insect

insect - Webパス発見 最新リリース: v1.4 20222.09.03 ウェブサーバーのディレクトリやファイルをブルートフォースするために設計された高度なコマンドラインツール、別名ウェブパススキャナー アイデア by @maurosoria と @shelld3v Developement-2022 は @nu11secur1ty によって活発に開発されています 目次 インストール ワードリスト オプション 設定 使用方法 シンプルな使用方法 進行状況の一時停止 再帰 スレッド プレフィックス / サフィックス ブラックリスト フィルター 生リクエスト ワードリスト形式...

dirsearch

dirsearch - Webパス発見ツール 高度なWebパス総当たりツール dirsearch は @maurosoria と @shelld3v によって活発に開発されています。 チームとのコミュニケーションには Discordサーバー に参加してください。 クイックスタート dirsearch には Python 3.11 以上が必要です。 git clone https://github.com/maurosoria/dirsearch.git --depth 1 cd dirsearch python3 dirsearch.py -u https://example.com -...

Afuzz

Afuzz - 자동화된 웹 경로 퍼징 도구 Afuzz는 버그 바운티 프로젝트를 위한 자동화된 웹 경로 퍼징 도구입니다. Afuzz 는 @rapiddns에 의해 활발히 개발되고 있습니다. 기능 Afuzz는 웹사이트에서 사용된 개발 언어를 자동으로 감지하고, 언어에 따라 확장자를 생성합니다. 블랙리스트를 사용하여 유효하지 않은 페이지를 필터링합니다. 화이트리스트를 사용하여 버그 바운티 헌터가 관심 있는 페이지 내용을 찾습니다. 페이지 내 랜덤 콘텐츠를 필터링합니다. 다양한 방식으로 404 오류 페이지를 판단합니다. 스캔 후 결과에...

pidrila

PIDRILA Current Release: v0.1.0 2020.11.08 개요 PIDRILA : P ython I nteractive D eepweb-oriented R apid I ntelligent L ink A nalyzer는 BrightSearch 팀이 모든 윤리적 네트스토커를 위해 개발한 매우 빠른 비동기 웹 경로 스캐너 프로토타입입니다. 설치 및 사용법 git clone https://github.com/enemy-submarine/pidrila.git cd pidrila python3 pidrila.py -u ...

CVE-2026-67200

CVE-2026-67200 refers to a path traversal in Perspective 5.0.0, exploitable by unauthenticated remote attackers who include literal ../ in HTTP request paths to read arbitrary server files via the cwd_static_file_handler. The vulnerability bypasses insufficient query-string-stripping sanitization...

CVE-2026-67185

CVE-2026-67185 affects TinyWeb up to version 0.0.8 and describes a path traversal in HttpBuilder::buildResponse() that concatenates URL path segments directly to the web root without normalization, allowing unauthenticated attackers to read files via ../ sequences. The vulnerability can expose se...

CVE-2026-16327 D-Link DNS-320 upload.php unrestricted upload

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/webfile/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and m...

EUVD-2026-45943

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...

CVE-2026-5270 Authentication Bypass in Navigator and Blue Planet Products

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite NCS, Manage Control Plan MCP, and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate...

nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

Impact The web handler renderMobileBundle internal/web/handlers.go:1325 passes the real pki.CAResolver directly into mobilebundle.Build. Inside Build internal/mobilebundle/builder.go:54, resolver.LoadByID decrypts the CA's ed25519 private key into a pki.CAManager, but Build never calls...

PT-2026-60097

Name of the Vulnerable Software and Affected Versions nebula-mesh affected versions not specified Description The web handler renderMobileBundle passes a pki.CAResolver to the mobilebundle.Build function, which decrypts the CA's ed25519 private key into a pki.CAManager. However, the Build functio...

Cisco IOS Cross-Site Request Forgery Vulnerability

Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via 1 a certain "show privilege" command to the /level/15/exec/- URI, and 2 a certain "alias exec" command to the /level/15/exec/-/configure/http URI...

CodeChecker open redirect when URL contains multiple slashes after the product name

Summary---CodeChecker versions up to 6.24.5 contain an open redirect vulnerability due to missing protections against multiple slashes after the product name in the URL's path segment. This results in bypassing protections against CVE-2021-28861, leading to the same open redirect...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the /skin/ action endpoint when running on Jetty 12 or later. An attacker can access arbitrary files on the server by crafting a URL containing encoded directory traversal sequences. This is only exploitable if th...

io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters

A flaw was found in Quarkus. A remote attacker could bypass HTTP path-based authorization policies by using specially crafted encoded semicolons, slashes, or backslashes in HTTP requests. This could allow unauthorized access to protected static resources, leading to information disclosure...

CVE-2026-48776 LangGraph SDK has unsafe URL path construction

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource...

CVE-2019-25731 Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact

Zuz Music 2.1 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript by submitting crafted contact form data. Attackers can inject script code through the name, subject, and message parameters in POST requests to...

Apache Airflow 安全漏洞

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. However, Apache Airflow has security vulnerabilities. The...

CVE-2021-47967

PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, o...

CVE-2026-44226

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, pyload-ng WebUI returns full Python traceback details to clients on unhandled exceptions. Because /web/ is reachable without authentication and renders attacker-controlled template names, an...