CVE-2026-102173

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in ExceptionalElements::imageelement, which concatenates a...

EUVD-2026-94172

A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...

CVE-2026-102173

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.3.1 . The root cause is insufficient escaping in the ExceptionalElements::image_element() function, which directly concaten...

CVE-2026-102173 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in ExceptionalElements::imageelement, which concatenates a...

CVE-2026-102173 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in ExceptionalElements::imageelement, which concatenates a...

EUVD-2026-94167

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in ExceptionalElements::imageelement, which concatenates a...

doctrack

Doctrack Tool to manipulate and weaponize Office Open XML documents. Features Create Office Open XML documents Word, Excel Insert tracking pixels and UNC paths Remote Template injection Insert CustomXML parts Inspect external target URLs, metadata and Custom XML parts Installation You will need t...

CVE-2025-57462

CVE-2025-57462 Описание: Хранимая XSS через вредоносную загрузку файлов в machpanel 8.0.32. PoC: Перейдите на https://controlpaneldomain/Client/SubmitTicket.aspx и загрузите PDF-файл, содержащий XSS-скрипты в метаданных. После отправки тикета вы сможете выполнить вредоносный XSS-скрипт, обративши...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

username-anarchy

Username Anarchy Version: 0.6 20 September 2024 Author: urbanadventurer Andrew Horton Homepage: https://www.morningstarsecurity.com/research/username-anarchy Source: https://github.com/urbanadventurer/username-anarchy/ License: MIT Description Tools for generating usernames when penetration...

zannotate

ZAnnotate ZAnnotate — это утилита на Go, которая упрощает аннотирование больших наборов IP-адресов с метаданными сети. В настоящее время включает: CLI Flag| Description| Needs API Key| Needs Data Download ---|---|---|--- --censys| Интернет-разведка Censys живой API| Да| --cymru| Данные об...

nextjs-cve-2026-44578

nextjs-cve-2026-44578 Шаблоны Nuclei для обнаружения CVE-2026-44578 SSRF через WebSocket Upgrade в Next.js с мультиоблачной валидацией метаданных, определением отпечатков Next.js и реальными рабочими процессами сканирования. Включает ссылки на оригинальные исследования NextSSRF и инструменты...

CVE-2025-31324_PoC_SAP

CVE-2025-31324PoC Доказательство концепции для CVE-2025-31324: Неавторизованная загрузка в SAP NetWeaver Visual Composer Metadata Uploader Данный скрипт выполняет: 1. Загрузку файла на уязвимую конечную точку через хост/порт загрузки 2. Опциональный запуск через HTTP GET через хост/порт триггера ...

telegram-story-scraper

Scraper d'Histoires Telegram 📱 Un script Python qui vous permet de scraper et télécharger automatiquement les stories de vos amis Telegram à l'aide de la bibliothèque Telethon. Le script surveille et enregistre en continu les photos et vidéos des stories, ainsi que leurs métadonnées. TGSS -...

evine

Evine Interactive CLI Web Crawler. Evine is a simple, fast, and interactive web crawler and web scraper written in Golang. Evine is useful for a wide range of purposes such as metadata and data extraction, data mining, reconnaissance and testing. If you like the project, give it a star. It forces...

CVE-2025-43300

CVE-2025-43300 : Corruption mémoire dans le traitement d'images DNG sur iOS/macOS Présentation CVE-2025-43300 est une vulnérabilité critique de corruption mémoire dans le framework de traitement d'images d'Apple qui affecte iOS 18.6.1 et les systèmes macOS. La vulnérabilité réside dans le code de...

exifLooter

Exif Looter Article de blog » · Signaler un bug · Proposer une fonctionnalité Table des matières 1. Pour commencer Installation 2. Utilisation Analyser une image spécifique Analyser un répertoire spécifique Tuyauter avec d'autres outils Supprimer les métadonnées des images Obtenir l'URL Open Stre...

CVE-2017-9096-iText-XXE

CVE-2017-9096 1. Создание вредоносного PDF с XXE Получите PDF с формой: wget https://www.pdfscripting.com/public/FreeStuff/PDFSamples/ModifySubmitExample.pdf -O input.pdf Распаковка PDF Для этого необходимо распаковать PDF с помощью qpdf --qdf --object-streams=disable input.pdf output.pdf, затем...

FormCraft3 <= 3.9.15 - Server-Side Request Forgery

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions. id: CVE-2026-65442 info: name: FormCraft3 = 3.9.15 - Server-Side Request Forgery author: DhiyaneshDk severity: high description: | Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...