CVE-2026-107270

Gophish versions through 0.12.1 are vulnerable to an Insecure Direct Object Reference (IDOR) (CWE-639) vulnerability. This flaw allows authenticated users to perform an object takeover by supplying sequential IDs in POST requests to the /api/groups/, /api/templates/, /api/pages/, and /api/smtp/ e...

extended-xss-search

Extended XSS Searcher and Finder 这是基于已发布的原始思路 "xssfinder" 的扩展版本。此私有版本允许攻击者不仅执行 GET 请求，还能执行 POST 请求。此外，还可以通过 Burp 或其他隧道代理每个请求。 第一步 将 example.app-settings.conf 重命名为 app-settings.conf 并调整设置。开箱即用通常没问题，但根据目标，我建议调整块大小。 执行 此工具不通过 CLI 接受任何参数，因此只需输入： python3 extended-xss-search.py 配置 可以设置大量选项和设置，以下是一些说明。 ...

XSSTRON

XSSTRON, Electron JS 浏览器，用于发现 XSS 漏洞 强大的 Chromium 浏览器，可在浏览网页时自动发现 XSS 漏洞，支持多种场景，同时支持 POST 请求 安装 安装 Node.js 和 npm（https://www.npmjs.com/get-npm）或（sudo apt install npm） 下载本仓库文件或（git clone https://github.com/RenwaX23/XSSTRON） cd XSSTRON npm install npm start 部分使用 Debian/Ubuntu 的用户可能无法运行该工具——我认为这是...

St. Joe ERP system - SQL Injection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

CVE-2026-105205

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...

CVE-2025-55182_RCE_Exploit

CVE-2025-55182RCEExploit REC Exploit es una herramienta de pruebas de seguridad basada en Python que automatiza la detección de posibles condiciones de RCE en entornos autorizados. Envía solicitudes POST personalizadas a los objetivos, analiza las respuestas del servidor en busca de indicadores d...

EUVD-2026-91474

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in...

Malicious code in exiouss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43ce408818d0222061c3b6ed499d77a245aae78e30e4f57c8e6e77ee52705805 main.js in [email protected] imports childprocess and issues POST requests to hardcoded endpoints, including https://gemini.google.com and...

PT-2026-99376

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.19.1 Description An issue exists where the legacy apiCall service executor pkg/engine/apicall/executor.go and the GlobalContextEntry external-API path do not apply the default egress blocklist or scoped-token...

EUVD-2026-84536

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

CVE-2026-75511 Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

PT-2026-96789

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 Description Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl. These values are processed through...

SUSE CVE-2026-72803

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs...

PT-2026-96127

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description Cross Site Scripting XSS occurs when the application fails to properly sanitize the Referer header during POST requests to the 'index.php' endpoint. This allows the value of the header to be copied into the...

PT-2026-95797

Name of the Vulnerable Software and Affected Versions Payment Gateway of Stripe for WooCommerce versions prior to 5.0.9 Description Improper Verification of Cryptographic Signature occurs due to the woocommerce api wt stripe webhook endpoint EH Stripe Webhook Handler::handle failing to execute th...

CVE-2026-92586: Missing Authorization

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38413)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the delWiFiScheduleCfg function. Attackers can exploit this vulnerability by sending specially crafted POST request...

CVE-2026-91941 Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

PT-2026-92060

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.9.3 Description An uncontrolled resource consumption issue exists in the PDFContentScrapingStrategy that allows untrusted clients to cause a denial of service. Attackers can trigger this by selecting the PDF scrapi...

CVE-2026-91941: Uncontrolled Resource Consumption

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...