CVE-2024-48652

CVE-2024-48652 Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field Steps to Reproduce: 1.Open the URL: http://127.0.0.1/admin/dashboard 2.Log in using admin credentials. 3.Navigate to the "Settings" section...

CVE-2026-87971

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

paskto

Paskto - Scanner Web Passif Paskto scanne passivement le web en utilisant l'index Internet Common Crawl, soit en téléchargeant les index sur demande, soit en analysant les données de votre système local. Les URL sont ensuite traitées via Nikto et des listes d'URL connues pour identifier du conten...

crawpy

Crawpy Un autre outil de découverte de contenu écrit en Python. Ce qui rend cet outil différent des autres : Envoie des requêtes HTTP asynchrones, rapide Mode de calibration, applique automatiquement des filtres Mode de scan récursif avec des options supplémentaires Génération de rapports, vous...

CVE-2026-87971

The If-So Dynamic Content WordPress plugin versions before 1.10.2 (specifically versions 1.4.4 through 1.10.1) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is a failure to validate the URL scheme of a request-supplied value, which is then reflected into a link on an admi...

EUVD-2026-94188

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-104049 Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

CVE-2026-104049 Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

WordPress Academy LMS plugin < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure vulnerability

Subscriber+ Arbitrary Lesson Content Disclosure vulnerability discovered by Morato Antoine in WordPress Plugin Academy LMS versions 4.0.0...

CVE-2025-24893

PoC for CVE-2025-24893 — XWiki Remote Code Execution Safe PoC PoC for CVE-2025-24893: XWiki' Remote Code Execution exploit for versions prior to 15.10.11 , 16.4.1 and 16.5.0RC1. ⚠️ IMPORTANT — AUTHORIZED TESTING ONLY This repository contains a proof-of-concept PoC project intended for educational...

ffuf

ffuf - Fuzz Faster U Fool Un fuzzer web rapide écrit en Go. Installation Exemples d'utilisation Découverte de contenu Découverte de vhosts Fuzzing de paramètres Fuzzing de données POST Utilisation d'un mutateur externe Fichiers de configuration Aide Mode interactif Installation Téléchargez un...

cspparse

cspparse Description cspparse est un outil pour évaluer les Content Security Policies. Il utilise l'API de Google pour récupérer les en-têtes CSP et les retourne au format ReconJSON. Non seulement il vérifie les en-têtes avec l'API de Google, mais il analyse également le HTML du site cible pour...

CVE-2026-106494

A flaw was found in the @backstage/backend-defaults package of Backstage. Improper input validation in cloud storage URL readers allows an attacker with write access to an associated cloud storage bucket to create specially crafted object names. Under certain deployment configurations, these name...

java-html-sanitizer

OWASP Java HTML Sanitizer Быстрый и легко настраиваемый HTML-санитайзер, написанный на Java, который позволяет включать в ваше веб-приложение HTML, созданный третьими лицами, защищая при этом от XSS. Существующая зависимость — от JSR 305. Остальные jar-файлы нужны только для тестового набора...

CVE-2017-1000117

Test repository to check Git's vulnerability CVE-2017-1000117 How it works? Clone this repository recursively. The sentence 「うんこもりもり」which means like "Lots of shit." will be shown on your terminal. $ git clone --recursive https://github.com/greymd/CVE-2017-1000117.git Cloning into...

bluemonday

bluemonday bluemonday는 Go로 구현된 HTML 살균기sanitizer입니다. 빠르고 설정이 매우 자유롭습니다. bluemonday는 신뢰할 수 없는 사용자 생성 콘텐츠를 입력으로 받아, 승인된 HTML 요소 및 속성의 허용 목록allowlist을 기준으로 살균된 HTML을 반환합니다. 따라서 해당 콘텐츠를 웹 페이지에 안전하게 포함할 수 있습니다. 사용자 생성 콘텐츠를 받아들이고 서버가 Go를 사용한다면, 반드시 bluemonday가 필요합니다. 사용자 생성 콘텐츠를 위한 기본...

asdsadsadasdasdsadsad

This repository does not have a README...

uaf-2023-28205

CVE-2023-28205: Apple WebKit Use-After-Free Vulnerability This vulnerability can be exploited through maliciously crafted web content, allowing attackers to execute arbitrary code. Description The code triggers a use-after-free UAF vulnerability by delaying the addition of Map and Date objects,...