15860 matches found
[SECURITY] Fedora 43 Update: nginx-mod-naxsi-1.6-19.fc43
naxsi is an nginx module that provides score based Web Application Firewall WAF abilities in a highly granular fashion...
Sql-injection-scanner
Sql-injection-scanner Developing a security scanning tool that...
pentest-cheatsheet
pentest-cheatsheet Commands, techniques and notes for penetrat...
API Security Demystified: Which Tools Actually Protect Your APIs (And Where the Gaps Are)
Introduction Quick answer: No single tool secures an API. API security is a layered discipline. Secure-coding analyzers and SCA scanners catch code and dependency flaws; DAST tests running APIs; API gateways and IAM enforce authentication and rate limits; a WAF blocks known attack patterns; bot...
CVE-2026-54639: Improperly Controlled Modification of Object Prototype Attributes
Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of convertTokenDatatokens, output: 'object' ;; indirect usage, via using Expand API; and/or indirect...
CVE-2026-10857 Reflected XSS in Akinsoft's e-Commerce
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. E-Commerce allows Reflected XSS. This issue affects e-Commerce: before 1.25.01.06...
On-Premises API Security on Kubernetes: What It Actually Looks Like in Practice
Let’s Talk About Where Your APIs Actually Run Quick answer: On-premises API security keeps API discovery, detection, and enforcement inside your own perimeter instead of a third-party cloud—the model regulated industries need. Deploying it natively on Kubernetes sidecar sensors → a discovery...
web-security-home-lab
Cybersecurity Home Lab Overview This project documents my...
Origin Validation Error
Overview Affected versions of this package are vulnerable to Origin Validation Error in the JWT validation process. An attacker can gain unauthorized access by presenting a validly signed token from a trusted issuer, originally intended for a different service, to the authentication system. This ...
CVE-2025-62340
HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automatically terminate user sessions after a period of inactivity...
CVE-2025-62340 HCL iControl was affected by Inadequate Session Timeout vulnerability
HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automatically terminate user sessions after a period of inactivity...
CVE-2025-62340
HCL iControl is affected by CVE-2025-62340 (Inadequate Session Timeout). The vulnerability is a failure of the web application to automatically terminate user sessions after a period of inactivity. According to the provided sources, the affected product is HCL iControl, with impact described as C...
Exploit for CVE-2025-49132
CVE-2025-49132 Pterodactyl is a free, open-source game server...
CVE-2026-48885
Unauthenticated Cross Site Scripting XSS in HollerBox = 2.3.10.1 versions...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /system/notice/add interface. An attacker can execute arbitrary JavaScript code in the context of a user's browser by injecting malicious scripts into input fields processed by this interface. Details...
Your Security Operations Team Just Got Faster: Meet Imperva’s AI Assistant.
There is a moment every security analyst knows well. It’s 2am , an alert fires, and you’re staring at a console trying to make sense of what just happened—fast. You need context, scope, and impact: What’s being targeted? Where is it coming from? Is it getting worse? What should we do next? That...
ethical-hacking-security-labs
Ethical Hacking & Network Security Lab Portfolio A hands-on...
websec-skills
websec-skills Web Security Vulnerability Testing Skills Set,...
CVE-2026-44205: Improper Neutralization of Input During Web Page Generation
Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to execute malicious scripts in the browsers of other users. This issue has been patched in version 15.106.0...