FBIntelPy

FBIntelPy：Python Facebook 情报（OSINT）搜索工具 FBIntelPy 是一款基于 Python 的 Facebook 情报搜索工具，旨在帮助生成经过筛选的 Facebook URL。该工具专为即将到来的 TraceLabs Search Party 2026.02 创建，灵感来源于 IntelTechnique 的网页搜索工具；本工具已更新部分已弃用的筛选器。 简而言之，此工具支持以下筛选类型：帖子 、照片 、视频 、用户 、事件 、用户/个人资料信息 以及全局搜索 。其中一些类型还支持添加关键词和日期。 更新： 我非常高兴该工具，尤其是帖子 搜索类型，帮助...

BurpSuite-Grand-Master-Tools

BurpSuite-Grand-Master-Tools 作者nu11secur1ty — 一个模块化工具包，可将 Burp 捕获的内容转化为即时、可重复的操作。 转换。复用。打开。自动化。 🚀 电梯推介 BurpSuite-Grand-Master-Tools 是一款轻量级、可审计且可扩展的工具包，专为渗透测试人员与漏洞赏金猎人打造。借助 Nu11Request 等工具快速上手——一键将 Burp 捕获的 HTTP 请求转换为真实、可浏览的 URL——然后构建一套模块库，将 Burp 工作流中的其余部分自动化。 ✨ 为何重要 节省重建请求目标与查询载荷的时间。...

GHSA-VX2M-JPXR-XV7W Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint

Summary Cloudreve's file-listing responses hand the client a contexthint UUID that is meant to speed up follow-up operations. When that hint is replayed on the file/url and file/thumb routes, DBFS caches a shareNavigatorState containing the already-loaded share root and share row. On a later...

CVE-2026-48784 Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate used strtr dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters...

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Description Symfony\Component\Routing\Generator\UrlGenerator::doGenerate percent-encodes . and .. path segments so that the generated URL still resolves to the originating route after RFC 3986 §5.2.4 dot-segment removal which strict RFC-3986 consumers — routers, reverse proxies, HTTP clients —...

Exploit for Cross-site Scripting in Bdtask Multi_Store_Inventory_Management_System

CVE-2024-2997 Scanner !Versionhttps://img.shields.io/badge...

Koa has Host Header Injection via ctx.hostname

Summary Koa's ctx.hostname API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a @ symbol e.g., evil.com:[email protected] is received,...

GHSA-7GCC-R8M5-44QM Koa has Host Header Injection via ctx.hostname

Summary Koa's ctx.hostname API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a @ symbol e.g., evil.com:[email protected] is received,...

CVE-2026-27959

A flaw was found in Koa’s ctx.hostname API used in Node.js applications. The function incorrectly parses specially crafted HTTP Host headers containing an @ character, which can cause the extracted hostname value to differ from the intended origin. An attacker can exploit this behavior by sending...

CVE-2026-27959

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's ctx.hostname API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed...

CVE-2026-27959 Koa has Host Header Injection via `ctx.hostname`

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's ctx.hostname API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed...

CVE-2026-27959

Koa (Node.js) prior to versions 3.1.2 and 2.16.4 exposes a vulnerability in ctx.hostname: it naively parses the Host header and returns an attacker-controlled value when the header contains an invalid RFC 3986 hostname (e.g., with a @). This can affect URL generation, password reset links, email ...

EUVD-2022-2651

Malicious code in bioql PyPI...

Exploit for External Control of File Name or Path in Microsoft

CVE-2025-33053 Proof Of Concept This repository provides scri...

CVE-2021-41114

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the...

Host Header Injection

pimcore/admin-ui-classic-bundle is vulnerable to Host Header Injection. The vulnerability is caused due to unsafely using the host header from incoming HTTP requests when generating URLs in the function invitationLinkAction within UserController.php , specifically in the way $loginUrl trusts user...

Gitea XSS Vulnerability

Gitea 1.7.0 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically...

Cross-Site Scripting (XSS)

tableexport.jquery.plugin is vulnerable to cross-site scripting. The vulnerability exists in the parseString function in tableExport.js due to a lack of sanitization in the url generation which allows a malicious attacker to steal sensitive information...

GHSA-RCRV-228C-GPRJ Invalid URL generation in bitlyshortener

Impact Due to a sudden upstream breaking change by Bitly, versions of bitlyshortener 0.6.0 generate invalid short URLs. All users are affected and must update immediately. Patches Upgrading bitlyshortener to 0.6.0 or newer will prevent the generation such invalid short URLs. Workarounds A...

Invalid URL generation in bitlyshortener

Impact Due to a sudden upstream breaking change by Bitly, versions of bitlyshortener 0.6.0 generate invalid short URLs. All users are affected and must update immediately. Patches Upgrading bitlyshortener to 0.6.0 or newer will prevent the generation such invalid short URLs. Workarounds A...