interactsh-web

Interactsh 웹 클라이언트 Interactsh를 위한 Next.js 기반 웹 인터페이스 시작하기 사전 요구 사항 Node.js 20+ React 19 필요 npm, yarn 또는 pnpm 설치 1. 저장소를 클론합니다: git clone https://github.com/projectdiscovery/interactsh-web.git cd interactsh-web 2. 의존성을 설치합니다: npm install or yarn install 3. 개발 서버를 실행합니다: npm run dev or yarn dev 4...

nishang

Nishang Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing. By Nikhil Mittal Founder of Altered Security - Hands-on red team and...

CVE-2022-27925

CVE-2022-27925 Zimbra RCE 2022 이 저장소는 hgrab-framework 의 일부입니다. dork title: "Zimbra Web Client Sign In" 영향을 받는 제품 Zimbra Collaboration Suite Network Edition 9.0.0 Patch 23 및 이전 버전 Zimbra Collaboration Suite Network Edition 8.8.15 Patch 30 및 이전 버전 설치 서버에 앱을 설치하세요. user@domain: git clone...

Zimbra - Cross-Site Scripting via ICS Files

Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event...

skyhook

Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...

CVE-2025-47812

CVE-2025-47812 이 탐지 방법은 어떻게 작동하나요? 이 Nuclei 템플릿은 웹 클라이언트의 HTML 응답에 노출된 7.4.4보다 오래된 버전을 식별하여 CVE-2025-47812에 취약한 Wing FTP Server 인스턴스를 탐지합니다. 이 스크립트를 어떻게 실행하나요? 1. 여기에서 Nuclei를 다운로드하세요. 2. 템플릿을 로컬 시스템에 복사하세요. 3. 다음 명령을 실행하세요: nuclei -u https://yourHost.com -t template.yaml 참고 자료...

cve-2021-21980-mock-server

Clippy of the Dead - CVE-2021-21980 테스트 환경 및 Nuclei 템플릿 이 저장소는 CVE-2021-21980vSphere Web Client 경로 순회을 탐지하는 높은 신뢰도의 Nuclei 템플릿과 안전한 로컬 테스트를 위해 취약한 동작을 재현하는 작은 모의 환경을 포함합니다. 파일: cve-2021-21980.yaml: 여러 인코딩 변형과 매처가 포함된 Nuclei 템플릿 app.py: /eam/vib 경로 순회 취약점을 시뮬레이션하는 작은 Flask 앱 Dockerfile: 자체 서명 TLS...

CVE-2025-30349

Horde IMP 취약점 – HTML 인코딩을 통한 난독화 – XSS 페이로드 Horde 5.2.23; IMP 6.2.27 취약점의 세부 사항은 Details.md 파일에 설명되어 있습니다. PoC는 취약점을 악용하는 페이로드가 포함된 이메일을 생성하여 수신자에게 전송합니다. 이러한 이메일은 Horde 웹 클라이언트에서 열람해야 하며, 일반 클라이언트예: 데스크톱 클라이언트에서는 열람할 수 없습니다...

vcenter-cve-2021-21980-lab

CVE-2021-21980 취약한 테스트 환경 개요 VMware vSphere Web Client의 경로 탐색 취약점을 시뮬레이션하는 실제적인 테스트 환경입니다. ⚠️ 경고: 취약한 테스트 환경입니다. 인터넷에 노출하지 마세요! 빠른 시작 빌드 및 실행 podman build -t vcenter-lab . podman run -d -p 443:443 --name vcenter-lab vcenter-lab 수동 테스트 curl -k...

CVE-2026-93647 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93647 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93647

The Zimbra Collaboration Suite Classic Web Client is vulnerable to a stored Cross-Site Scripting (XSS) flaw. An unauthenticated calendar sender can inject active markup into the RFC From address of a COUNTER message . When a user selects this message within Zimbra Classic, the XSS is triggered, p...

CVE-2026-93642 Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93642

The Zimbra Collaboration Suite Modern Web Client is vulnerable to Stored Cross-Site Scripting (XSS) due to a flaw where an unauthenticated sender can forge a share notification. When a signed-in Zimbra Modern recipient clicks the Accept Share button, the XSS is triggered. This allows an attacker ...

CVE-2026-93641

The Zimbra Collaboration Suite Classic Web Client is vulnerable to Stored Cross-Site Scripting (XSS) . An unauthenticated sender can forge a share notification that, when clicked by a signed-in recipient, executes malicious scripts. This allows an attacker to access mailbox data and act as the vi...

CVE-2026-93641 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

When Business Email Compromise Starts Rewriting Reality

Business Email Compromise BEC operates on a familiar playbook. Threat actors breach a mailbox, silently monitor operations, map approval chains, and ultimately exploit that access to divert funds or exfiltrate sensitive assets. This dynamic is central to our analysis as we kick off a series aroun...

CVE-2026-87253

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Web Client. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require hum...

EUVD-2026-79907

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Web Client. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require hum...

CVE-2026-87253

Oracle Agile PLM (component: Web Client , affected version 9.3.6 ) contains a vulnerability allowing an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation requires human interaction from a person other than the attacker and involves a scope ch...