CVE-2024-51665

CVE-2024-51665 Magical Addons For Elementor = 1.2.1 - Authenticated Subscriber+ Server-Side Request Forgery Description: The Magical Addons For Elementor Header Footer Builder, Free Elementor Widgets, Elementor Templates Library plugin for WordPress is vulnerable to Server-Side Request Forgery in...

CVE-2024-1380

CVE-2024-1380 Relevanssi – A Better Search = 4.22.0 - Missing Authorization to Unauthenticated Query Log Export Description The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relevanssiexportlogcheck function...

yeti

Plataforma Yeti Yeti tiene como objetivo cerrar la brecha entre los profesionales de CTI y DFIR al proporcionar una plataforma de inteligencia forense y un pipeline para equipos de DFIR. Nació de la frustración de tener que responder a la pregunta "¿dónde he visto este artefacto antes?" o "¿cómo...

reconerator

Resumen Este es un ensamblado .NET personalizado que realiza una serie de actividades de reconocimiento situacional. Hay varios conjuntos de funcionalidades actuales: BASIC - Obtiene información del disco y del registro. LDAP - Permite realizar consultas LDAP personalizadas de Active Directory...

CVE-2025-50110

CVE-2025-50110 Cleartext Transmission of Sensitive Information in EagleEyes Lite Android Application 1. Overview Name : EagleEyesLite Version : 2.0.0 Vendor : AVTECH CWE : CWE-319: Cleartext Transmission of Sensitive Information, CWE-598: Use of GET Request Method With Sensitive Query Strings CVS...

CVE-2012-1823

PHP CGI Argument Injection CVE-2012-1823 Description sapi/cgi/cgimain.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script aka php-cgi, does not properly handle query strings that lack an = equals sign character, which allows remote attackers to execute arbitrary code by...

wordlistgen

wordlistgen ¿Qué y por qué? wordlistgen es una herramienta para pasar una lista de URLs y obtener una lista de palabras relevantes para tus listas de palabras. Las listas de palabras son mucho más efectivas cuando tomas en cuenta el contexto de la aplicación. wordlistgen extrae componentes de URL...

CVE-2026-44262

dedoc/scramble RCE CVE-2026-44262 PoC 📜 Description CVE-2026-44262 is an unauthenticated Remote Code Execution vulnerability in dedoc/scramble, a Laravel API documentation generator. NodeRulesEvaluator::doEvaluateExpression calls extract$variables before eval"return $code;". When a controller...

CVE-2024-27304-PoC

CVE-2024-27304-PoC references DEF CON 32 - SQL Injection Isn't Dead Smuggling Queries at the Protocol Level - Paul Gerste pgx SQL Injection via Protocol Message Size Overflow webapp A simple web application with login functionality. Only administrators can log in. This application uses PostgreSQL...

CVE-2026-54433

CVE-2026-54433: Roundcube plain-text email stored XSS This repository contains a configurable Python proof of concept for CVE-2026-54433 , a stored cross-site scripting vulnerability in Roundcube's plain-text email renderer. An unauthenticated sender can deliver a crafted text/plain message. When...

CVE-2026-88785

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN acce...

graphicator

Graphicator Graphicator es un "scraper" / extractor de GraphQL. La herramienta itera sobre el documento de introspection devuelto por el endpoint de GraphQL objetivo, y luego reestructura el esquema en una forma interna para poder recrear las consultas soportadas. Cuando se crean dichas consultas...

CVE-2026-88785

The Simple Membership WordPress plugin, in versions before 4.8.3 , is vulnerable to credential exposure. When the optional auto-login-after-registration feature is enabled, the plugin transmits a newly registered member's plaintext password within a URL query string . This exposure allows anyone ...

EUVD-2026-96773

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN acce...

CVE-2026-88785 Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN acce...

CVE-2026-55993

camel-atmosphere-websocket Header Injection Reproducer CVE-2026-55993 This project demonstrates a message-header injection in Apache Camel's camel-atmosphere-websocket component, tracked as CVE-2026-55993. The WebSocket consumer copies the connection's query parameters onto the Camel Exchange...

CVE-2025-30208

CVE-2025-30208 — Vite Arbitrary File Read · v5 CVE: CVE-2025-30208 GHSA: GHSA-x574-m823-4x7w Severity: CVSS 5.3 Medium network-accessible dev server ⚠ For authorized security engagements only. Unauthorized use against systems you do not own or have explicit written permission to test is illegal...

web

Netzwerkweite Werbeblockierung über Ihre eigene Linux-Hardware Pi-hole-Website | Dokumentation | Discourse-Forum | Spenden Pi-hole-Weboberfläche Die Weboberfläche von Pi-hole® basierend auf AdminLTE bietet einen zentralen Ort, um Ihre Pi-hole-Installation zu verwalten und die von FTLDNS™...

qsreplace

qsreplace Acepta URLs desde stdin, reemplaza todos los valores de la cadena de consulta con un valor proporcionado por el usuario, solo genera cada combinación de parámetros de cadena de consulta una vez por host y ruta. Uso Archivo de entrada de ejemplo: ▶ cat urls.txt...

dnspeep

dnspeep dnspeep te permite espiar las consultas DNS que tu computadora está realizando. Aquí hay un ejemplo de salida: $ sudo dnspeep query name server IP response A incoming.telemetry.mozilla.org 192.168.1.1 CNAME: telemetry-incoming.r53-2.services.mozilla.com, CNAME:...