elegant-bouncer

ELEGANTBOUNCER ELEGANTBOUNCER is a detection tool for file-based mobile exploits. It employs an innovative approach for advanced file-based threat identification, eliminating the need for in-the-wild samples and outperforming traditional methods based on regular expressions or IOCs. At present, i...

cve-2019-2725

Run with python3 1. Place detection targets in the ip.txt file, format: 192.168.1.18:7001 2. Run the script directly; results with vulnerabilities are saved in the ok.txt file...

cred_scanner

credscanner A simple command line tool for finding AWS credentials in files. Optimized for use with Jenkins and other CI systems. I suspect there are other, better tools out there such as git-secrets, but I couldn't find anything to run a quick and dirty scan that also integrates well with Jenkin...

CVE-2024-5522

EN A PoC exploit scanner for CVE-2024-5522 vulnerability in WordPress websites. This tool helps identify and exploit the vulnerability by scanning a list of target URLs and attempting a specific payload to determine if the site is vulnerable. Features Automatic Vulnerability Scanning : Scans targ...

log4shell_sentinel

Log4Shell Sentinel - A Smart CVE-2021-44228 Scanner Introduction While there have some excellent tools released to help organizations scan their environments for applications vulnerable to the critical Log4J / CVE-2021-44228 vulnerability, I felt that: none of the tools I ran into were made for...

SUSE CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

DEBIAN-CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

CVE-2026-114714

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a path traversal vulnerability within the squirrelmail_usercopy plugin. When using the file-based backend, the application fails to reject path separators in the login name when building the source path. This allows...

CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

EUVD-2026-107695

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

PT-2026-120891

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause...

Linux Distros Unpatched Vulnerability : CVE-2026-114714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based...

Astra Linux – Vulnerability in Tomcat9

Path Equivalence: The use of ‘file.Name’ an internal dot notation can lead to Remote Code Execution, information disclosure, or the addition of malicious content to uploaded files via the write-enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-...

CVE-2026-61525 Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller

Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to...

CVE-2026-61525 Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller

Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to...

CVE-2026-61525

The Zammad helpdesk system versions 7.0.2 and 7.1.0 are vulnerable to a path traversal attack within the session management for websocket and long-polling connections. The root cause is the insufficient validation of client-supplied session identifiers before they are used to construct internal f...