CVE-2024-22891

Nteract PoC CVE-2024-22891 の脆弱性に対する Proof-Of-Concept（実証コード）です。 nteract 0.28.0 は Markdown リンクを介して Electron WebView を許可するため、リモートコード実行（RCE）が発生します。 このリポジトリには、脆弱なアプリケーションの例と、それに対する Proof-of-Concept（POC）エクスプロイトが含まれています。PoC として、プロセスを自動化する Python ファイルがあります。 1. 脆弱性の概要: 脆弱性の対象: Markdown リンク RCE 脆弱性の種類: その他...

writehat

WriteHat is a reporting tool which removes Microsoft Word and many hours of suffering from the reporting process. Markdown -- HTML -- PDF. Created by penetration testers, for penetration testers - but can be used to generate any kind of report. Written in Django Python 3. Features: Effortlessly...

writehat

WriteHat 은 보고서 작성 과정에서 Microsoft Word와 많은 고통를 제거해주는 보고 도구입니다. Markdown -- HTML -- PDF 로 변환됩니다. 침투 테스터에 의해, 침투 테스터를 위해 만들어졌지만, 모든 종류의 보고서를 생성하는 데 사용할 수 있습니다. DjangoPython 3로 작성되었습니다. 기능: 멋진 침투 테스트 보고서를 손쉽게 생성 즉석 드래그 앤 드롭 보고서 작성기 Markdown 지원 – 코드 블록, 테이블 등 포함 이미지 자르기, 주석 추가, 캡션, 업로드 사용자 정의 가능한 보고서...

quiver

Quiver : A Meta-Tool for Kali Linux Quiver is an organized namespace of shell functions that pre-fill commands in your terminal so that you can ditch your reliance on notes, copying, pasting, editing, copying and pasting again. Quiver helps you remember how to use every tool in your arsenal and...

CVE-2024-25503

CVE-2024-25503 脆弱性タイプ : Cross Site Scripting XSS 製品: Advanced REST Client desktop application 脆弱性のあるバージョン: 17.0.9 製品のベンダー:https://www.advancedrestclient.com/ 1. 説明 Advanced REST Client v.17.0.9 におけるクロスサイトスクリプティング XSS の脆弱性により、リモートの攻撃者が任意のコードを実行し、機密情報を取得することが可能です。これは、New Project 機能の 'edit details'...

agentic-threat-hunting-framework

Agentic Threat Hunting Framework ATHF Quick Start • Installation • Documentation • Examples Give your threat hunting program memory and agency. The Agentic Threat Hunting Framework ATHF is the memory and automation layer for your threat hunting program. It gives your hunts structure, persistence,...

awesome-cybersecurity-resources

awesome-cybersecurity-resources Awesome Cybersecurity Resources，更多。 目的 本仓库存储从互联网、仓库文档以及精选的本地笔记中收集整理的网络安全资源。 README.md 是资源目录和唯一可信来源。每个条目包含一个标题、一段简洁的事实性描述以及经过验证的来源链接。 结构 data/automation/：自动化状态 .agents/skills/cybersecurity-resource-curator/：自动加载的资源整理工作流 scripts/discoverresources.py：本地发现自动化脚本...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

OSCP-Exam-Report-Template-Markdown

Offensive Security 시험 보고서 템플릿 Markdown Offensive Security 시험 보고서 템플릿 Markdown 을 만들었으므로 더 이상 Offensive Security OSCP, OSWE, OSEE, OSWP, OSEP, OSED, OSWA, OSDA, OSMR, OSTH, OSIR 시험에서 LaTeX, Microsoft Office Word, LibreOffice Writer가 필요하지 않습니다! 이제 시험 보고서 작성 시 효율적이고 더 빠르게 작업할 수 있습니다! 🚀 작성 속도 향상 , 24시...

Stirling-PDF SSRF via Markdown

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security...

CVE-2026-104477

A flaw was found in showdown. The link and image parsers fail to properly sanitize or escape double quotation marks in destination URLs when rendering HTML attributes. A remote attacker could exploit this flaw by supplying crafted Markdown input containing malicious event handlers, leading to...

CVE-2024-41662

CVE-2024-41662 VNote バージョン 注: アプリケーションは、アプリ内で出力エンコーディングを実行することにより、一部のJavaScriptペイロードを適切に検証します。ただし、特定のケースでは検証に失敗します。 5. さらに、攻撃者は以下のペイロードを使用してリモートコード実行 を達成できます。 影響を受けるバージョンの詳細 =3.18.1 影響...

CVE-2022-45025

CVE-2022-45025 Markdown Preview Enhanced（VSCode、Atom）のPDFインポートにおけるコマンドインジェクション 説明 Mume マークダウンツールライブラリは、shell: true オプションを指定した spawn コマンドを使用していたため、コマンドインジェクションに対して脆弱でした。これにより、攻撃者は被害者を騙して特別に細工されたMarkdownファイルをVSCodeまたはAtomで開かせることで、任意のコード実行を達成できる可能性があります。このライブラリは、VSCode と Atom の両方でMarkdown Preview...

CVE-2026-104466

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

CVE-2026-104454

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

EUVD-2026-91477

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

CVE-2026-104466 YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

CVE-2026-104466

YesWiki versions prior to 4.6.7 are susceptible to a stored cross-site scripting (XSS) vulnerability located in the formatters/wakka.php component. The root cause is the improper handling of quotes in markdown image URLs , which allows users with page editing or comment posting privileges to inje...

EUVD-2026-91465

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104454

YesWiki versions before 4.6.7 are vulnerable to an algorithmic-complexity denial of service within the wakka.php formatter. The root cause is an O(n^2) markdown-link regular expression that allows unauthenticated attackers to submit a small, specially crafted body of bracket characters to the pag...