sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

rdpy

RDPY Remote Desktop Protocol in twisted python. RDPY is a pure Python implementation of the Microsoft RDP Remote Desktop Protocol protocol client and server side. RDPY is built over the event driven network engine Twisted. RDPY support standard RDP security layer, RDP over SSL and NLA...

Iran-War-Media

Iran War Media Monitor Read the Full Deep Dive Introduction This project monitors news coverage of the war between Iran, Israel, and the United States. You can use this repository to: 1. Create a corpus of media articles in English 2. Identify authors and news media outlets to keep track of who...

CVE-2025-24893_Analysis

CVE-2025-24893 - XWiki SolrSearch SSTI to unauthenticated RCE A self-contained Docker lab that reproduces CVE-2025-24893, a Server-Side Template Injection in XWiki's SolrSearch RSS feed that leads to unauthenticated remote code execution. It runs the vulnerable version 15.10.10 and the patched...

CVE-2026-128045

OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequentia...

CVE-2026-128041

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that...

CVE-2026-120573

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcategory' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-120573

The WPeMatico RSS Feed Fetcher plugin for WordPress (versions

EUVD-2026-124990

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcategory' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-120573 WPeMatico RSS Feed Fetcher <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcategory' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-128033 OpenMage magento-lts before 20.18.2 Information Disclosure via Order-Status RSS Feed

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in MageRssModelResourceOrder::getAllCommentCollection, which omits the isvisibleonfront filter for invoice, shipment and credit-memo comments. Authenticated customers can open...

EUVD-2026-125069

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in MageRssModelResourceOrder::getAllCommentCollection, which omits the isvisibleonfront filter for invoice, shipment and credit-memo comments. Authenticated customers can open...

CVE-2026-128033

The OpenMage magento-lts platform is affected by an information disclosure vulnerability in versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3. The root cause is located in the Mage_Rss_Model_Resource_Order::getAllCommentCollection() function, which fails to apply the is_visible_on_fron...

EUVD-2026-125067

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that...

CVE-2026-128041

The OpenMage magento-lts software versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that the system serves RSS feeds with a text/html content type without escaping feed entry data. An unauthenticated guest can subm...

CVE-2026-128045

OpenMage Magento-LTS versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 are vulnerable to an authorization bypass in the /rss/order/status feed. The root cause is that the feed's URL key consists of unsigned Base64-encoded JSON containing order, increment, and customer IDs. This allows ...

EUVD-2026-125063

OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequentia...

CVE-2025-24893

Exploit for CVE-2025-24893 CVE-2025-24893 is a critical unauthenticated remote code execution RCE vulnerability affecting the XWiki Platform. This flaw lets any guest user inject and execute arbitrary Groovy code —without authentication—via a specially crafted RSS request to the SolrSearch...

Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

The Import XML and RSS Feeds WordPress plugin before 2.1.5 allows unauthenticated attackers to execute arbitrary commands via a web shell. id: CVE-2023-4521 info: name: Import XML and RSS Feeds 2.1.5 - Unauthenticated RCE author: princechaddha severity: critical description: The Import XML and RS...

Changedetection.io RSS Single Watch - Cross-Site Scripting

changedetection.io 0.54.1 contains a stored XSS caused by unescaped reflection of UUID path parameter in RSS single-watch endpoint, letting remote attackers execute JavaScript in victim's browser, exploit requires victim to visit crafted URL. id: CVE-2026-27645 info: name: Changedetection.io RSS...