CVE-2021-38583

CVE-2021-38583 openBaraza HCM HR Payroll v.3.1.6 vulnerabilità XSS riflesso openBaraza HCM HR Payroll v.3.1.6 non neutralizza correttamente l'input controllabile dall'utente, consentendo una vulnerabilità di cross-site scripting XSS riflesso su più pagine. https://openbaraza.org...

Krawl

Krawl A modern, customizable web honeypot server designed to detect and track malicious activity from attackers and web crawlers through deceptive web pages, fake credentials, and canary tokens. Table of Contents Demo What is Krawl? Krawl Dashboard Deployment Modes Krawl Banlist Quickstart Docker...

cve-2026-31431-poc

CVE 2026-31431 POC Questa vulnerabilità sfrutta un errore nel controllo della lunghezza di authencesn in Linux, che causa il write back di pagine dirty in aree a cui l'utente non ha permessi, determinando un'escalation dei privilegi Il principio di attacco si basa principalmente su questo repo, c...

memguard

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...

malicious-pdf

Malicious PDF Generator ☠️ Generate 67 malicious PDF test files for testing phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh Used for penetration testing, bug bount...

testenv

SQL injection test environment A collection of web pages vulnerable to SQL injection flaws and more: conf/ - operating system configuration files used by deployment.sh. dbs/ - standalone databases for some database management systems e.g. Microsoft Access. libs/ - web API libraries to connect to...

CVE-2026-32258

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manageeditor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on...

CVE-2026-32258

Winter CMS (a Laravel-based PHP CMS) versions 1.2.10 through 1.2.12 are vulnerable to stored XSS when authenticated backend users with the backend.manage_editor permission inject malicious code via Editor Settings → Markup Styles . The custom styles are compiled by the LESS parser and rendered un...

CVE-2026-79228

A flaw was found in Google Chrome. An incorrect authorization vulnerability within the Site Isolation feature allows a remote attacker, who has compromised the renderer process, to bypass site isolation. This can be achieved by a crafted HTML page, leading to unauthorized access to privileged pag...

CVE-2019-17427

CVE-2019-17427 CVE-2019-17427 POC XSS persistente In Redmine precedente alla versione 3.4.11 e 4.0.x precedente alla 4.0.4, esiste XSS persistente a causa di errori di formattazione textile. La vulnerabilità esiste essenzialmente su qualsiasi pagina wiki che per impostazione predefinita utilizza ...

CVE-2026-16984

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin (also known as WP Legal Pages ) versions before 3.7.1 lack an authorization check on a REST route that returns stored account data. This allows unauthenticated visitors to retrieve ...

CVE-2026-16984 WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

CVE-2026-16984 WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

CVE-2023-41436-CSZ-CMS-Stored-XSS---Pages-Content

CSZ CMS XSS Memorizzato v1.3.0 Autore: Sergio CVE: 2023-41436 Descrizione: La vulnerabilità di Cross Site Scripting in CSZCMS v.1.3.0 consente a un utente malintenzionato locale di eseguire codice arbitrario tramite uno script appositamente predisposto nel parametro Additional Meta Tag nel...

gahoole77.github.io

Questo repository non contiene un README...

Mnemosyne

Mnemosyne Meu memorando pessoal de segurança da informação Curiosidade O nome deste projeto vem da deusa grega da memória: Mnemosyne. Além disso, e em relação à nossa história, é interessante notar que é a origem da palavra memória. Uso Mnemosyne está publicamente disponível no subdomínio de mesm...

CVE-2026-55468

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468

CVE-2026-55468 affects the internal Pages admin API in Wagtail , an open-source CMS built on Django. The API returns page fields declared in api_fields without sufficient access control , allowing any user with Wagtail admin access to retrieve restricted draft and live page content , including ba...