CVE-2014-0472

CVE-2014-0472 Usa docker-compose up -d Accede a localhost:8083 Referencia: https://www.djangoproject.com/weblog/2014/apr/21/security/ 1. Una o más vistas están presentes que construyen una URL basada en la entrada del usuario comúnmente, un parámetro "next" en una cadena de consulta que indica a...

CVE-2023-34839

CVE-2023-34839 — Issabel PBX 4.0.0-6: CSRF to Privilege Escalation Table of Contents Overview Vulnerability Details Affected Software CVSS Score Attack Scenario Proof of Concept PoC Steps to Reproduce Impact Remediation References Disclaimer Overview CVE-2023-34839 is a Cross-Site Request Forgery...

CVE-2025-31161

CVE-2025-31161 - CrushFTP Authentication Bypass Exploit PoC CVE-2025-31161 - Authentication Bypass CrushFTP 📌 CVE Details ID : CVE-2025-31161 Type : Authentication Bypass Vendor : CrushFTP Impact : Allows unauthenticated attackers to forge a valid CrushAuth token and create a fully privileged adm...

CVE-2026-4882

CVE-2026-4882 User Registration Advanced Fields = 1.6.20 - Unauthenticated Arbitrary File Upload Description : User Registration Advanced Fields = 1.6.20 - Unauthenticated Arbitrary File Upload Description The User Registration Advanced Fields plugin for WordPress versions up to and including...

CVE-2021-26084

CVE-2021-26084 CVE-2021-26084, Atlassian Confluence OGNL Injection Vulnerability Atlassian Confluence is a widely used wiki system in enterprises, and some versions contain an OGNL expression injection vulnerability. Attackers can exploit this vulnerability to execute arbitrary code on the target...

Payload: Token refresh and password reset responses may expose restricted user fields

Impact Token refresh and password reset responses could return fields that the requesting user did not have access to. You are affected if: - An authentication collection contains hidden or read-restricted fields. Patches Authentication responses now apply field access and hidden-field filtering...

CVE-2026-105853 Payload: Token refresh and password reset responses may expose restricted user fields

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot...

CVE-2026-105853

The Payload headless content management system is vulnerable to information disclosure in versions 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 . The root cause is that token refresh and password reset responses can independently return hidden or read-restricted fields that the ...

EUVD-2026-93496

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...

owt

Currently unstable will be updated eventually. Offensive Wifi Toolkit owt created by Brennan Mccown clu3bot This tool compiles some necessary tools for wifi auditing in a unix bash script with a user friendly interface. The goal of owt is to have the smallest file size possible while still...

CVE-2020-8163

CVE-2020-8163 CVE-2020-8163 - Remote code execution of user-provided local names in Rails Remote code execution of user-provided local names in Rails 5.0.1 There was a vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the locals argument of a render cal...

Payload: Untrusted redirect URL parameter exploit

Impact Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating. Patches Users should upgrade Payload packages to = 3.88.0 or = 4.0.0-canary.27. Workarounds Upgrading is recommended. Until then, remove user-controlled...

CVE-2026-105846 Payload: Untrusted redirect URL parameter exploit

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This...

EUVD-2026-93488

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This...

CVE-2026-105846 Payload: Untrusted redirect URL parameter exploit

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This...

bubblewrap

Bubblewrap Muchas herramientas de tiempo de ejecución de contenedores, como systemd-nspawn, docker, etc., se centran en proporcionar infraestructura para administradores de sistemas y herramientas de orquestación p. ej. Kubernetes para ejecutar contenedores. Estas herramientas no son adecuadas pa...

userenum-CVE-2018-15473

Userenum CVE-2018-15473 User enumeration for CVE-2018-15473 This script is a method to use a user dictionary with the CVE-2018-15473 SSH User Enumeration by Leap Security @LeapSecurity https://leapsecurity.io. Script developed to solve Valentine HTB machine. How to use it 1st. Download the main...

vaas-cve-2014-6271

Vulnerabilidad como Servicio - CVE 2014-6271 Un sistema Debian Buster Linux con una versión vulnerable de bash y una aplicación web para mostrar CVS-2014-6271, también conocido como Shellshock. Resumen Este contenedor Docker está basado en Debian Buster y ha sido modificado para usar una versión...

psudohash

psudohash Cool New Features of v1.1.0 Special thanks to DavidAngelos: ▶️ Added a progress bar in every step to track execution. ▶️ Added options: In-order joins -i / --inorder: join keywords only in the original order e.g. foo,bar,baz → foo, bar, baz, foobar, foobaz, barbaz, foobarbaz. All-order...

XLL_Phishing

XLLPhishing Introducción Con el reciente anuncio de Microsoft sobre el bloqueo de macros en documentos provenientes de internet tanto por correo electrónico como por descarga web, los atacantes han comenzado a explorar agresivamente otras opciones para lograr el acceso impulsado por el usuario UD...