CVE-2026-105865 Payload: Incomplete validation during the upload file lifecycle

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

EUVD-2026-93511

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

VeilTransfer

VeilTransfer 2.0 VeilTransfer is a data exfiltration utility designed to test and enhance detection capabilities. This tool simulates real-world data exfiltration techniques used by advanced threat actors, allowing organizations to evaluate and improve their security posture. By leveraging multip...

nowafpls

nowafpls Table of Contents nowafpls Documented WAF limitations Installing nowafpls Using nowafpls Authors License nowafpls Most web application firewalls WAFs have limitations for how much data they can process when a request body is sent. This means for HTTP requests that contain a request body...

CVE-2023-38891

CVE-2023-38891 Authenticated SQL Injection Vulnerability in VTiger Open Source CRM v7.5 Discovered by: Jacob Elliott 07/13/23 Summary In the Reports module in VTiger CRM v7.5.0, there is insufficient checking of the selected fields for the report which are stored and then later reintroduced as a...

cve-2025-1323

cve-2025-1323 WP-Recall Plugin SQL Injection ⚠️ Legal Disclaimer This tool is intended for authorized security testing and educational use only. Do not use against systems without explicit permission. Misuse may be illegal. ✅ Requirements Python 3.x requests module Install dependencies: pip instal...

FBI Removes Accenture Contractor Over ShinyHunters Job Site Data Breach

The FBI removed a contractor over a ShinyHunters-linked breach. Reuters sources identified Accenture and an unpatched Oracle PeopleSoft system...

Uscrapper

Uscrapper Vanta Introducing Uscrapper Vanta, Unleashing the Power of Open-Source Intelligence, dive deeper into the vast web with Uscrapper Vanta, Vanta unlocks a new level of data extraction capabilities, empowering the exploration of the uncharted territories of the dark web and uncovering hidd...

PasteHunter

PasteHunter PasteHunter is a python3 application that is designed to query a collection of sites that host publicly pasted data. For all the pastes it finds it scans the raw contents against a series of Yara rules looking for information that can be used by an organisation or a researcher. Setup...

Spring_cve-2022-22980

Springcve-2022-22980 spring data mongodb remote code execution | cve-2022-22980 poc Description A Spring Data MongoDB application is vulnerable to SpEL injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value...

CVE-2026-105861 Payload external upload trust validation issue

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...

CVE-2018-16763

Fuel CMS 1.4.1 - Remote Code Execution FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. Install git clone https://github.com/Trushal2004/CVE-2018-16763.git cd CVE-2018-16763/ python3 -...

aisecplus-week01-danielossai

🔐 AISec Plus — Week 1: Map the Threat Researcher: Daniel Ossai Repo: aisecplus-week01-danielossai Submitted: Week 1 · AISec Plus Bootcamp 📌 Incident Name & Date EchoLeak CVE-2025-32711 Discovered: January 2025 · Disclosed: June 2025 · Patched: June 2025 📝 What Happened Researchers at Aim Security...

cacti-rce-cve-2022-46169-vulnerable-application

Cacti v1.2.22 命令注入 CVE-2022-46169 漏洞应用 这是一个用于测试 Cacti 漏洞（CVE-2022-46169 ）利用的易受攻击应用。 警告！ 此应用包含严重的安全漏洞。运行风险自负！建议在备份且隔离的环境（如已创建近期快照并仅使用主机网络模式的虚拟机）中运行。请勿将此应用部署到任何面向互联网的服务器，否则它们将被攻破。 免责声明 ：本人对任何人使用此应用的方式概不负责。此应用的唯一用途是作为 CVE-2022-46169 漏洞利用的测试场景，不得恶意使用。如果您的服务器因安装此应用而被攻破，责任不在于我，而在于上传并安装它的人员。 漏洞信息 CVE-ID...

Am-I-affected-by-Meltdown

Am I affected by Meltdown?! Meltdown CVE-2017-5754 checker What am I? Proof-of-concept / Exploit / Checks whether system is affected by Variant 3: rogue data cache load CVE-2017-5754, a.k.a MELTDOWN. The basic idea is that user will know whether or not the running system is properly patched with...

stretcher

Stretcher Stretcher is a tool to search for open elasticsearch servers. Usage: python stretcher.py --shodan key --action analyze --threads 0..100 --dork python stretcher.py --help / // / / // / \ / / / / / / / / / / / // / / / // // / / / / / //// //// //// Tool designed to help identify...

SnipRecover-CLI

SnipRecover CLI Detection and restoration of Windows Snipping Tool PNG captures vulnerable to CVE-2023-28303 SnipRecover CLI is a minimal, dependency-free command-line utility designed to: Detect PNG files modified by the Windows Snipping Tool vulnerability CVE‑2023‑28303. Restore the original...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

snapchat-map-scraper

Snapchat Story Downloader This program can search Snapchat's public Snap Map at multiple locations and download all stories for later investigation and categorization. A lot is unknown about how Snapchat decides which videos show up at which "point" on the map, so the scraper can also randomize t...