CVE-2022-31902

CVE-2022-31902 Denial Of Service DoS in Notepad++x86 in 8.4.3 and before. Description Vulnerability triggering, via opening a specially crafted text file e.g. first.txt and then using options Find All in All Opened Document or Find All in Current Opened Document under Find options. As an...

CVE-2019-12735

CVE-2019-12735 An Arbitrary Code Execution vulnerability through modeline in vim/neovim root@kitploit: Product: Vim 8.1.1365, Neovim 0.3.6 Type: Arbitrary Code Execution CVE: CVE-2019-12735 Date: 2019-06-04 Author: Arminius @rawsec Vim versions before 8.1.1365 and Neovim versions before 0.3.6 hav...

Pentest-Collaboration-Framework

Pentest Collaboration Framework Pentest Collaboration Framework - an opensource, cross-platform and portable toolkit for automating routine processes when carrying out various works for testing! Explore the docs » ‼️ Important Links...

getaltname

GSAN - Get Subject Alternative Names GSAN is a tool that can extract Subject Alternative Names SAN found in SSL Certificates directly from https servers which can provide you with DNS names subdomains or virtual servers. It doesn't rely on Certificate Transparency logs, it connects directly to th...

tmpmail

A temporary email right from your terminal written in POSIX sh tmpmail is a command line utility written in POSIX sh that allows you to create a temporary email address and receive emails to the temporary email address. It uses 1secmail's API to receive emails. By default w3m is used to render th...

CVE-2026-30691

CVE-2026-30691 - Vulnerability Advisory Official MITRE vulnerability record details and technical documentation for CVE-2026-30691. root@kitploit: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Suggested description Cross-Site Scripting XSS vulnerability in @cyntler/react-doc-viewer v1.17.1 allo...

sub404

Sub404: A Fast Tool To Check Subdomain Takeover Vulnerability What is Sub 404 Sub 404 is a tool written in python which is used to check possibility of subdomain takeover vulnerability and it is fast as it is asynchronous. Why During recon process you might get a lot of subdomainse.g more than 10...

CVE-2026-32807

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly...

CVE-2026-32807

CVE-2026-32807 affects dataCycle-CORE prior to 25.07.3, where any user with a DataLink UUID can fetch an attached text file directly, even if expired or unauthenticated. The route is public and mailers embed the direct URL, allowing leaked or forwarded links to expose the attachment. Impact is co...

CVE-2026-32807 dataCycle Public DataLink Text File Download Ignores Validity And Authorization

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly...

CVE-2026-15677

The CVE-2026-15677 entry concerns code-projects Online Job Portal 1.0. Affected component: /JobSeekerInsert.php. Issue: manipulating the argument txtFile allows unrestricted upload, with the attack executable remotely and the exploit publicly available. Impact is described as unrestricted file up...

CVE-2026-15677

A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file /JobSeekerInsert.php. Executing a manipulation of the argument txtFile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to t...

CVE-2026-14801

Removed by vendor...

CVE-2026-34097

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in textfile.php lines 94, 101, 323, 403, 826, 852. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...

CVE-2026-34101

Guardian language-system is affected by an error-based SQL injection in text_file.php (line 17), where the id GET parameter is concatenated directly into a SQL query without sanitization: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$_GET['id']."'. An au...

CVE-2026-34101 Guardian Language-System SQL Injection via id Parameter in text_file.php

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in textfile.php line 17: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$GET'id'."'. An authenticated attacker can perform error-based SQL injection to extract...

CVE-2026-34101 Guardian Language-System SQL Injection via id Parameter in text_file.php

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in textfile.php line 17: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$GET'id'."'. An authenticated attacker can perform error-based SQL injection to extract...

EUVD-2026-41058

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in textfile.php line 17: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$GET'id'."'. An authenticated attacker can perform error-based SQL injection to extract...

CVE-2026-34097

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in textfile.php lines 94, 101, 323, 403, 826, 852. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...

CVE-2026-34097 Guardian Language-System XSS via id Parameter in text_file.php

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in textfile.php lines 94, 101, 323, 403, 826, 852. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...