CVE-2023-34845

CVE-2023-34845 POC de vulnerabilidad para CVE-2023-34845 Vulnerabilidad Encontré un ataque de cross-site scripting en la página de creación de nuevo contenido http://localhost:800/admin/new-content esto ejecutará el script en el contexto del usuario, permitiendo al atacante acceder a cualquier...

ThreatExchange

Projects in this Repository This repository originally started as code to support Meta's ThreatExchange API, but over time has grown to include a number of projects to support signal exchange and content moderation in general. Below are a list of sub-projects. PDQ Image Hashing and Similarity...

secator

The pentester's swiss knife. Features • Supported commands • Installation • Usage • Documentation • Join us on Discord ! secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters a...

CVE-2025-29927-POC

CVE-2025-29927-POC 简介 本仓库包含 CVE-2025-29927 的概念验证（PoC），这是一个假设的漏洞，演示了 Web 应用程序中中间件处理的缺陷。该 PoC 展示了如何利用特制的 HTTP 请求绕过重定向逻辑，访问受限内容（例如仪表盘）。本项目仅用于教育和安全研究目的。 免责声明 ：本 PoC 仅限在获得明确许可的受控环境中使用。未经授权对您不拥有或未获得测试同意的系统进行测试是非法且不道德的。 目录 先决条件 漏洞概述 概念验证步骤 步骤 1：初始请求（失败） 步骤 2：修改后的请求（成功） 如何复现 参考资料 贡献 许可证 先决条件 要跟随本 PoC，您需要...

PhantomFS

PhantomFS Proveedor de ProjFS. Proyecta archivos cuyo contenido depende de qué proceso los lee. El payload se almacena cifrado con AES-256-CBC en disco, descifrado solo en memoria en tiempo de ejecución. Esto no debería evadir ningún EDR, ya que el payload se escribirá en disco cuando procesos...

demiguise

Demiguise - HTA 加密工具 由 NCC Group Plc 以开源形式发布 - http://www.nccgroup.trust/ 由 Richard Warren 开发, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/demiguise 基于 AGPL 发布，详见 LICENSE 文件 它的作用是什么？ 该项目的目标是生成.html文件，这些文件 包含一个加密的 HTA 文件 。其思路是，当目标访问页面时，获取密钥，并在浏览器中动态解密...

CVE-2026-84429

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2025-15591

Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...

CVE-2024-37791

CVE-2024-37791 CVE-2024-37791 项目地址： 准备工作： 登入后台-获取cookie 漏洞URL: http://127.0.0.1:8093/s/article/Content/index?classid=&keyword= 漏洞参数: keyword payload: %27andselectfromselect+ifasciisubstrdatabase,1,1%3E97,sleep1,0a//union/ /select+1=%27 注入成功则延迟大于一秒,否则没有延迟 sqlmap验证： poc 需要有cookie。 GET...

Azure-Sentinel

Microsoft Sentinel 与 Microsoft 365 Defender 欢迎来到统一的 Microsoft Sentinel 与 Microsoft 365 Defender 仓库！本仓库包含开箱即用的检测、探索查询、搜寻查询、工作簿、剧本以及更多内容，帮助您快速上手 Microsoft Sentinel，并提供安全内容以保护您的环境并搜寻威胁。这些搜寻查询还包括适用于 Microsoft 365 Defender 和 Microsoft Sentinel 中的高级搜寻场景的 Microsoft 365 Defender 搜寻查询。您还可以向 issues 提交您希望在接...

CVE-2026-84429

The Django web framework is vulnerable to a potential denial-of-service (DoS) attack affecting versions 6.1 before 6.1.2 , 6.0 before 6.0.9 , and 5.2 before 5.2.18 . The root cause is quadratic time complexity in the django.utils.http.parse_header_parameters() function when parsing values contain...

CVE-2026-84429 Potential denial-of-service vulnerability in HTTP header parsing

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

EUVD-2026-93417

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

EUVD-2025-211030

Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...

CVE-2025-15591

A Cross-Site Scripting (XSS) vulnerability exists in the Forums feature of OpenText Content Management Content Server . This flaw allows a bad actor to inject malicious code into a Forums web page. The vulnerability is associated with CWE-79 (Improper Neutralization of Input During Web Page Gener...

CVE-2025-15591 Cross-Site Scripting (XSS) vulnerability identified in OpenText™ Content Management

Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...

CheatSheetHost

CheatSheetHost Un servidor web ligero y basado en contenido para alojar hojas de trucos interactivas y materiales de referencia. Perfecto para desafíos CTF Capture The Flag, ingeniería inversa y documentación técnica. Es ideal para usar en laboratorios donde se desea limitar o prescindir del...

S3Scanner

S3扫描器 一个快速而简陋的脚本，用于发现未受保护的S3存储桶并转储其内容 💧 使用方法 该工具包含两个部分： 1 - s3finder.py 此脚本获取域名列表，检查它们是否托管在Amazon S3上。找到的S3域名将以"domain:region"格式输出到文件，并附带相应区域。 安装： 1. （可选）virtualenv venv && source ./venv/bin/activate 2. pip install -r requirements.txt 使用： $ python s3finder.py -o output.txt domainsToCheck.txt 兼容性：...

pythem

pythem - Penetration Testing Framework pythem is a multi-purpose pentest framework written in Python. It has been developed to be used by security researchers and security professionals. The tool intended to be used only for acts within the law. I am not liable for any undue and unlawful act...

CMSeeK

什么是 CMS？ 内容管理系统（CMS）负责创建和修改数字内容。它通常支持在协作环境中多用户操作。一些著名的例子包括： WordPress、Joomla、Drupal 等 。 发布历史 - Version 1.1.3 25-07-2020 - Version 1.1.2 19-05-2019 - Version 1.1.1 01-02-2019 - Version 1.1.0 28-08-2018 - Version 1.0.9 21-08-2018 - Version 1.0.8 14-08-2018 - Version 1.0.7 07-08-2018 ... 更新日志文件 CMSe...