EUVD-2026-102479

TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers0.url in a user-defined action. Attackers holding a project API key or console admin login c...

CVE-2019-11708

Full chain exploit for CVE-2019-11708 & CVE-2019-9810 This is a full browser compromise exploit chain CVE-2019-11708 & CVE-2019-9810 targeting Firefox on Windows 64-bit. It uses CVE-2019-9810 for getting code execution in both the content process as well as the parent process and CVE-2019-11708 t...

PT-2026-116063

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses versi...

PT-2026-116061

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService,...

PT-2026-116112

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

PT-2026-116119

fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or clou...

CVE-2021-22986_Check

CVE-2021-22986Check CVE-2021-22986 Checker Script in Python3 How to Use: python3 checker.py -u http://url Output: HOST IS NOT VULNERABLE: | | | / | | | | | | | | | | | | | | | | \ \ | ' | |/ | | | | | | | | | | | | | || |/ |/| ./||/||| | | || Vuln Checker ! Target: http://URL + http://URL is...

CVE-2025-69600

CVE-2025-69600 author: Rafael José Núñez Gulías company: Iberian Var Group Affected products: RayVentory Scan Engine 12.6 Update 8 and previous versions Raynet advisory: RSEC200966 Command injection in Raynet's rvia allows adversaries to execute commands via getconfig, upload, inventory, and orac...

CVE-2025-24893-POC

CVE-2025-24893-POC A POC for CVE-2025-24893 written in python Usage python3 -u the url...

CVE-2026-111323

RedAmon versions through 7.0.1 are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) via the POST /tradecraft/verify endpoint. The root cause is that the validate_url function only verifies the initial hostname, allowing attackers to provide a public URL that performs a redirect...

CVE-2026-111321

The software TaskingAI versions up to and including 0.3.0 is vulnerable to a Server-Side Request Forgery (SSRF) flaw. The root cause is the processing of an unvalidated OpenAPI servers[0].url within a user-defined action. Authenticated attackers possessing a project API key or console admin login...

CVE-2026-111321 TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions

TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers0.url in a user-defined action. Attackers holding a project API key or console admin login c...

CVE-2026-111313

The JobOps software (versions through 0.13.1 ) is vulnerable to a Server-Side Request Forgery (SSRF) in the POST /api/manual-jobs/fetch handler. This flaw allows authenticated users or unauthenticated clients in demo mode to force the server to fetch internal destinations by supplying loopback, p...

OutlookLeakTest

The Outlook HTML Leak Test Project! Blog post: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/may/smb-hash-hijacking-and-user-tracking-in-ms-outlook/ What's in "./Schemes-List.xlsx"? List of URI schemes that might work in Windows. These schemes/protocols can be useful in...

behat-config-leaks

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install behat-config-leaks Run bellow command to check behat-config-leaks -h Configurations 2. We integrated with the Telegram API to...

CVE-2026-2413

CVE-2026-2413 Ally – Web Accessibility & Usability = 4.0.3 - Unauthenticated SQL Injection via URL Path Description The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficien...

shell-history-leaks

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install shell-history-leaks Run bellow command to check shell-history-leaks -h Configurations 2. We integrated with the Telegram API to...

openredirect

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install openredirect Run bellow command to check openredirect -h Configurations 2. We integrated with the Telegram API to receive insta...

laravel-ignition-Rxss

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install laravel-ignition-rxss Run bellow command to check laravel-ignition-rxss -h Configurations 2. We integrated with the Telegram AP...

BurpSuite-Grand-Master-Tools

BurpSuite-Grand-Master-Tools Bynu11secur1ty — A modular toolkit that transforms Burp captures into instant, repeatable actions. Convert. Reuse. Open. Automate. 🚀 Elevator pitch BurpSuite-Grand-Master-Tools is a lightweight, auditable, and extensible toolkit for pentesters and bug bounty hunters...