reconspider

Most Advanced Open Source Intelligence OSINT Framework ReconSpider ReconSpider is most Advanced Open Source Intelligence OSINT Framework for scanning IP Address, Emails, Websites, Organizations and find out information from different sources. ReconSpider can be used by Infosec Researchers,...

security-monitoring-agent

Sentinel · Local vulnerability monitoring A local Windows + W...

Automated-blind-xss-search-for-Burp-Suite

Femida-xss WIP An automated blind-xss search plugin for Burp Suite. Installation Git clone https://github.com/ianxtianxt/Automated-blind-xss-search-for-Burp-Suite.git Burp - Extender - Add - find and select blind-xss.py How to use Settings First of all you need to setup your callback URL in field...

OpenNebula-CVE-2025-56537

OpenNebula-CVE-2025-56537 Exploit Title : OpenNebula 6.10.0.1 - Stored XSS Cross-site Scripting in virtual network template Exploit Author : Mark Artamonov Vendor Homepage : https://opennebula.io/ Tested Version : OpenNebula 6.10.0.1 Affected Versions : OpenNebula Proof of Concept : Fix : Upgrade...

SneeitScanner-CVE-2025-6389

SneeitScanner-CVE-2025-6389 SneeitScanner - PoC & Scanner for Unauthenticated RCE in Sneeit Framework CVE-2025-6389 ⚡ SneeitScanner ⚡ Proof of Concept PoC and Automated Scanner for Unauthenticated RCE in Sneeit Framework CVE-2025-6389 This robust Python script is a functional PoC and scanner tool...

CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC

CVE-2018-16763 — Fuel CMS 1.4.1 Remote Code Execution PoC Unauthenticated RCE vulnerability in Fuel CMS 1.4.1. The filter parameter in the /fuel/pages/select/ endpoint is passed unsanitized to a eval call in the PHP backend, allowing arbitrary code execution via a crafted payload. Unlike blind...

HTB-Mailing-A-Complete-Walkthrough

HTB: Mailing — A Complete Walkthrough By Mursalin If you've been grinding through HackTheBox machines, Mailing is one of those boxes that genuinely teaches you something. It's rated Easy, runs on Windows, and chains together a few real-world vulnerabilities — a directory traversal, a credential...

TheLastBundleMismatch

Mysterious patch Let's start this time with the patch that appeared as fix for CVE-2023-45777 in Android Security Bulletin: diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java b/services/core/java/com/android/server/accounts/AccountManagerService.java index...

CVE-2021-20323

CVE-2021-20323 Description Keycloak before 18.0.0 and after 10.0.0 contains a reflected XSS on the clients-registrations endpoint. The bug is triggered by providing, by POST, a json structure with a key as parameter name that is not supported by the endpoint. The response return reflects the json...

CVE-2026-79956 Improper Sanitization leads to Command Injection in AOS-8 Web Interface

A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to...

CVE-2026-79956 Improper Sanitization leads to Command Injection in AOS-8 Web Interface

A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to...

CVE-2026-79956

The AOS-8 Web Interface is vulnerable to a Command Injection flaw caused by improper sanitization . While the provided documents do not specify the exact affected versions or the root cause in depth, the vulnerability allows for remote command execution. No specific remediation steps, exploit lin...

CVE-2026-20245---Cisco-SD-WAN-Privilege-Escalation-Exploit

CVE-2026-20245 - Cisco SD-WAN Privilege Escalation Exploit ⚠️ WARNING This code is ONLY for educational purposes and authorized security testing. 📋 Description CVE-2026-20245 is a privilege escalation vulnerability in the CLI of Cisco Catalyst SD-WAN Controller vSmart, Cisco Catalyst SD-WAN Manage...

CVE-2026-30655

CVE-2026-30655 — SQL Injection in esiclivre password reset Summary A SQL injection vulnerability exists in the password reset endpoint of esiclivre. An unauthenticated attacker can inject SQL via the cpfcnpj POST parameter, potentially resulting in unauthorized access to sensitive information...

CVE-2026-24416

CVE-2026-24416: OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module Overview Field| Details ---|--- CVE ID| CVE-2026-24416 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: = 2.9.8 CWE Classification...

filebuster

Filebuster An extremely fast and flexible web fuzzer What is it? Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world of PERL - Furl::HTTP. Also the thread modelling is optimized to...

CVE-2025-52204

CVE-2025-52204 – Reflected XSS / HTML Injection in Znuny customer.pl endpoint Summary A Reflected Cross-Site Scripting XSS and HTML Injection vulnerability exists in Znuny, allowing attackers to inject arbitrary JavaScript or HTML via the parameter defined by the system configuration...

CVE-2025-65321

CVE-2025-65321 The Language Sloth Discord bot is vulnerable to Directory Traversal in the gif and png functions. The functions build file paths using unsanitized user input for the 'name' parameter, allowing attackers to reference files outside the intended resource directories. The functions "gi...

malboxes

= Malboxes :toc: preamble :toclevels: 2 :twob: https://twitter.com/obilodeau :twhg: https://twitter.com/hugospns // github stuff ifdef::env-github:github: ifndef::github // local logo image::docs/logos/main.svgMalboxes Logo endif:: ifdef::github // logo on github...

Phantom-Signature-Attack

This research paper presents a comprehensive cryptanalytic study of critical vulnerabilities in the Bitcoin protocol’s digital signature implementation, namely the Phantom Signature Attack CVE-2025-29774 and the fundamental SIGHASHSINGLE processing error . The study demonstrates that incorrect...