CVE-2026-73167

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

CVE-2026-73165

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

CVE-2026-73163

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

x8

x8 Hidden parameters discovery suite written in Rust. The tool aids in identifying hidden parameters that could potentially be vulnerable or reveal interesting functionality that may be missed by other testers. Its high accuracy is achieved through line-by-line comparison of pages, comparison of...

Arjun

Arjun HTTP Parameter Discovery Suite What's Arjun? Arjun can find query parameters for URL endpoints. If you don't get what that means, it's okay, read along. Web applications use parameters or queries to accept user input, take the following example into consideration...

param-miner

param-miner This extension identifies hidden, unlinked parameters. It's particularly useful for finding web cache poisoning vulnerabilities. It combines advanced diffing logic from Backslash Powered Scanner with a binary search technique to guess up to 65,000 param names per request. Param names...

redpill

:octocat: Project Description The redpill project aims to assist reverse tcp shells in post-exploration tasks. Often, on redteam appointments we need to use unconventional ways to access the target system, like reverse tcp shells not metasploit in order to bypass the defenses implemented by the...

ParamFinder

ParamFinder Discover hidden parameters straight from Caido! Installation Via Community Store Recommended 1. In your Caido, go to the Plugins page 2. Navigate to the Community Store 3. Search for ParamFinder 4. Click Install 5. Done! 🎉 Manual Installation 1. Navigate to the Releases page 2. Downlo...

x8-Burp

This app is no longer supported The tool helps to find hidden parameters that can be vulnerable or can reveal interesting functionality that other hunters miss. Greater accuracy is achieved thanks to the line-by-line comparison of pages, comparison of response code and reflections. Features...

spyse.py

spyse.py Python API wrapper and command-line client for the tools hosted on spyse.com. "Spyse is a developer of complete DAAS Data-As-A-Service solutions for Internet security professionals, corporate and remote system administrators, SSL / TLS encryption certificate providers, data centers and...

swagger-ui

Introduction: The Role of Swagger UI Swagger UI is a widely used library that renders OpenAPI formerly Swagger specifications into an interactive web interface. It enables developers and integrators to explore and test APIs without having the backend implementation in place. CVE‑2018‑25031 Detail...

CVE-2024-34225

Computer Laboratory Management System using PHP and MySQL 1.0 Submitter: Kha Do Vulnerability Cross Site Scripting Description Cross Site Scripting vulnerability in php-lms/admin/?page=systeminfo in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject...

CVE-2024-4577

CVE-2024-4577 A Proof of Concept developed by @watchTowr exploiting the PHP CGI Argument Injection vulnerability CVE-2024-4577 to obtain RCE on a vulnerable PHP version running in a Windows environment. Detailed technical analysis for this vulnerability Orange Tsi 🍊 This vulnerability was found b...

GetBlocked

GetBlocked! Cleaner pages. Fewer trackers. Local-only. GetBlocked! is a lightweight, local-only Chrome extension that helps reduce common third-party website tracking by blocking known tracker requests, cleaning tracking links, and explaining tracking attempts. It is built as a small, inspectable...

CVE-2024-34224

Computer Laboratory Management System using PHP and MySQL 1.0 Submitter: Kha Do Vulnerability Cross Site Scripting Description Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject...

DSXS

Damn Small XSS Scanner Damn Small XSS Scanner DSXS is a fully functional Cross-site scripting vulnerability scanner supporting GET and POST parameters written in under 100 lines of code. As of optional settings it supports HTTP proxy together with HTTP header values User-Agent, Referer and Cookie...

CVE-2025-53652-Jenkins-Git-Parameter-Analysis

CVE-2025-53652: Jenkins Git Parameter Plugin Unvalidated Input Vulnerability. Summary This vulnerability arises because user-controlled input from Jenkins build parameters is injected unsafely into the Git checkout command. User input is provided as a build parameter e.g., gitParameters, which ca...

CVE-2024-4577

Orange Tsi 🍊 This vulnerability was found by Orange Tsai @orange8361 of DEVCORE @d3vc0r3. Make sure to follow his outstanding research, our role was to only recreate and develop the exploit for this issue. Security Alert: CVE-2024-4577 PHP CGI Argument Injection Vulnerability Overview CVE-2024-45...

CVE-2022-32988

CVE-2022-32988 Affected products We have not yet tested Asus models other than those listed. However we suspect it may also work on other models with the same firmware version. root@kitploit: DSL-N14UB1 V.1.1.2.3805 Overview In router Asus DSL-N14U-B1 1.1.2.3805 was discovered to contain a stored...

sqlmc

SQLMC - Comprobador Masivo de Inyección SQL Demo Información Esta herramienta es solo con fines educativos, el uso de SQLMC para atacar objetivos sin consentimiento mutuo previo es ilegal. Los desarrolladores no asumen ninguna responsabilidad y no se hacen responsables de cualquier uso indebido o...