WordPress Button Generator <2.3.3 - Remote File Inclusion

WordPress Button Generator before 2.3.3 within the wow-company admin menu page allows arbitrary file inclusion with PHP extensions as well as with data:// or http:// protocols, thus leading to cross-site request forgery and remote code execution. id: CVE-2021-25052 info: name: WordPress Button...

cloud

Cloud Monitoring the Cloud Landscape Our mission with this project is to provide an always up-to-date and freely accessible map of the cloud landscape for every major cloud service provider. We've decided to kick things off with collecting SSL certificate data of AWS EC2 and GCP machines,...

buster

Description Buster is an advanced OSINT tool used to: Get social accounts of an email using multiple sourcesgravatar,about.me,myspace,skype,github,linkedin,previous breaches Get links to where the email was found using google,twitter,darksearch and paste sites Get breaches of an email Get domains...

chiasmodon

Chiasmodon Chiasmodon is an OSINT tool that allows users to gather information from various sources and conduct targeted searches based on domains, Google Play applications, email addresses, IP addresses, organizations, URLs, and more. It provides comprehensive scanning capabilities, customizable...

linkedin2username

linkedin2username OSINT Tool: Generate username lists from companies on LinkedIn. This is a pure web-scraper, no API key required. You use your valid LinkedIn username and password to login, it will create several lists of possible username formats for all employees of a company you point it at...

lk_scraper

LinkedIn Scraper Scrapes Any LinkedIn Data Installation $ pip install git+git://github.com/jqueguiner/lkscraper Setup Using Docker compose $ docker-compose up -d $ docker-compose run lkscraper python3 Using Docker only for Selenium server First, you need to run a Selenium server $ docker run -d -...

coeus-ci

Coeus CI Competitive Intelligence that sees all. Named after Coeus SEE-us, the 100 eyed Greek Titan of the inquisitive mind — whose name literally means "querying." CI stands for Competitive Intelligence. A business intelligence OSINT tool that builds company profiles from free public data source...

CVE-2026-33944

Dolibarr ERP/CRM contains a SQL Injection vulnerability in the Third Party (Company) update functionality. The application fails to properly sanitize or cast the localtax1_value and localtax2_value properties (passed via lt1 and lt2 POST parameters), concatenating them directly into an SQL UPDATE...

CVE-2026-33944 Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter

Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the localtax1value and localtax2value ...

PT-2026-135642

Munshi by Petpooja before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/company id, where the application fails to enforce the dedicated company delete permission or verify company ownership. An authenticated invited sub-user...

CVE-2026-119733: Petpooja Munshi: Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow…

Munshi by Petpooja before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/companyid, where the application fails to enforce the dedicated companydelete permission or verify company ownership. An authenticated invited sub-user wi...

ARC-Browser-Address-Bar-Spoofing-PoC

ARC Browser Address Bar Spoofing - iOS/iPadOS CVE-2024-25733 ARC Browser Address Bar Spoofing PoC - iOS/iPadOS Exploit PoC Proof of Concept function spoof setTimeout = window.stop; let randomPort; do randomPort = Math.floorMath.random 1000; while randomPort === 0 || randomPort === 443;...

sentryexploit

MobileIron Sentry CVE-2023-38035 information extraction Features Extract company name and contact email Proof of vulnerability Usage ./sentryexploit 192.168.0.10:8443 2023/08/24 21:29:55 Information extracted, appliance is vulnerable: 2023/08/24 21:29:55 Company: XXXX Ltd., contact:...

CVE-2025-22777

CVE-2025-22777 GiveWP – Donation Plugin and Fundraising Platform = 3.19.3 - Unauthenticated PHP Object Injection Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.3 via...

Fourteen_Endpoints

The Middlemen Shell Companies Inside Apple's Privacy Relay An anonymous Delaware LLC publishes a Bible prayer app, a daily journal, and a caller ID tool on the App Store. That entity operates encrypted relay infrastructure inside Apple's privacy network. That relay terminates at Taiwan Mobile Co....

CVE-2021-44228-Advisories

CVE-2021-44228-Advisories Please open Issues to include an advisory / No PRs. Please check out this list, got more traction than mine : https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592 This list includes all advisories of companies, even if they're just confirming that they're not...

MAL-2026-18214 Malicious code in @grabcad/company-server-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77669bd2c3c9138e7d3ab0612febc058dfd8235eb812a40ffb5bf3f27d19bf47 Package self-describes as a Compatibility shim. for the @grabcad scope and ships no real functionality: index.js exports a Proxy whose property acces...

Malware in @grabcad/company-server-shared

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @grabcad/company-server-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77669bd2c3c9138e7d3ab0612febc058dfd8235eb812a40ffb5bf3f27d19bf47 Package self-describes as a Compatibility shim. for the @grabcad scope and ships no real functionality: index.js exports a Proxy whose property acces...

Malicious Package

Overview @grabcad/company-server-shared is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...