CVE-2026-117541

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize to throw a...

CVE-2026-117540

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic pregreplace pass...

CVE-2026-116894

REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend...

CVE-2026-116893

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rexapipackage API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like...

CVE-2026-116892

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG eve...

CVE-2026-116877

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using setrecurringevent without an end date to generate...

CVE-2026-116878

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL...

CVE-2026-116876

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move...

CVE-2026-116879

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced...

CVE-2026-116871

Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substanti...

CVE-2026-116872

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalizecompactform that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:... or has:... expressions to...

aDLL

aDLL - Adventure of Dinamic Lynk Library aDLL is a binary analysis tool focused on the automatic discovery of DLL Hijacking vulnerabilities. The tool analyzes the image of the binary loaded in memory to search for DLLs loaded at load-time and makes use of the Microsoft Detours library to intercep...

decker

Decker - Penetration Testing Orchestration Framework Purpose Decker is a penetration testing orchestration framework. It leverages HashiCorp Configuration Language 2 the same config language as Terraform to allow declarative penetration testing as code, so your tests can be versioned, shared,...

NinjaDroid

NinjaDroid NinjaDroid is a simple tool to reverse engineering Android APK packages. Published at: https://snapcraft.io/ninjadroid $ snap install ninjadroid --channel=beta Overview NinjaDroid uses AXMLParser together with a series of Python scripts based on aapt, keytool, string and such to extrac...

CVE-2025-55182-NextJS-Scanner-React2Shell-PoC

CVE-2025-55182 Exploitation Tool A comprehensive security research tool for testing Next.js React Server Components Remote Code Execution vulnerability CVE-2025-55182. Overview This toolkit provides automated detection and exploitation capabilities for CVE-2025-55182, a critical RCE vulnerability...

PartyLoud

Partyloud Get your privacy back Generate fake web browsing and mitigate tracking CodeFactor PartyLoud is a highly configurable and straightforward free tool that helps you prevent tracking directly from your linux terminal, no special skills required. Once started, you can forget it is running. I...

signatures

Signatures This repository is designed to provide a way to create and distribute detection signatures easily. Get creative with your own detection solutions, completely unencumbered by license limitations. To help combat evil, we firmly commit our work to the public domain for the greater good of...

rdg_scanner_cve-2020-0609

Scanning for Remote Desktop Gateways Potentially unpatched CVE-2020-0609 and CVE-2020-0610 The scanner has 2 modes of operation: Check for systems vulnerable to CVE-2020-0609 on UDP 3391 Uses the vuln scan code of https://github.com/MalwareTech/RDGScanner Disclaimer Scanning for memory corruption...

SQLiDetector

SQLiDetector Simple python script supported with BurpBouty profile that helps you to detect SQL injection "Error based" by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases. +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- | S|Q|L|i...

CVE-2026-117541 svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize to throw a...