tmpmail

A temporary email right from your terminal written in POSIX sh tmpmail is a command line utility written in POSIX sh that allows you to create a temporary email address and receive emails to the temporary email address. It uses 1secmail's API to receive emails. By default w3m is used to render th...

Pentest-Collaboration-Framework

Pentest Collaboration Framework Pentest Collaboration Framework - an opensource, cross-platform and portable toolkit for automating routine processes when carrying out various works for testing! Explore the docs » ‼️ Important Links...

getaltname

GSAN - Get Subject Alternative Names GSAN is a tool that can extract Subject Alternative Names SAN found in SSL Certificates directly from https servers which can provide you with DNS names subdomains or virtual servers. It doesn't rely on Certificate Transparency logs, it connects directly to th...

CVE-2022-31902

CVE-2022-31902 Notepad++（x86） 在 8.4.3 及 之前版本 中存在拒绝服务（DoS）漏洞。 描述 通过打开特制的文本文件（例如 first.txt），然后在查找选项中使用“在所有打开文档中查找全部”或“在当前打开文档中查找全部”功能，触发漏洞。 以下举例说明，截至 2022年11月7日，最新版本的 Notepad++（x86）为 8.4.3。 概念验证 - 在 Notepad++ 中打开 first.txt，搜索任意字符，然后点击“在所有打开文档中查找全部”或“在当前打开文档中查找全部”按钮。 结果： Visual Studio 2019 转储分析...

CVE-2019-12735

CVE-2019-12735 是一个通过 vim/neovim 的 modeline 实现任意代码执行（Arbitrary Code Execution）的漏洞 root@kitploit: Product: Vim 8.1.1365, Neovim 0.3.6 Type: Arbitrary Code Execution CVE: CVE-2019-12735 Date: 2019-06-04 Author: Arminius @rawsec Vim 8.1.1365 之前的版本和 Neovim 0.3.6 之前的版本存在一个漏洞，当打开包含特殊内容的文本文件时，可以通过 modeli...

CVE-2026-30691

CVE-2026-30691 - 漏洞公告 CVE-2026-30691 的官方 MITRE 漏洞记录详情及技术文档。 root@kitploit: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Suggested description Cross-Site Scripting XSS vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt...

sub404

Sub404: A Fast Tool To Check Subdomain Takeover Vulnerability What is Sub 404 Sub 404 is a tool written in python which is used to check possibility of subdomain takeover vulnerability and it is fast as it is asynchronous. Why During recon process you might get a lot of subdomainse.g more than 10...

CVE-2026-32807

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly...

CVE-2026-32807

CVE-2026-32807 affects dataCycle-CORE prior to 25.07.3, where any user with a DataLink UUID can fetch an attached text file directly, even if expired or unauthenticated. The route is public and mailers embed the direct URL, allowing leaked or forwarded links to expose the attachment. Impact is co...

CVE-2026-32807 dataCycle Public DataLink Text File Download Ignores Validity And Authorization

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly...

CVE-2026-15677

The CVE-2026-15677 entry concerns code-projects Online Job Portal 1.0. Affected component: /JobSeekerInsert.php. Issue: manipulating the argument txtFile allows unrestricted upload, with the attack executable remotely and the exploit publicly available. Impact is described as unrestricted file up...

CVE-2026-15677

A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file /JobSeekerInsert.php. Executing a manipulation of the argument txtFile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to t...

CVE-2026-14801

Removed by vendor...

CVE-2026-34097

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in textfile.php lines 94, 101, 323, 403, 826, 852. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...

CVE-2026-34101

Guardian language-system is affected by an error-based SQL injection in text_file.php (line 17), where the id GET parameter is concatenated directly into a SQL query without sanitization: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$_GET['id']."'. An au...

CVE-2026-34101 Guardian Language-System SQL Injection via id Parameter in text_file.php

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in textfile.php line 17: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$GET'id'."'. An authenticated attacker can perform error-based SQL injection to extract...

CVE-2026-34101 Guardian Language-System SQL Injection via id Parameter in text_file.php

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in textfile.php line 17: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$GET'id'."'. An authenticated attacker can perform error-based SQL injection to extract...

EUVD-2026-41058

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in textfile.php line 17: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$GET'id'."'. An authenticated attacker can perform error-based SQL injection to extract...

CVE-2026-34097

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in textfile.php lines 94, 101, 323, 403, 826, 852. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...

CVE-2026-34097 Guardian Language-System XSS via id Parameter in text_file.php

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in textfile.php lines 94, 101, 323, 403, 826, 852. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...