kostebek

Reconnaissance Tool Introduction The Kostebek is a reconnaissance tool which uses firms' trademark information to discover their domains. Reference : https://evren.ninja/en/post/recon-is-everywhere/ Demo video : Setup Downloading Kostebek git clone https://github.com/esecuritylab/kostebek...

CVE-2026-95165

Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting XSS in the Organization name field...

PT-2026-106166

Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting XSS in the Organization name field...

EUVD-2026-92703

Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting XSS in the Organization name field...

CVE-2026-95165

Bacularis versions 5.4.0 through 6.5.1 are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The flaw exists specifically within the Organization name field . No information regarding the root cause, practical impact, remediation, or available exploits is provided in the documents.

CVE-2026-95165

Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting XSS in the Organization name field...

CVE-2026-95165: Undefined Security Weakness

Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting XSS in the Organization name field...

CVE-2026-95682

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "";. Because the value was placed inside a double-quoted...

CVE-2026-95682

MISP contains a stored XSS in the admin email composition screen . The MISP.org organization name was interpolated into a JavaScript string literal via an unescaped PHP echo (var org = ""), so a name containing a double-quote or backslash could terminate the literal and inject arbitrary script. T...

EUVD-2026-84399

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "";. Because the value was placed inside a double-quoted...

CVE-2026-95682 MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "";. Because the value was placed inside a double-quoted...

CVE-2026-95682 MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "";. Because the value was placed inside a double-quoted...

CVE-2026-95682: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = " ";. Because the value was placed inside a double-quoted...

EUVD-2026-42252

Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. Attackers can craft payloads in the organization name field to redirect users to untrusted websites, enabling phishing attacks and...

CVE-2026-56283

Capgo before 12.128.2 contains an HTML injection vulnerability in the organization settings endpoint. Attackers can inject malicious HTML into the organization name field, enabling an open redirection to untrusted websites, which could facilitate phishing and reputational damage. The CVE entry no...

GO-2026-5305 Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs

Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CVE-2026-52813 Gogs: Path Traversal in organization name results in RCE through Git hooks

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences ../ are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary...

CVE-2026-52813

CVE-2026-52813 (Gogs) involves a path traversal flaw in organization names that contain ../ sequences, causing writes to arbitrary filesystem paths. The root cause is insufficient sanitization in internal/database/org.go (and related repo path logic), enabling an attacker to nest Git repositories...

GHSA-C39W-43GM-34H5 Gogs has Path Traversal in organization name that results in RCE through Git hooks

Summary Organization names containing path traversal sequences ../ are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of...

PT-2026-51631

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3 Description Gogs contains a path traversal flaw where organization names containing relative path sequences e.g., ../ are accepted without proper sanitization. This occurs because the internal/database/org.go file...