extended-ssrf-search

Extended ssrf search This tool search for SSRF using predefined settings in different parts of a request path, host, headers, post and get parameters. First step Rename example.app-settings.conf to app-settings.conf and adjust settings. The most important setting is the callback url. I recommend ...

poc-cve-2018-1273

CVE-2018-1273 Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted...

Jenkins-CVE-2024-23897-Lab

Jenkins CVE-2024-23897 Lab Arbitrary file read vulnerability in Jenkins 2.441 and earlier. Launch docker-compose up -d Automated Attack docker exec -it attacker-host ./auto-exploit.sh Manual Attack docker exec -it attacker-host bash cd /tmp curl -o jenkins-cli.jar...

EUVD-2024-55851

Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request parameter is used to locate a file without restricting access to an intended directory or rejecting traversal sequences...

CVE-2025-52289

CVE-2025-52289: Broken Access Control in MagnusBilling v7.8.5.3 Description A Broken Access Control vulnerability exists in MagnusBilling versions prior to v7.8.5.3. Newly registered users can escalate their account status from pending to active without administrator approval by modifying a reque...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 nuclei template Joomla CVE-2023-23752 - a request parameter breaks through the Rest API Affected version ​ Joomla roughly has three routing entries, which are 1. index.php in the root directory users access articles 2. administrator/index.php in the root directory...

EUVD-2026-119472

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user...

CVE-2026-19876

A reflected cross-site scripting XSS vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1BN4820260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is...

EUVD-2026-118001

A reflected cross-site scripting XSS vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1BN4820260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is...

PT-2026-137872

Name of the Vulnerable Software and Affected Versions INFINITT ULite versions prior to 5.0.2.1 BN50 Description A reflected cross-site scripting XSS issue exists in the login/SSO error page. This occurs because an unsanitized request parameter is reflected without output encoding, allowing an...

CVE-2026-120646

A flaw was found in perl-cgi. A remote attacker can trigger a Denial of Service DoS by supplying a crafted request parameter processed by the uploadInfo function. Because the function fails to verify that the parameter represents an upload file handle, the invalid input causes an unhandled...

CVE-2015-20130

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

Security Bulletin: vulnerability detected in informixhq-server

Summary Vulerabiltity in web component [email protected] Vulnerability Details CVEID:CVE-2026-84363 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as...

CVE-2015-20130

Netsweeper versions before 4.0.11 and 4.1.0 before 4.1.5 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the webadmin/reporter/view_server_log.php component. The root cause is the lack of proper output encoding when handling the log request parameter. Remote attackers ca...

CVE-2015-20130 Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

EUVD-2015-9439

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

VulnCheck KEV: CVE-2015-20130

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

PT-2026-133615

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view server log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the...

CVE-2015-20130: Netsweeper: Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in…

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

CVE-2026-113667

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...