GooFuzz

GooFuzz - Googleダークの力 クレジット 作成者: M3n0sD0n4ld Twitter: @DavidUton 説明： GooFuzz は Bash スクリプト で書かれたスクリプトであり、高度なGoogle検索技術を利用して、Webサーバーにリクエストを送信せずにファイルやディレクトリ内の機密情報を取得します。 新機能 バージョン2.0 の新機能とツールの正しい使い方を学びたいですか？ こちらの記事 をチェックして、ツールを最大限に活用してください。 前提条件 Bash/Zsh : スクリプトが実行されるメインエンジン。 curl :...

GitDorker

GitDorker GitDorkerは、GitHub Search APIと、さまざまなソースから私が収集した広範なGitHub dorksリストを利用して、検索クエリに基づいてGitHub上に保存された機密情報の概要を提供するツールです。 GitDorkerの主な目的は、ユーザーにクリーンで調整された攻撃対象領域を提供し、GitHub上の機密情報の収集を開始できるようにすることです。GitDorkerは、GitRobやTrufflehogなどの追加ツールと組み合わせて、GitDorkerから見つかった興味深いリポジトリやユーザーに対して使用することで、最良の結果を得ることができます。...

freevulnsearch

freevulnsearch このNMAP NSEスクリプトは、Free OCSAFプロジェクトの一部です - https://freecybersecurity.org。NMAPのバージョンスキャン「-sV」と連携して、CVE（Common Vulnerabilities and Exposures）を使用して該当する脆弱性が自動的に割り当てられ、CVSS（Common Vulnerability Scoring System）を使用して脆弱性の重大度が割り当てられます。わかりやすくするために、CVSSは対応するv3.0 CVSS評価に割り当てられています。 緊急（CVSS 9.0 -...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

HellRaiser

HellRaiser 脆弱性スキャナー インストール HellRaiserは、cve-search APIに依存しています。cve-search APIを実行し、config/config.ymlのcvesearchapidomainフィールドにアドレスを追加してください。 ruby 2.7.2、bundler 1.17.3、railsをインストールします。 https://gorails.com/setup/ubuntu/20.04 redis-serverとnmapをインストールします。 sudo apt-get update sudo apt-get install...

XWiki - HQL Injection

XWiki is vulnerable to Hibernate Query Language HQL injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potential...

ChanCMS <= 3.3.0 - SQL Injection

yanyutao0402 ChanCMS = 3.3.0 contains a SQL injection caused by manipulation of the "key" argument in app/modules/api/service/Api.js Search function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request. id: CVE-2025-10210 info: name: ChanCMS = 3.3.0 - SQL...

CVE-2026-73976 djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read SELECT queries, this does not write to the...

CVE-2026-73976 djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read SELECT queries, this does not write to the...

poc_monitor

pocmonitor CVE-2024-49112 の POC を検索する短いスクレイパー 4時間ごとにスクリプトを実行するcronジョブを設定すると、更新が維持されます。アラートはカスタマイズ可能ですが、Discord Webhookを使用してDiscordチャンネルに通知します。 0 /4 cd /root/monitorscript && /usr/bin/python3 pocmonitor.py /var/log/pocmonitor/pocmonitor.log 2&1 デバッグセットの場合: cd /root/monitorscript && /usr/bin/python...

CVE-2026-11817

In multi-organization deployments, an Org Admin in one organization could call GET /api/access-control/users/permissions/search with actionPrefix=dashboards: and obtain dashboard and folder UIDs plus per-user permission mappings from other organizations. Single-organization deployments are not...

EUVD-2026-66208

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...

CVE-2026-16640

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...

CVE-2026-16640 Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...

CVE-2026-16640

The Drupal Search API Autocomplete module (versions 0.0.0 through 1.12.0 ) is vulnerable to Reflected Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. The flaw resides in a test script accessible to anonymous users that fails to sufficiently validate ...

CVE-2026-16640 Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...

CVE-2026-16640: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...

CVE-2026-53529

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

EUVD-2026-64178

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

CVE-2026-53529: Improper Neutralization of Input During Web Page Generation

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...