freevulnsearch

freevulnsearch Этот скрипт NMAP NSE является частью проекта Free OCSAF - https://freecybersecurity.org. В сочетании со сканированием версий "-sV" в NMAP, соответствующие уязвимости автоматически назначаются с использованием CVE Common Vulnerabilities and Exposures, а степень серьезности уязвимост...

GooFuzz

GooFuzz – Мощь Google Dorks Авторы Автор: M3n0sD0n4ld Twitter: @DavidUton Описание: GooFuzz — это скрипт, написанный на Bash Scripting , который использует продвинутые методы поиска Google для получения конфиденциальной информации в файлах или каталогах, не делая запросов к веб-серверу. Что новог...

GitDorker

GitDorker GitDorker — это инструмент, который использует GitHub Search API и обширный список GitHub-дорков, собранных мной из различных источников, чтобы предоставить обзор конфиденциальной информации, хранящейся на GitHub, по заданному поисковому запросу. Основная цель GitDorker — предоставить...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

XWiki - HQL Injection

XWiki is vulnerable to Hibernate Query Language HQL injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potential...

ChanCMS <= 3.3.0 - SQL Injection

yanyutao0402 ChanCMS = 3.3.0 contains a SQL injection caused by manipulation of the "key" argument in app/modules/api/service/Api.js Search function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request. id: CVE-2025-10210 info: name: ChanCMS = 3.3.0 - SQL...

HellRaiser

HellRaiser Сканер уязвимостей Установка HellRaiser зависит от API cve-search. Запустите API cve-search и добавьте адрес в поле cvesearchapidomain в файле config/config.yml. Установите ruby 2.7.2, bundler 1.17.3 и rails. https://gorails.com/setup/ubuntu/20.04 Установите redis-server и nmap...

poc_monitor

pocmonitor Короткий скрапер, ищущий POC для CVE-2024-49112 Настройка cron-задания для запуска скрипта каждые 4 часа позволит поддерживать обновления. Оповещения можно настроить, но используется Discord webhook для уведомления в канал Discord. 0 /4 cd /root/monitorscript && /usr/bin/python3...

CVE-2026-11817

In multi-organization deployments, an Org Admin in one organization could call GET /api/access-control/users/permissions/search with actionPrefix=dashboards: and obtain dashboard and folder UIDs plus per-user permission mappings from other organizations. Single-organization deployments are not...

CVE-2026-16640

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...

CVE-2026-16640

Drupal Search API Autocomplete (versions 0.0.0 through 1.12.0) is affected by a Reflected XSS vulnerability. The root cause is a test script that is accessible to anonymous users and fails to sufficiently validate user input, allowing malicious scripts to be injected and reflected back. The issue...

CVE-2026-16640 Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...

CVE-2026-53529

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

EUVD-2026-64178

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

CVE-2026-11817

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

CVE-2026-55496 Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive ...

Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

This module enables you to add autocomplete suggestions for search forms created with the Search API module. The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting vulnerability. This vulnerability ...

CVE-2026-57821

A SQL Injection vulnerability exists in Apache Fineract's Office Search API GET /api/v1/offices in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to...

CVE-2026-56287

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API GET /api/v1/clients in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with...

CVE-2026-57821

A SQL Injection vulnerability exists in Apache Fineract's Office Search API GET /api/v1/offices in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to...