints) allows forceful browsing . The module does not sufficiently validate the parent webform's permissions for create, view, and update operations. The advisory classifies t...

CVE-2026-16645

Drupal PhotoSwipe (contrib module) contains a missing authorization flaw in its image gallery display formatter that allows forceful browsing of images. The module failed to sufficiently check access permissions when viewing images via the lightbox gallery formatter. Affected versions are < 3....

CVE-2026-18985

CVE-2026-18985 is an Incorrect Authorization vulnerability in the Drupal contrib module Edit in-place field (versions 0.0.0 through 2.1.1). The module provides formatters for in-place editing within Views and other displays but does not sufficiently verify access when editing entities, allowing a...

PartyLoud

Partyloud Retrouvez votre vie privée Générez une fausse navigation web et atténuez le pistage CodeFactor PartyLoud est un outil gratuit hautement configurable et simple qui vous aide à empêcher le pistage directement depuis votre terminal Linux, sans compétences particulières. Une fois démarré,...

feroxbuster

!WARNING Security Notice – Domain Impersonation The domain feroxbuster.com is NOT affiliated with this project, its maintainers, or any official feroxbuster releases. Official feroxbuster downloads are distributed ONLY through: https://github.com/epi052/feroxbuster open source...

BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection

A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/deleteStudy.php. The manipulation of the argument documentUniqueId leads to sql injection. It is possible to initiate the attack...

Piwigo < 16.3.0 - Unauthenticated Information Disclosure via History API

Piwigo = 16.3.0 contains an information disclosure vulnerability caused by the pwg.history.search API method lacking adminonly restriction, letting unauthenticated users access full browsing history, exploit requires no authentication id: CVE-2026-27833 info: name: Piwigo 16.3.0 - Unauthenticated...

CVE-2022-43110

CVE-2022-43110 Дополнительная информация Voltronic Viewpower/Pro и ребрендинги/производные Программное обеспечение для управления ИБП должно позволять только надлежащим образом аутентифицированному и авторизованному администратору настраивать систему через веб-интерфейс. Из-за CWE-425: прямой...

EvilNeko

EvilNeko EvilNeko — это проект для автоматизации оркестровки контейнеров и реализации атак Browser in the Browser BITB для красных команд. Вдохновлён исследованиями, проведёнными Mr. d0x здесь, и развивает идеи проекта EvilNoVNC. Цель проекта — улучшить существующие открытые инструменты для...

psc

PortShellCrypter -- PSC This project - as well as its sister project crash - belongs to my anti-censorship tool-set that allows to setup fully working encrypted shells and TCP/UDP forwarding in hostile censoring environments. It is also useful for forensics to dump data from devices via UART or...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

CVE-2006-3392

这是一个简单的工具，用于利用 Webmin 1.290 / Usermin 1.220 - 任意文件披露漏洞。 使用方法： 1. 运行脚本 python exploit.py。 2. 输入端口号。 3. 选择你想要查看的文件夹。 ⛔ 重要提示 ⛔ 我们不对使用此脚本进行不道德行为负责。...

mitaka

Mitaka Mitaka is a browser extension that makes your OSINT Open Source Intelligence search & scan easier. Key features: Auto IoC indicators of compromise selection with refanging. E.g. example.com to example.com, testatexample.com to [email protected], hxxp://example.com to http://example.co...

firefox: thunderbird: Mitigation bypass in the Safe Browsing component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Safe Browsing component...

firefox: thunderbird: Mitigation bypass in the Safe Browsing component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Safe Browsing component...

firefox: thunderbird: Mitigation bypass in the Safe Browsing component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Safe Browsing component...

CVE-2026-77815 Infinite Image Browsing Resolves Paths With normpath, Allowing Symlink Escape From Scanned Directories

toabspath in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by ispathtrusted in scripts/iib/api.py while...

CVE-2026-77814 Infinite Image Browsing is_path_trusted Prefix Comparison Omits the Trailing Path Separator

ispathtrusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswithparentpath, without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed ...

CVE-2026-77814 Infinite Image Browsing is_path_trusted Prefix Comparison Omits the Trailing Path Separator

ispathtrusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswithparentpath, without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed ...