XSSTRON

XSSTRON, Navegador Electron JS para encontrar vulnerabilidades XSS Potente navegador Chromium para encontrar vulnerabilidades XSS automáticamente mientras navegas por la web, puede detectar muchos casos de uso con soporte también para solicitudes POST Instalación root@kitploit: Install Node.js an...

extended-xss-search

Buscador y Finder de XSS Extendido Esta es la versión extendida basada en la idea inicial ya publicada como "xssfinder". Esta versión privada permite a un atacante realizar no solo solicitudes GET sino también POST. Además, es posible proxy cada solicitud a través de Burp u otro túnel. Primeros...

St. Joe ERP system - SQL Injection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

CVE-2025-55182_RCE_Exploit

CVE-2025-55182RCEExploit REC Exploit es una herramienta de pruebas de seguridad basada en Python que automatiza la detección de posibles condiciones de RCE en entornos autorizados. Envía solicitudes POST personalizadas a los objetivos, analiza las respuestas del servidor en busca de indicadores d...

CVE-2026-92586: Missing Authorization

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38413)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the delWiFiScheduleCfg function. Attackers can exploit this vulnerability by sending specially crafted POST request...

CVE-2026-91941 Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

PT-2026-92060

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

CVE-2026-91941: Uncontrolled Resource Consumption

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

CVE-2026-78083: Cross-Site Request Forgery (CSRF)

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...

CVE-2026-86768: Improper Input Validation

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

CVE-2026-86416: Missing Authorization

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...

CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CVE-2026-86090: Missing Authorization

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

CVE-2026-85650: Server-Side Request Forgery (SSRF)

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CVE-2026-84806: Incorrect Permission Assignment for Critical Resource

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

CVE-2026-84187: Improper Access Control

AVideo contains a missing authentication vulnerability in plugin/Live/onpublish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to modi...

CVE-2026-72846: Server-Side Request Forgery (SSRF)

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...

next.js: Next.js: Denial of Service via crafted POST requests to server actions

A flaw was found in Next.js. Applications utilizing Partial Prerendering via the Cache Components feature are susceptible to connection exhaustion. A remote attacker can send crafted POST requests to a server action, triggering a request-body handling deadlock. This leaves connections open,...

CVE-2026-72803: Missing Authorization

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs...