m365_groups_enum

Enumerate Microsoft 365 Groups in a tenant with their metadata Description The allgroups.py script allows to enumerate all Microsoft 365 Groups in a Azure AD tenant with their metadata: name visibility: public or private description email address owners members Teams enabled? SharePoint URL e.g...

chaos

chaos chaos is an 'origin' IP scanner developed by RST in collaboration with ChatGPT. It is a niche utility with an intended audience of mostly penetration testers and bug hunters. An origin-IP is a term-of-art expression describing the final public IP destination for websites that are publicly...

CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC

CVE-2025-60852: Inyección CSV en Instant Developer Foundation 25.0.9600 – Prueba de Concepto PoC 📌 Descripción general Este repositorio contiene una Prueba de Concepto PoC para una vulnerabilidad de Inyección CSV Inyección de Fórmulas CVE-2025-60852 que afecta a aplicaciones creadas con el...

CVE-2020-25398

CVE-2020-25398 Existe una inyección CSV en InterMind iMind Server hasta la versión 3.13.65 a través de la funcionalidad de exportación CSV. Información Descripción: Un atacante puede configurar datos específicos, que podrían exportarse a un archivo csv malicioso con una carga útil de ejecución de...

CVE-2024-29375

CSV-Injection-PoC CSV Injection in Addactis IBNRS 3.10.3.107 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L CVSS: 7.1, Impact Score: 5.3, Exploitation Score: 1.3 Affected Components: Project Description, Identifiers, Custom Triangle Name inside Input Triangles and Yield Curve Name parameters Screenshot 1:...

CVE-2023-36250

CVE-2023-36250 Vulnerabilidad de inyección CSV en el rastreador de tiempo de GNOME versión 3.0.2, que permite a atacantes locales ejecutar código arbitrario a través de un archivo .tsv manipulado al crear un nuevo registro. Tipo de Vulnerabilidad Inyección CSV Descubridor Bruno Teixeira Referenci...

log4shell_sentinel

Log4Shell Sentinel - A Smart CVE-2021-44228 Scanner Introduction While there have some excellent tools released to help organizations scan their environments for applications vulnerable to the critical Log4J / CVE-2021-44228 vulnerability, I felt that: none of the tools I ran into were made for...

vt-py-scanner

Escáner de VirusTotal Script de Python para analizar TODOS los archivos con la API de VirusTotal, escaneando carpetas y subcarpetas de forma recursiva. Optimizado para Windows. Características Escanea TODOS los archivos de una carpeta y sus subcarpetas Configuración mediante archivo .env - Guarda...

Brother MFC-L9570CDW - Information Disclosure

An unauthenticated attacker who can access either the HTTP service TCP port 80, the HTTPS service TCP port 443, or the IPP service TCP port 631, can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mntinfo.csv can be accessed via a GET request and no...

CVE-2020-10131

CVE-2020-10131 - CVE-2020-10131 - SearchBlox vor V-9.2.1 ist anfällig für CSV-Makro-Injection. Produktbeschreibung: SearchBlox vereinfacht die Unternehmenssuche für komplexe Organisationen. Die intuitiven und intelligenten Tools von SearchBlox bieten eine sofort einsatzbereite Einrichtung, sicher...

CVE-2021-46363

CVE-2021-46363: Iniezione di Formula in Magnolia CMS Un problema nella funzione Export di Magnolia v6.2.3 e versioni precedenti consente agli attaccanti di eseguire attacchi di Iniezione di Formula tramite file CSV/XLS appositamente modificati. Queste formule possono comportare l'esecuzione di...

CHIRP-CodeExecution_via_Malicious_ImageFile

CHIRP — Beliebige Codeausführung über eval im Kenwood-ITM-Treiber Produkt: CHIRP - Ein Open-Source-Projekt zur Programmierung von Amateurfunkgeräten. Betroffene Versionen: URL: https://github.com/kk7ds/chirp, https://chirpmyradio.com Betroffene Versionen: = chirp-next-20260814 CWE: CWE-95 Eval...

CVE-2026-80488

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

CVE-2026-80488 WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

EUVD-2026-68061

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

CVE-2026-80488

WP Ultimate CSV Importer WordPress plugin versions before 9.0 contain a SQL injection vulnerability in the AIOSEO Import Fields feature. Imported field values are not properly sanitised or escaped before being used in a SQL statement, allowing high-privilege users (admin and above) to execute arb...

httprobe

httprobe Take a list of domains and probe for working http and https servers. Install root@kitploit: ▶ go install github.com/tomnomnom/httprobe@latest Basic Usage httprobe accepts line-delimited domains on stdin: root@kitploit: ▶ cat recon/example/domains.txt example.com example.edu example.net ▶...

CVE-2026-76797

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-76797 MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-76797

The MongoSQL Transition Readiness Tool (MongoDB) is vulnerable to CSV injection through its generated reports. Database and collection names are written into CSV output without neutralizing leading characters that spreadsheet applications interpret as formulas. An attacker with write privileges o...