CVE-2022-30190

CVE-2022-30190 CVE-2022-30190 CVE-2022-30190 Follina POC 在本地主机的 80 端口上托管 exploit.html。打开 docx 文件以弹出计算器。 要更改文档指向的远程地址，请使用 7Z 打开并编辑 word\rels\document.xml.rels，将其指向新位置。必须 保留感叹号。如果从 URL 末尾省略它，将无法运行。 exploit 必须在 window.location.href 之前包含至少 3541 个字符，且这些字符必须位于 script 标签内。exploit.html 中包含大约 6000 个左右字符。 ...

corsair_scan

欢迎使用 Corsairscan Corsairscan 是一款用于测试跨域资源共享（CORS）错误配置的安全工具。CORS 是一种机制，允许网页上的受限资源被从最初提供该资源的域以外的其他域请求。如果配置不当，未授权的域也能访问这些资源。 什么是 CORS？ CORS 是一种基于 HTTP 标头的机制，允许服务器指示除自身以外的其他源（域、方案或端口），浏览器应允许从这些源加载资源。它通过添加新的 HTTP 标头来工作，让服务器描述哪些源被允许从 Web 浏览器读取该信息。 CORS...

behave

Behave! A Still in Development monitoring browser extension for pages acting as bad boys. NB : This is the code repository of the project, if you're looking for the packed extensions: Firefox: https://addons.mozilla.org/en-US/firefox/addon/behave/ Chrome:...

ChangeTower

ChangeTower ChangeTower 旨在帮助你监控网页变化，并在检测到变化时通过 Go 语言编写的通知功能及时获知。此工具非常适合用于了解网页是否更新，从而在其他人之前获取新内容。 安装说明 ChangeTower 需要 Go 1.16 或更高版本才能成功安装。运行以下命令获取仓库： root@kitploit: go get -v github.com/Dc4ts/ChangeTower 如果你的操作系统尚未安装 Go，可以使用预编译版本，请前往 release 页面下载。 示例命令 查看帮助。 root@kitploit: ./ChangeTower -h...

Agentejo Cockpit 0.10.2 - Cross-Site Scripting

Agentejo Cockpit 0.10.2 contains a reflected cross-site scripting vulnerability due to insufficient sanitization of the to parameter in the /auth/login route, which allows for injection of arbitrary JavaScript code into a web page's content. id: CVE-2020-14408 info: name: Agentejo Cockpit 0.10.2 ...

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

FortiWeb - Cross Site Scripting

FortiWeb 6.3.0 through 6.3.7 and versions before 6.2.4 contain an unauthenticated cross-site scripting vulnerability. Improper neutralization of input during web page generation can allow a remote attacker to inject malicious payload in vulnerable API end-points. id: CVE-2021-22122 info: name:...

dnstwist

See what sort of trouble users can get in trying to type your domain name. Find lookalike domains that adversaries can use to attack you. Can detect typosquatters, phishing attacks, fraud, and brand impersonation. Useful as an additional source of targeted threat intelligence. DNS fuzzing is an...

CVE-2026-84108

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84074

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84070

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

EUVD-2026-83359

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84108

IBM Guardium Data Protection 12.2 is vulnerable to remote code execution caused by improper neutralization of input during web page generation. A remote attacker with no privileges and no user interaction could exploit this via the network, though with high attack complexity. The assigned CVSS 3....

EUVD-2026-83358

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84106

IBM Guardium Data Protection 12.2 is affected by a vulnerability that could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation . The CVSS v3.1 score is 8.9 (HIGH) , with a changed scope and high impact on both confide...

CVE-2026-84074 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

EUVD-2026-83424

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

EUVD-2026-83420

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84070

IBM Guardium Data Protection 12.2 is vulnerable to arbitrary code execution caused by improper neutralization of input during web page generation. A remote authenticated attacker with low privileges and required user interaction can exploit this flaw, resulting in high impact on confidentiality a...

CVE-2026-84070 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...