CVE-2026-88872 AVideo CustomizeUser setPassword.json.php CSRF

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage tha...

CVE-2026-88870

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in the LoginControl plugin PGP key endpoints. The affected endpoints, including savePublicKey.json.php , lack CSRF token validation and accept requests via GET. An attack...

EUVD-2026-75420

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a...

CVE-2026-88870 WWBN AVideo LoginControl PGP Key CSRF via GET Request

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

wacker

Overview A set of scripts to help perform an online dictionary attack against a WPA3 access point. Wacker leverages the wpasupplicant control interface to control the operations of the supplicant daemon and to get status information and event notifications ultimately helping speedup connection...

FOFA-API-Threaded-Searcher

FOFA API Threaded Searcher A powerful multi‑threaded Python tool to query the FOFA Fofa.so API, extract selected fields, and save unique results with intelligent formatting. ✨ Features Multi‑threaded – Fetch multiple pages concurrently configurable threads Custom fields – Choose any valid FOFA...

CVE-2025-65754

CVE-2025-65754: XSS almacenado en Algernon 1.17.4 Descripción Algernon v1.17.4 está afectado por una vulnerabilidad de Cross-Site Scripting XSS que permite a los atacantes ejecutar código arbitrario mediante un payload manipulado en un nombre de archivo. Proyecto afectado: Algernon - 1.17.4...

Oracle-WebLogic-CVE-2022-21371

Oracle-WebLogic-CVE-2022-21371 Oracle WebLogic Server Local File Inclusion : CVE-2022-21371 Affected Version: Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 Description: The Oracle Fusion Middleware's Oracle WebLogic Server product Web Container component is vulnerable to local file...

RamziRange3

🕶️ RamziRange9 A deliberately vulnerable web application bui...

pd-agent v0.2.1

ProjectDiscovery Cloud Platform — Agent What it does • Quick Start • Install • Configuration • Scaling What it does pd-agent lets you scan your own internal networks from the ProjectDiscovery Cloud Platform. Install the agent on a machine inside the network you want to scan — a VM, a server, a...

FreePBX-Multiple-CVEs-2025

FreePBX-Multiple-CVEs-2025 This repository documents three security vulnerabilities discovered in FreePBX CVE-2025-66039, CVE-2025-61678, CVE-2025-61675, including analysis, impact, and proof-of-concept details for security research and awareness purposes. Description CVEs 🔴 CVE-2025-61675 A...

CVE-2025-66955

CVE-2025-66955 Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access files on the host via "path" parameter in the downloadAttachment and downloadAttachmentFromPath API calls. CVSS Vectors CVSS 3.1: 7.7,...

SiteCore-RCE-Detection

SiteCore-RCE-Detection Para la detección de RCE en Sitecore - CVE-2021-42237 RCE sin autenticación en Sitecore Experience Platform - CVE-2021-42237 Se basa en la detección de la versión de Sitecore y la respuesta cuando se realiza una solicitud a Report.ashx vulnerable mediante GET y POST. El...

https-github.com-pravin-pp-log4j2-CVE-2021-45105-1

Aplicación vulnerable de muestra Log4j2 CVE-2021-45105 Versiones afectadas: todas las versiones desde 2.0-beta9 hasta 2.16.0 Esta aplicación está basada en una aplicación web Spring Boot vulnerable a CVE-2021-45105 Utiliza Log4j 2.16.0 Ejecutar la aplicación Ejecútalo: root@kitploit: Import the...

WordPress Contact Form by Supsystic - Server-Side Template Injection

Contact Form by Supsystic WordPress plugin = 1.7.36 contains a server-side template injection caused by unsandboxed TwigLoaderString and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters. id: CVE-2026-4257 info: name: WordPress Contact...

dtls-fuzzer

dtls-fuzzer es una herramienta Java que realiza pruebas de estado de protocolo mediante fuzzing en servidores DTLS. Más concretamente, soporta las siguientes funcionalidades: 1. dado un alfabeto, puede generar automáticamente un modelo de una implementación local de servidor DTLS; 2. dada una...

horus

Project | Horus Table of Contents 🚀 About Horus ⚡ Installation and Usage Instructions ⚙️ API Configuration 🔮 Intended Features 🤝 Current Maintainers 🛠️ Contributing 📧 Contact Me 🤝 Acknowledgements 🚀 About Horus Horus is an all-in-one encompassing tool for investigations assistance, from API...

Follina

Follina Notes related to CVE-2022-30190 FOLLINA: CVE-2022-30190 1. Uses Microsoft Support Diagnostic Tool MSDT 2. Exploits diagnostic window opened for Diagnosis and when executed properly, gives reverse shell to attacker. 3. Github: a. https://github.com/JohnHammond/msdt-follina b...

Patch-the-Path-CVE-2025-55234-Detection-Defense

Patch-the-Path-CVE-2025-55234-Detection-Defense Este playbook describe las estrategias de detección, contención y remediación para CVE-2025-55234, una falla crítica de escalada de privilegios en Windows SMB. Por Mark Mallia Introducción En el panorama actual de ciberriesgo en constante cambio, la...