CVE-2026-1337

CVE-2026-1337 - Neo4j - Log Injection Log injection by an authenticated user is possible in the Neo4j query.log when Neo4j is not configured to be in json format. Summary Neo4j does not escape control characters in the metadata field when of a bolt transaction. An autenticated user could send...

stegcloak

StegCloak The Cloak of Invisibility for your texts StegCloak is a pure JavaScript steganography module designed in functional programming style, to hide secrets inside text by compressing and encrypting the secret before cloaking it with special unicode invisible characters. It can be used to...

stegcloak

StegCloak La Capa de Invisibilidad para tus textos StegCloak es un módulo de esteganografía puro en JavaScript diseñado con un estilo de programación funcional, para ocultar secretos dentro de texto comprimiendo y cifrando el secreto antes de camuflarlo con caracteres Unicode invisibles especiale...

weakpass

Weakpass Here, you can find the list of tools and example of API server from weakpass.com for password and hash cracking in one place. 📂 Folder Structure tools A collection of password and hash cracking tools. Check them out: Kraker-js Lookup Passcheck Passgen libs Links to the libraries used in...

shiro-cve-2020-17523

Apache Shiro Two Postures Authentication Bypass Analysis CVE-2020-17523 0x01 Vulnerability Description Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro's easy-to-understand API, you can...

boa-cve-2009-4496-analysis

CVE-2009-4496 — Defensive Vulnerability Analysis Overview This repository documents a defensive analysis of CVE-2009-4496 , a historical vulnerability associated with the Boa web server. The objective of this project is to examine the vulnerability from a defensive security perspective through:...

L1B3RT4S

L1B3RT45...

unicode-control-characters-action

Unicode Control Characters Action A GitHub Action to find Unicode control characters using the Red Hat diagnostic tool https://access.redhat.com/security/vulnerabilities/RHSB-2021-007 to detect RHSB-2021-007 Trojan source attacks CVE-2021-42574,CVE-2021-42694 Inputs args Required The script...

sharesniffer

sharesniffer sharesniffer is a network analysis tool for finding open and closed file shares on your local network. It includes auto-network discovery and auto-mounting of any open cifs and nfs shares. How to use Example to find all hosts on any local network with open/closed nfs/smb shares: pyth...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

CVE-2021-42574

Trojan Source:Invisible Vulnerabilities - Code generator — In simple terms, the vulnerability is that the code looks different from what it will be when compiled : The attack consists of using embedded control characters in comments and strings to reorder source code characters in a way that...

CVE-2026-104026

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

CVE-2026-104026

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

CVE-2026-104026

In Sapling SCM versions prior to v0.2.20260929-102736 , the software allows control characters to be embedded in Git subtree URLs . An attacker can exploit this by providing a maliciously constructed repository; if a target clones this repository, it can trigger code execution during otherwise re...

EUVD-2026-91648

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

CVE-2026-104026

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

SafeText

SafeText Herramienta para sanear texto y permitir la distribución segura de documentos de fuentes anónimas eliminando caracteres de ancho cero y homoglifos. Las personas que intentan filtrar un correo electrónico u otro archivo de texto corren el riesgo de ser identificadas mediante la toma de...

bst

Binary String Toolkit Summary The Binary String Toolkit or BST for short is a rather simple utility to convert binary strings to various formats suitable for inclusions in source codes, such as those used to develop exploits and Proof of Concepts in the security field. Features Convert and dump...

lazyCSRF

LazyCSRF LazyCSRF es un generador de PoC CSRF más útil que se ejecuta en Burp Suite. Sin mantenimiento futuro 🙇 Cuando empecé a desarrollar lazyCSRF, creí erróneamente que el generador de PoC CSRF integrado en Burp Professional no podía generar PoC usando XHR y no soportaba solicitudes PUT, etc...

bidi_char_detector

Detector de Caracteres BIDI Esta herramienta verifica la existencia de caracteres Unicode BIDI en tus archivos, los cuales pueden ser mal utilizados para ataques a la cadena de suministro para mitigar CVE-2021-42574. Esta herramienta fue escrita en Rust y se distribuye como un contenedor pequeño...