sh00t

A Testing Environment for Manual Security Testers Sh00t is a task manager to let you focus on performing security testing provides To Do checklists of test cases helps to create bug reports with customizable bug templates Features: Dynamic Task Manager to replace simple editors or task management...

lazyrecon

/ \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | Usage ./lazyrecon.sh -d domain.com To exclude particular subdomains: ./lazyrecon.sh -d domain.com -e excluded.domain.com,other.domain.com About...

getaltname

GSAN - Get Subject Alternative Names GSAN is a tool that can extract Subject Alternative Names SAN found in SSL Certificates directly from https servers which can provide you with DNS names subdomains or virtual servers. It doesn't rely on Certificate Transparency logs, it connects directly to th...

nuclei-wordfence-cve

Nuclei + Wordfence = ♥ 84,997 Nuclei Templates for WordPress Security Scanning 🥳 Level up your WordPress security game! This project's got a treasure trove of fresh Nuclei templates for WordPress. Scan for weaknesses in Core, plugins, and themes – all based on the latest intel from Wordfence.com...

CVE-2026-86802

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

CVE-2026-86802 To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

EUVD-2026-83869

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

CVE-2026-86802

To Do List Member is a WordPress plugin that allows unauthenticated users to create arbitrary published posts and taxonomy terms due to missing authorization and nonce checks in its import routine. The plugin also fails to validate the source location it fetches imported data from, enabling unaut...

CVE-2026-86802 To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

WordPress To Do List Member plugin 1.4-1.6 - Unauthenticated Content Injection vulnerability

Unauthenticated Content Injection vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin To Do List Member versions 1.4-1.6...

PT-2026-96059

Name of the Vulnerable Software and Affected Versions To Do List Member WordPress plugin versions prior to 1.7 Description An import routine lacks authorization and nonce checks, and fails to validate the source location of fetched data. This allows unauthenticated users to create arbitrary...

CVE-2026-86802: Missing Authorization

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

WordPress To Do List Member plugin 1.4-1.6 - Unauthenticated Stored XSS, File Listing and Deletion vulnerability

Unauthenticated Stored XSS, File Listing and Deletion vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin To Do List Member versions 1.4-1.6...

CVE-2026-86801

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...

CVE-2026-86801

The To Do List Member WordPress plugin (versions 1.4 through 1.6 ) includes a file upload endpoint that fails to load WordPress, meaning no authentication , capability , or nonce checks are enforced. The endpoint validates only the uploaded file's name , not its content , allowing unauthenticated...

CVE-2026-86801 To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...

CVE-2026-86801 To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...

EUVD-2026-81384

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...

CVE-2026-86801: Missing Authentication for Critical Function

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...

Vikunja 安全漏洞

Vikunja is an open-source to-do application developed by Vikunja developers. Versions of Vikunja prior to 2.3.0 contained security vulnerabilities. These vulnerabilities were caused by a mistake in the SQL operator precedence of the hasAccessToLabel function, which could allow any authenticated...