shadowd

Logo Shadow Daemon is a web application firewall that intercepts requests at the application level. This repository contains the main component of Shadow Daemon that handles the analysis and storage of requests. Documentation For the full documentation please refer to shadowd.zecure.org...

exploitdb

New repo can be found here: https://gitlab.com/exploit-database/exploitdb...

Windows-Exploit-Suggester

DESCRIPTION This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins. It requires the...

DOGE

DOGE Darknet Osint Graph Explorer Still in dev, works right. You should use this in addtion to Darknet OSINT Transform Pay attention here Query prototype: SELECT DISTINCT customcolumnname AS input, anothercustomname AS output FROM sometable, obviously you can add other options as WHERE, ORDER BY,...

opencspm

OpenCSPM Open Cloud Security Posture Management, OpenCSPM, is an open-source platform for gaining deeper insight into your cloud configuration and metadata to help understand and reduce risk over time. Who is OpenCSPM for? Security teams running infrastructure in cloud environments looking to gai...

firebase

firebase Exploiting vulnerable/misconfigured Firebase databases Disclaimer: The provided software is meant for educational purposes only. Use this at your own discretion, the creator cannot be held responsible for any damages caused. Please, use responsibly! Prerequisites Non-standard python...

ransomwatch

RansomWatch RansomWatch is a ransomware leak site monitoring tool. It will scrape all of the entries on various ransomware leak sites, store the data in a SQLite database, and send notifications via Slack or Discord when a new victim shows up, or when a victim is removed. Note: RansomWatch isn't...

Wordpress Email Subscribers by Icegram Express - SQL Injection

The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient escaping ...

H2 Database Console - JNDI Injection RCE

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution via the H2 web console versions before...

WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection

WordPress Secure Copy Content Protection and Content Locking plugin before 2.8.2 contains a SQL injection vulnerability. The plugin does not escape the sccpid parameter of the ayssccpresultsexportfile AJAX action, available to both unauthenticated and authenticated users, before using it in a SQL...

web2py-e94946d-CVE-2016-3957

Readme web2py is a free open source full-stack framework for rapid development of fast, scalable, secure and portable database-driven web-based applications. It is written and programmable in Python. LGPLv3 License Learn more at http://web2py.com Google App Engine deployment cp examples/app.yaml ...

CVE-2026-26980

CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content API SQL Injection PoC ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Overview CVE-2026-26980 is an unauthenticated SQL Injection vulnerability in TryGhost Ghost CMS Content API. The vulnerable path is...

CVE-2025-46171

vBulletin 3.x.x - DoS via Buddy List Overload Summary The /misc.php?do=buddylist endpoint runs a single, large JOIN query that retrieves all buddies along with their user and session information to check online status. Because this query processes the entire buddy list without pagination or resul...

CVE-2014-125130: Improper Limitation of a Pathname to a Restricted Directory

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

PT-2026-104126

Name of the Vulnerable Software and Affected Versions Dc Woocommerce Multi Vendor versions prior to 5.0.19 Description An issue exists where authenticated attackers with vendor-level access or higher specifically those with the edit stores capability can perform SQL Injection. This occurs because...

openSUSE 16 Security Update : python-pymongo (openSUSE-SU-2026:22003-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22003-1 advisory. Changes in python-pymongo: - CVE-2026-96749: integer overflow in BSON document encoding allows an unprivileged user to write outside the bounds ...

PT-2026-104151

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

PT-2026-104437

Name of the Vulnerable Software and Affected Versions Armatura One affected versions not specified Description The database initialization routine assigns a fixed, vendor-defined password to the database superuser account during creation instead of generating a unique password for each...

PT-2026-104092

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed b...

CVE-2026-94592: Use of Hard-coded Credentials

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...