docker-bench-security

Docker Bench for Security The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production. The tests are all automated, and are based on the CIS Docker Benchmark v1.6.0. We are making this available as an open-source utili...

BloodHound-Legacy

BloodHound Legacy Edition v4 Has Been Deprecated This repository is for BloodHound Legacy version 4, which was last updated in 2023 and is no longer maintained. It will be archived in the near future. Please Use the New BloodHound Community Edition BloodHound Legacy has been replaced by the free...

Taipan

Taipan is now a sponsored project. The Community sponsor will receive access to the laset version of Taipan Community Edition. The free version is release after three months from the release date. To know more visit: https://github.com/enkomio-sponsor/info or https://taipansec.com. Latest Communi...

cent

Community edition nuclei templates, a simple tool that allows you to organize all the Nuclei templates offered by the community in one place. Install go install -v github.com/xm1k3/cent/v2@latest Or download from releases after installation run cent init to initialize cent with the configuration...

RustHound-CE

RustHound-CE is a cross-platform and cross-compiled BloodHound collector tool written in Rust, making it compatible with Linux, Windows, and macOS. It therefore generates all the JSON files that can be analyzed by BloodHound Community Edition. This version is only compatible with BloodHound...

openvas-scanner

OpenVAS Scanner This is the OpenVAS Scanner of the Greenbone Community Edition. It is used for the Greenbone Enterprise appliances and is a full-featured scan engine that executes a continuously updated and extended feed of Vulnerability Tests VTs. Releases All release files are signed with the...

Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting

Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id parameter. id: CVE-2019-14696 info: name: Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting author: pikpikcu severity: medium description: Open-School 3.0, and...

dradis-ce

Welcome to the Dradis Framework An Automated Pentest Reporting Tool Dradis is an open-source collaboration framework and penetration testing report generator that helps InfoSec teams streamline reporting workflows. With support for importing data from tools like Burp Suite, Nessus, and Nmap, Drad...

CVE-2024-35584

CVE-2024-35584 OpenSIS Authenticated SQL Injection Description There exists a SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php. This finding affects OpenSis Community Edition 9.1 to 8.0 and possibly versions below. Proof of Concept In...

semgrep-rules

semgrep-rules Welcome! This repository contains Semgrep's Community Edition rules. In addition to the rules in this repository, the Semgrep Registry offers proprietary Pro rules that offer additional language coverage, and unlock crossfile and deep dataflow analysis. Find rules: search for...

CVE-2022-40317

CVE-2022-40317 Stored XSS in Notes A stored XSS was found in the notes section of the application while we were pentesting a client that was using OpenKM. Basically, when storing notes, somehow normal HTML was allowed and it was rendered as is. As you know, However, we found that using...

CVE-2023-49964

CVE-2023-49964: FreeMarker Server-Side Template Injection in Alfresco An issue was discovered in Hyland Alfresco Community Edition =7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage...

CVE-2023-7028

CVE-2023-7028 ⚠️ This exploit is for defensive purposes and should be used by cybersecurity professionals to identify possible vulnerable GitLab servers. Description CVE-2023-7028 - Account Takeover via Password Reset without user interactions in GitLab Community Edition and Enterprise Edition...

CVE-2026-109206 LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet /avatar performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compa...

CVE-2026-109205

LogicalDOC Community Edition through version 9.3 is vulnerable to an unauthenticated file upload flaw in the UploadServlet . The root cause is the lack of limits on multipart requests sent to the /upload endpoint, which allows remote attackers to write files to disk without a session. By repeated...

EUVD-2026-97439

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet /avatar performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compa...

CVE-2026-109206

LogicalDOC Community Edition through version 9.3 is vulnerable to username enumeration via the AvatarServlet (/avatar). The root cause is a lack of session validation , allowing unauthenticated attackers to provide usernames or numeric IDs in the userId parameter. By comparing 1x1 transparent ima...

EUVD-2026-97440

LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in...

CVE-2026-109203 LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its version...

CVE-2026-109203

LogicalDOC Community Edition through version 9.3 is vulnerable to a missing authorization flaw in the ConvertPdf servlet (CWE-862). This vulnerability allows authenticated users to bypass access controls and download restricted PDF documents from folders they are not authorized to view. Attackers...