Log4jTools

Log4jTools Tools for investigating Log4j CVE-2021-44228 Bug explanation and Demo https://www.youtube.com/watch?v=0-abhd-CLwQ FetchPayload.py Get java payload from ldap path provided in JNDI lookup. Requirements: curl system, requests python Example command: python FetchPayload.py...

subjs

subjs subjs fetches javascript files from a list of URLS or subdomains. Analyzing javascript files can help you find undocumented endpoints, secrets, and more. It's recommended to pair this with gau and then https://github.com/GerbenJavado/LinkFinder Resources Usage Installation Usage: Examples: ...

nvd

nvd Fast, simple library in Go to fetch CVEs from the NVD U.S. National Vulnerability Database feeds. Install go get github.com/daehee/nvd Usage The nvd package provides a Client for fetching CVEs from the official NVD feeds: // nvd client with ./tmp working dir client, err := NewClient"tmp" //...

boha

@agntn/puzzles Public crypto puzzles and bounties, as typed records. You ask for a puzzle, you get its address, its key material and what happened on chain. Why? Every puzzle thread has the same three things: the addresses, the prizes, and who solved what. Every scanner and tracker re-types them...

ManualRsrcDataFetching

ManualRsrcDataFetching: one function to replace FindResource & LoadResource & LockResource & SizeofResource windows apis. Note: Payload.ico is a x64 calc shellcode...

anubis-fetch

anubis-fetch $ nix run github:fzakaria/anubis-fetch -- --text https://lore.kernel.org/ A Go CLI for fetching URLs behind Anubis proof-of-work challenges. It solves legacy SHA-256 and WASM challenges in-process, with headless Chromium as a fallback. Sites such as lore.kernel.org and kernel.org use...

CVE-2026-126208

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVGALLOWLOCALHREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external hr...

Linux Distros Unpatched Vulnerability : CVE-2026-47678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown...

CVE-2026-109403

A flaw was found in conductor. A remote attacker can exploit this vulnerability by supplying a manipulated agentUrl parameter to the agent card fetching service, resulting in Server-Side Request Forgery SSRF. This flaw allows the server to make unauthorized network requests to unintended...

CVE-2026-47678

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue...

CVE-2026-47678

The GLPI asset and IT management software package contains a blind time-based SQL injection vulnerability in its dropdown values fetching endpoint. Affected versions range from 9.4.0 up to, but not including, 10.0.26 and 11.0.8 . An authenticated user can submit crafted values that are improperly...

CVE-2026-47678 GLPI: Blind Time based SQLI in dropdowns

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue...

CVE-2026-47678 GLPI: Blind Time based SQLI in dropdowns

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue...

CVE-2026-47678 GLPI: Blind Time based SQLI in dropdowns

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue...

PT-2026-137231

Name of the Vulnerable Software and Affected Versions GLPI versions 9.4.0 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description Authenticated users can perform SQL injection by submitting crafted values to the dropdown values fetching endpoint. These values are incorporated directly int...

CVE-2026-120058

A flaw was found in postgresql-odbc. An untrusted database server can exploit this vulnerability to execute arbitrary code or cause a denial of service DoS on the client system. When cursor-based fetching is enabled, the driver determines its row cache size using the column count from the initial...

CVE-2026-107020: n/a: An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers…

An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL...

CVE-2026-116182 phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them...

CVE-2026-116182 phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them...

CVE-2026-116182 phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them...