burp_global_match_replace

Global Match & Replace GMR расширение Burp Suite Global Match & Replace GMR расширяет Burp Suite правилами сопоставления/замены, которые применяются глобально или в нескольких выбранных вами инструментах Repeater, Intruder, Proxy и т. д.. Он предоставляет диффы для каждого запроса и ответа, чтобы...

idaguides

IDA Guides Petit plugin pour IDA qui ajoute des guides d'indentation à la vue du décompilateur. Installation 1. Clonez ou téléchargez ce dépôt 2. Extrayez son contenu dans le répertoire plugins d'IDA 3. Redémarrez IDA Testé avec IDA 9.2, 9.3...

cve-2026-21509-office_security_bypass_reproduction

CVE-2026-21509 — Contournement de la fonctionnalité de sécurité de Microsoft Office CVE-2026-21509 est une vulnérabilité de contournement de la fonctionnalité de sécurité de Microsoft Office CVSS 7.8 , activement exploitée par APT28 hackeurs russes contre l'Ukraine Dépendance à des entrées non...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...

YesWiki Archived Revision - Cross-Site Scripting

YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append an XSS payload after a valid revision timestamp. id: CVE-2026-52773 info: name: YesWiki...

Dashy <= 4.3.6 - Reflected XSS via Workspace

Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the contex...

D-Link D-View 8 v2.0.1.28 - Authentication Bypass

Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28 id: CVE-2023-5074 info: name: D-Link D-View 8 v2.0.1.28 - Authentication Bypass author: DhiyaneshDK severity: critical description: | Use of a static key t...

CVE-2024-37759_PoC

CVE-2024-37759 PoC Description DataGear 5.0.0 et les versions antérieures présentent une vulnérabilité d'injection d'expression SpEL qui conduit à une exécution de code à distance. Exploit Détails de l'exploit CVE Lorsque vous effectuez une requête vers l'interface /data/schemaId/tableName/view, ...

Moniker-Link-CVE-2024-21413

🛡️ Moniker Link CVE-2024-21413 Salle : Moniker Link CVE-2024-21413 — TryHackMe Statut : ✅ Terminé Date : 30 mai 2025 🎯 Objectif Comprendre et exploiter CVE-2024-21413, une vulnérabilité dans Microsoft Outlook qui contourne le Protected View en utilisant des Moniker Links pour fuiter des...

creepy-plugins

creepy-plugins Description Plugins for cree.py The architecture of cree.py allows for multiple user-defined sources for geolocation information. These sources are defined as plugins and can be installed in creepy by copying them into the plugins folder under the installation directory. New plugin...

CVE-2026-104874

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

CVE-2026-79294

CVE-2026-79294 CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. Vulnerability Details Vulnerability Type: Stored/Stored-like...

EUVD-2026-91789

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input e.g., upon a third-party pull request that contains a Terraform configuration, if sensitive data c...

CVE-2026-104994

Versions of Trivy prior to 0.71.0 are vulnerable to a directory traversal issue within Terraform filesystem functions . The root cause occurs when these functions attempt to access pathnames located above the designated scan root. This risk is particularly relevant when performing misconf scannin...

CVE-2022-31101

CVE-2022-31101 Exploit pour le module PrestaShop bockwishlist 2.1.0 SQLi CVE-2022-31101 Utilisation python3 cve-2022-31101.py Fournissez l'URL de la wishlist lorsque demandé. Exemple d'URL : http://example.com/module/blockwishlist/view?idwishlist=1 Fournissez les cookies de votre compte lorsque...

dsync

dsync Плагин IDAPython, синхронизирующий представления декомпилированного и дизассемблированного кода. Подробнее см. комментарии в исходном коде. Требуется IDA Pro 7.3 Примечание: Возможно, стоит воспользоваться официальной функцией синхронизации, представленной в IDA 7.3...

CVE-2026-104847

ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. Whe...

EUVD-2026-91717

MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes e.g., via the deleted-attributes search or the paginated attribute listing, the application returned soft-deleted attributes...

CVE-2026-104914

MISP versions prior to v2.5.48 are vulnerable to an improper access control vulnerability in its attribute search and paginated attribute view endpoints. The root cause is a lack of visibility restrictions in these specific code paths; while the event detail view correctly restricts soft-deleted ...