CVE-2026-78615

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

CVE-2026-78610

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...

CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

cmsms-sqli

CMS Made Simple = 2.2.9 SQL Injection CVE-2019-9053 - Python3 Exploit Reiner Python3-Port des ursprünglichen Exploit-DB 46635 von Daniele Scanu. Zeitbasierte blinde SQLi zum Auslesen von Admin-Anmeldedaten aus verwundbaren CMS Made Simple-Installationen. 🎯 Funktionen: ✅ Keine externen...

CVE-2025-30144

Summary La libreria fast-jwt non valida correttamente il claim iss in base alla RFC https://datatracker.ietf.org/doc/html/rfc7519page-9. Details La validazione del claim iss issuer all'interno della libreria fast-jwt consente un array di stringhe come valore iss valido. Questa lacuna progettuale...

burp-dom-scanner

Burp DOM Scanner É uma extensão do Burp Suite que permite rastreamento e escaneamento recursivo de Single Page Applications. Ele executa um navegador Chromium para escanear a página web por XSS baseado em DOM. Ele também pode coletar todas as requisições XHR, fetch, websockets, etc emitidas duran...

DBconfigReader

Schwachstelle in der Fanwei ecology OA-Systemschnittstelle: Offenlegung von Datenbankkonfigurationsinformationen /mobile/DBconfigReader.jsp http://x.x.x.x:8090/mobile/DBconfigReader.jsp Fortify-Code-Audit: Schwacher Verschlüsselungsalgorithmus erkannt SecretKey key =...

rack-bug

Rack::Bug Code Climate Repository: http://github.com/brynary/rack-bug Descrizione Rack::Bug aggiunge una barra degli strumenti diagnostica alle app Rack. Quando attivata, inietta un div flottante che consente di esplorare log, query al database, tempi di rendering dei template, ecc. Caratteristic...

CVE-2022-3546

CVE-2022-3546 https://vulners.com/cve/CVE-2022-3546 Una vulnerabilità è stata trovata in SourceCodester Simple Cold Storage Management System 1.0 e classificata come problematica. Interessata da questo problema è una funzionalità sconosciuta del file /csms/admin/?page=user/list del componente...

copy-fail-c

Copy Fail CVE-2026-31431 – C-Portierung Englisch en ∙ 日本語 ja ∙ 简体中文 zh-cn ∙ 한국어 ko ∙ Русский ru Eine plattformunabhängige C-Neuimplementierung des Copy-Fail-Linux-LPE CVE-2026-31431, offengelegt am 29.04.2026 von Theori / Xint. Die vollständige Schwachstellenbeschreibung, der Zeitplan und der...

copy-fail-c

Copy Fail CVE-2026-31431 - C port English en ∙ 日本語 ja ∙ 简体中文 zh-cn ∙ 한국어 ko ∙ Русский ru A cross-platform C reimplementation of the Copy Fail Linux LPE CVE-2026-31431, disclosed 2026-04-29 by Theori / Xint. See the canonical writeup at copy.fail for the full vulnerability description, timeline, a...

domainim

DOMAINIM Features • Usage • Installation • Usage • Contributing • Additional Notes Domainim is a fast domain reconnaissance tool for organizational network scanning. The tool aims to provide a brief overview of an organization's structure using techniques like OSINT, bruteforcing, DNS resolving...

scrying

NCC Group Scrying A new tool for collecting RDP, web and VNC screenshots all in one place This tool is still a work-in-progress and should be mostly usable but is not yet complete. Please file any bugs or feature requests as GitHub issues Motivation Since Eyewitness recently dropped support for R...

flask-saml2

flask-saml2 .. note:: Betreuer gesucht. Dieses Projekt wird nicht mehr gewartet. Die Bibliothek funktioniert, oder funktionierte zumindest, als ich sie zuletzt verwendet habe, aber ich arbeite nicht mehr an dem Projekt, für das dies entwickelt wurde. Wenn Sie interessiert sind, die Leitung und...

tplmap

Tplmap This project is no longer maintained. I'm happy to merge new PRs as long they don't break the test suite. Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operatin...

CVE-2026-43499-armv7

CVE-2026-43499 GhostLock — ARM32 Huawei Watch 4 Pro Tentativo di exploit per l'escalation dei privilegi del kernel Linux basato su CVE-2026-43499 GhostLock — Huawei Watch 4 Pro MDS-AL00, armv7l Panoramica del progetto Questo progetto è un tentativo di exploit della vulnerabilità del kernel...

linux-apache-fix-mod_rewrite-spaceInURL

Fix Apache modrewrite spazio nell'URL Linux Ubuntu Dopo l'ultimo aggiornamento di Apache, ho avuto alcuni problemi con gli "spazi negli URL" in modrewrite. 2023-04-25 - upgrade apache2:amd64 2.4.38-3+deb10u9 2.4.38-3+deb10u10 Gli URL che contengono "spazio" e che sono stati sostituiti con %20...

DATA

DATA: Analyse und Automatisierung von Credential-Phishing Folien des Vortrags auf der CircleCityCon 2017 Getestet auf Headless Ubuntu Server 16.04 BUCKLEGRIPPER py Eine verdächtige Phishing-URL oder eine Datei mit zeilenweise getrennten URLs besuchen, Screenshots erstellen und nach interessanten...

CVE-2026-43494-PinTheft-PoC

SLEY — PoC PinTheft CVE-2026-43494 Prova di concetto — uid=1000raken → uid=0root dopo ./sley su WSL2 6.6.87.2-microsoft-standard-WSL2 Prova di concetto in un singolo file per CVE-2026-43494 PinTheft: un'escalation dei privilegi locale del kernel Linux che combina un bug di conteggio dei riferimen...

CVE-2017-13253

CVE-2017-13253 كود PoC لثغرة CVE-2017-13253. الشرح الكامل متاح هنا. لاحظ أن الأرقام مختلفة قليلاً عن مقال المدونة، حيث وجدت أن هناك فرصة أكبر لحدوث انهيار crash مع كومة بحجم 0x2000 بالطبع إذا قمت بتشغيله مرات كافية فسوف ينهار على أي حال. لأي أسئلة/مشاكل/تعليقات، يمكنك التواصل معي على تويتر...