wordlist_generator

wordlistgenerator Das Tool wordlistgenerator generiert eine für Ihr Ziel einzigartige Wortliste mit Techniken, die in tomnomnoms Video "Who, What, Where, When" erwähnt werden. Es verwendet URLs von gau, um Verzeichnisse, Dateinamen oder Wörter auf Seiten zu extrahieren. Als zusätzliche Funktion...

vbsmin

VBSmin VBScript minifier Features ⬜️ Remove extra whitespace Trailing whitespace Leading whitespace Blank lines Inline extra spaces 💬 Remove comments Single quote start of the line Single quote inline REM 1️⃣ One-line Line splitting underscore Colon Quick start Quick install root@kitploit: $ gem...

CVE-2024-3640_WafBypass

CVE-2024-3640 WafBypass Exploração do plugin woodpacker A forma de bypass é na verdade inserir comentários XML para contornar palavras-chave. Detecção de atraso Execução de comando com retorno Webshell personalizado na memória...

ccs

Code Credential Scanner यह स्क्रिप्ट एक बड़े, विविध कोडबेस में हार्ड-कोडेड क्रेडेंशियल्स, या कॉन्फ़िगरेशन फ़ाइलों में मौजूद क्रेडेंशियल्स को स्कैन करने के लिए है। ये एक गंभीर सुरक्षा समस्या का प्रतिनिधित्व करते हैं, और इन्हें पहचानना और प्रबंधित करना अत्यंत कठिन हो सकता है। इस स्क्रिप्ट का विशिष्...

CVE-2026-47665

Penpot , an open-source design and prototyping platform, is affected by a stored cross-site scripting vulnerability in versions up to and including 2.14.3 . Comment content on shared files is stored as raw text and rendered via innerHTML without sanitization; the backend applies only a length che...

CVE-2021-42697

Akka HTTP 10.1.x anterior a 10.1.15 e 10.2.x anterior a 10.2.7 podem encontrar exaustão de pilha ao analisar cabeçalhos HTTP, o que permite que um atacante remoto realize um ataque de Negação de Serviço ao enviar um cabeçalho User-Agent com comentários profundamente aninhados. Referências MITRE...

mitigation-cve-2019-9787

mitigation-cve-2019-9787 POC 1. semplice xss : 2. semplice csrf: codice del sito web dell'attaccante--- https://github.com/kuangting4231/wordpress.github.io 3. csrf esecuzione remota di codice: codice del sito web dell'attaccante--- https://github.com/kuangting4231/assigment1.github.io mitigazion...

CVE-2023-47437

CVE-2023-47437 Pachno Schwachstelle für gespeichertes Cross-Site-Scripting https://vulners.com/cve/CVE-2023-47437 Beschreibung: In Pachno wurde eine Schwachstelle identifiziert, die es einem authentifizierten Angreifer ermöglicht, einen Angriff mit gespeichertem Cross-Site-Scripting XSS...

PoC-CVE-2025-62222

PoC: CVE-2025-62222 - GitHub Copilot Chat RCE Este repositório contém uma Prova de Conceito PoC para a vulnerabilidade CVE-2025-62222. Demonstra como é possível alcançar a Execução Remota de Código RCE na máquina de um desenvolvedor manipulando o contexto do GitHub Copilot Chat no VS Code por mei...

YT-Spammer-Purge

YouTube Spammer Purge Cos'è? - Consente di filtrare e cercare commenti spam sul tuo canale e su canali altrui in molti modi diversi E cancellarli/segnalarli tutti insieme vedi funzionalità sotto. Come scaricare: Clicca sul collegamento "Releases" a destra, poi sulla release più recente, sotto...

CVE-2024-7514

CVE-2024-7514 WordPress Comments Import & Export = 2.3.7 - Lettura arbitraria di file da parte di utenti autenticati Autore+ tramite Directory Traversal Descrizione Il plugin WordPress Comments Import & Export per WordPress è vulnerabile alla lettura arbitraria di file a causa di una validazione...

CVE-2021-44217

CVE-2021-44217 Descrizione suggerita In Ericsson CodeChecker fino alla versione 6.18.0, una vulnerabilità di Cross-site scripting XSS persistente nel componente dei commenti del visualizzatore di report consente ad attaccanti remoti di iniettare script web o HTML arbitrari tramite i dati JSON POS...

Show all comments < 7.0.1 - Cross-Site Scripting

The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin. id: CVE-2022-4295 info: name: Show all commen...

EUVD-2025-210791

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

CVE-2025-70340

A Broken Access Control vulnerability in ThingsBoard Professional Edition (PE) 4.21 and below affects the Alarms comments functionality. An authenticated customer user can manipulate API request parameters to create or modify system-generated alarm comments , enabling impersonation of system mess...

POC-CVE-2023-3244

Prova di concetto per CVE-2023-3244 Ciao, questa è una semplice Prova di Concetto PoC per la vulnerabilità CVE-2023-3244 trovata nel plugin WordPress "comments-like-dislike". La vulnerabilità interessa le versioni del plugin fino alla 1.2.0 inclusa. Per sfruttare questa vulnerabilità, puoi fare...

drinkme

drinkme drinkme is a shellcode test harness. It reads shellcode from stdin and executes it. This allows pentesters to quickly test their payloads before deployment. Formats drinkme can handle shellcode in the following formats: "0x" "\x" "x" "" For example, NOP could be represented as any of...

hardcodes

hardcodes extract strings from source code...

WordPress Core <6.5.2 - Cross-Site Scripting

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. id: CVE-2024-4439 info: name: WordPress Core 6.5.2 - Cross-Site Scripting author: nqdung2002 severity: hi...

CVE-2026-38472

GazellePW (GazellePosterWall) contains a Stored XSS vulnerability in its forum reward comments feature, identified at commit 86c4bedf727691b5a97af42a4864869d18446449 . Remote attackers can inject arbitrary JavaScript through the c parameter in /forums.php?action=ajax_get_jf. The injected payload ...