interactsh-web

Interactsh Web Client A Next.js-based web interface for Interactsh Getting Started Prerequisites Node.js 20+ required for React 19 npm, yarn, or pnpm Installation 1. Clone the repository: root@kitploit: git clone https://github.com/projectdiscovery/interactsh-web.git cd interactsh-web 2. Install...

Zimbra - Cross-Site Scripting via ICS Files

Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event...

skyhook

Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...

nishang

Nishang Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing. By Nikhil Mittal Founder of Altered Security - Hands-on red team and...

CVE-2025-30349

Horde IMP vulnerability – obfuscation via HTML encoding – XSS payload Horde 5.2.23; IMP 6.2.27 The details of the vulnerability are explained in Details.md file. The PoC creates and send an email with payload exploiting the vulnerability to the recipient. This kind of email has to be viewed in a...

vcenter-cve-2021-21980-lab

CVE-2021-21980 Entorno de Prueba Vulnerable Descripción General Entorno de prueba realista que simula la vulnerabilidad de salto de ruta path traversal del Cliente Web de VMware vSphere. ⚠️ ADVERTENCIA: Entorno de prueba vulnerable. ¡No lo expongas a Internet! Inicio Rápido Compilar y Ejecutar...

CVE-2022-27925

CVE-2022-27925 Zimbra RCE 2022 Este repositorio es parte del hgrab-framework dork title: "Zimbra Web Client Sign In" Producto afectado Zimbra Collaboration Suite Network Edition 9.0.0 Patch 23 y anteriores Zimbra Collaboration Suite Network Edition 8.8.15 Patch 30 y anteriores Instalación Instale...

CVE-2025-47812

CVE-2025-47812 ¿Cómo funciona este método de detección? Esta plantilla de Nuclei detecta instancias de Wing FTP Server vulnerables a CVE-2025-47812 mediante la identificación de versiones anteriores a la 7.4.4 expuestas en la respuesta HTML del cliente web. ¿Cómo ejecuto este script? 1. Descargue...

cve-2021-21980-mock-server

Clippy of the Dead - entorno de pruebas para CVE-2021-21980 y plantilla de Nuclei Este repositorio contiene una plantilla de Nuclei de alta confianza para detectar CVE-2021-21980 path traversal de vSphere Web Client y un pequeño entorno simulado mock que reproduce el comportamiento vulnerable par...

Malicious code in analytics-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8893c0594fed4d622c0e347b4e8f899d5b00e11c15fe31e09169a9fae8e82be package.json at line 11 declares a dependency whose key equals this package's own name analytics-web-client and whose source is a bare HTTPS URL...

MAL-2026-15526 Malicious code in analytics-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8893c0594fed4d622c0e347b4e8f899d5b00e11c15fe31e09169a9fae8e82be package.json at line 11 declares a dependency whose key equals this package's own name analytics-web-client and whose source is a bare HTTPS URL...

CVE-2026-73572

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

CVE-2026-73574

Zimbra Collaboration versions before 10.1.17 are affected by a local file inclusion (LFI) vulnerability in the Forward servlet of the Classic Web Client. The root cause is improper validation of the fu request parameter, allowing an unauthenticated attacker to supply a crafted path and disclose p...

CVE-2026-73572

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

EUVD-2026-58071

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

PT-2026-71678

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description A stored cross-site scripting XSS issue exists in the Zimbra Classic Web Client. This occurs because the system does not sufficiently sanitize specific attachment content during...

CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-46714

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-46714

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-14540

A Server-Side Request Forgery SSRF vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client...