snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

SourceCodester Stock Management System 1.0 - SQL Injection Authentication Bypass

SourceCodester Stock Management System 1.0 contains a SQL injection vulnerability in the login function at /sms/classes/Login.php. The username parameter is directly interpolated into an SQL query without sanitization, allowing an unauthenticated attacker to bypass authentication and gain admin...

detection-defense-library

Detection Defense Library One defense-engineering library, consolidated. Attack classes, the patterns that detect them, the committed Sigma rules, and the Windows trust-boundary model, all in a single repo. This repo folds in five former sibling repositories: Former repo| Folded into| What it hol...

frida

Frida Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Learn more at frida.re. Two ways to install 1. Install from prebuilt binaries This is the recommended way to get started. All you need to do is: pip install frida-tools CLI tools pip install frida...

frida-ios-hook

Frida iOS hook 📍 A tool that helps you can easy using frida. It support script for trace classes, functions, and modify the return values of methods on iOS platform. 👉 For Android platform: frida-android-hook 👉 For Intercept Api was encrypted on iOS application: frida-ios-intercept-api Env OS...

bug-reaper

BugReaper Structured web2 bug bounty AI skill — 18 vulnerability classes, 4 bug bounty platforms, zero AI slop. Compatible with OpenClaw, Cursor, Claude Code, Antigravity, and Windsurf. BugReaper is an Agent Skill that turns any compatible AI agent into a disciplined web2 bug bounty hunter. It...

ActiveMQ_CVE-2023-46604

ActiveMQCVE-2023-46604 Python implementation for rapidly constructing concurrent data traffic packets; both gadget classes are implemented, org.springframework.context.support.FileSystemXmlApplicationContext and org.springframework.context.support.ClassPathXmlApplicationContext, FileSystemXml can...

CVE-2026-0847

CVE-2026-0847 — NLTK Multiple CorpusReader Classes: Arbitrary File Read via Path Traversal -orange?style=for-the-badge Overview Field| Details ---|--- CVE ID| CVE-2026-0847 Package| nltk Natural Language Toolkit Registry| PyPI Affected Versions| = 3.9.2 Vulnerability Type| CWE-22: Path Traversal...

VulnerableGWTApp

Vulnerable GWT Web Application This is a version of the StockWatcher example application described in the GWT getting-started guide that has been modified to use the GWT "enhanced classes" feature, making it vulnerable to a Java deserialization attack. It should only be used for testing detection...

CVE-2026-125339

Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token...

CVE-2026-125339

Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token...

CVE-2026-125339

Winter CMS versions 1.0.319 through 1.2.13 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw because Backend\Classes\Controller::actionExists() allows public handler-shaped methods to be invoked via top-level GET requests. Since the system uses Route::any, CSRF validation is bypassed for...

CVE-2026-124570

A vulnerability was detected in SourceCodester Online Leave Management System 1.0. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performing a manipulation of the argument employee avatar filename results in cross site...

EUVD-2026-119811

A vulnerability was detected in SourceCodester Online Leave Management System 1.0. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performing a manipulation of the argument employee avatar filename results in cross site...

CVE-2026-124570 SourceCodester Online Leave Management System Employee Avatar Upload Extension Master.php cross site scripting

A vulnerability was detected in SourceCodester Online Leave Management System 1.0. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performing a manipulation of the argument employee avatar filename results in cross site...

CVE-2026-124570

A cross-site scripting (XSS) vulnerability exists in the SourceCodester Online Leave Management System 1.0 within the Employee Avatar Upload Extension . The flaw is located in an unknown function of the file app/classes/Master.php . Attackers can achieve remote execution by manipulating the emplo...

CVE-2026-124570 SourceCodester Online Leave Management System Employee Avatar Upload Extension Master.php cross site scripting

A vulnerability was detected in SourceCodester Online Leave Management System 1.0. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performing a manipulation of the argument employee avatar filename results in cross site...

CLSA-2026-1794173371 TuxCare security update for io.netty:netty-transport-classes-epoll (1 CVE)

TuxCare rebuilt io.netty:netty-transport-classes-epoll to address 1 CVE. Fixed in 4.1.79.Final-tuxcare.6...

CVE-2026-70410

A flaw was found in Apache Calcite Avatica. This vulnerability, categorized as 'Unsafe Reflection', allows an attacker to provide externally-controlled input during plugin instantiation. This input can lead to the initialization of arbitrary classes, potentially executing static initializer block...

Linux Distros Unpatched Vulnerability : CVE-2026-112907

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with readlockfile and...