poro

poro Description Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value...

shepard

SHEPARD BITS This is a persistance tool using Windows Background Intelligent Transfer Service BITS. Functionality File Download, File Exfiltration, File Download + Persistent Execution Usage Run shepard.exe as Administrator with the following command line arguments: -d : regular file download to ...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

remic

remic Vulnerability Scanner for Detecting Publicly Disclosed Vulnerabilities in Application Dependencies Usage $ remic -h NAME: remic - A simple and fast tool for detecting vulnerabilities in application dependencies USAGE: remic options file VERSION: 0.0.2 OPTIONS: --format value, -f value forma...

CVE-2026-111464

The WP Fastest Cache plugin for WordPress (versions up to and including 1.5.3 ) is vulnerable to Sensitive Information Exposure . The plugin fails to honor no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state when caching the Core wp-activate.php response. This results ...

CVE-2026-111464 WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response

The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate- cookie, or the WPINSTALLING state, writi...

CVEs

My publicly published security advisories...

gha-lab-a7f6217d26

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of wp-graphql/wp-graphql at commit...

vulnerability-research

Vulnerability Research My corpus of publicly disclosed vulnerabilities and other findings...

fuzz4bounty

🚀💰fuzz4bounty 🚀Wordlists for Bug Bounty Hunting This repository contains publicly available wordlists for Bug hunting. The main Objective for creating this repo is to bring all the available wordlists at one place. Wordlists will be updated regularly. Feel free to contribute, Pull Requests are...

Chrome-CVE-2024-2887-RCE-POC

Chrome-CVE-2024-2887-RCE-Poc Overview Vulnerability Name：Google Chrome Type Confusion Threat Type：Code Execution Exploitation Likelihood：High POC Status：Publicly Disclosed In-the-Wild Exploitation Status：Not Disclosed EXP Status：Publicly Disclosed Technical Details Status：Publicly Disclosed This...

s3_objects_check

S3 Objects Check Description Whitebox evaluation of effective S3 object permissions, in order to identify publicly accessible objects. Allows identifying publicly accessible objects, as well as objects accessible for AuthenticatedUsers by using a secondary profile. A number of tools exist which...

bucketbuster

BucketBuster Cloud object-storage exposure scanner and read-only storage CLI for authorized security testing, bug bounty work, and infrastructure you own. BucketBuster checks candidate bucket names against public endpoints for Yandex Cloud, VK Cloud, Selectel, SberCloud, Alibaba OSS, Tencent COS,...

CVE-2021-21972

VMware vCenter Server RCE — CVE-2021-21972 Research Lab Author: Niranjan Pokhrel Independent research project reproducing and documenting a critical, publicly disclosed VMware vCenter Server vulnerability in an isolated home lab, to understand the vulnerability class, exploitation path, and...

EUVD-2026-114215

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user...

PT-2026-133697

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user...

Graham Steffaniak filebrowser path traversal vulnerability

A security vulnerability exists in Graham Steffaniak FileBrowser versions prior to 1.5.2-stable and from 2.0.0-beta up to 2.0.1-beta. This vulnerability arises because file reading processes fail to verify that the resolved target of symbolic links lies within the source root directory and is...

CVE-2026-91157 Discourse: Media uploads remain publicly accessible after category permissions are restricted

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk...

CVE-2026-109162

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/userupload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted,...

CVE-2026-109162

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/userupload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted,...