45 matches found
awesome-web-security
Awesome Web Security - ZH 🐶 Curated list of Web Security materials and resources. Needless to say, most websites suffer from various types of bugs which may eventually lead to vulnerabilities. Why would this happen so often? There can be many factors involved including misconfiguration, shortage ...
HackBar
HackBar Burpsuite 插件 使用方法 环境要求 Burpsuite 安装方法 root@kitploit: 从 https://github.com/d3vilbug/HackBar/releases/ 下载最新 Jar 包并添加到 burpsuite 中 测试环境 Burpsuite 2021.4 Windows 10 Ubuntu & PopOS 即将推出的功能/模块 Ctrl + H 快捷键 WAF 绕过 SQLi 解码器/编码器 致谢 An0n 3xPloiTeR https://github.com/Anon-Exploiter/ 提供 SQLi && XSS...
Shadow-Vault
Shadow Vault 🔐 Shadow Vault 是一款轻量级 PHP 网络工具，专为系统管理员 设计，用于在共享托管环境中安全地向 shadow 文件添加新的用户凭据。它会自动检测现有的 shadow 老化格式，使用 SHA-512 密码哈希，支持多种写入回退方法，甚至还提供了一键自动登录 cPanel 网络邮件（端口 2096）的功能。 ⚠️ 免责声明 ：此工具仅用于合法的服务器管理 。在您并不拥有的系统上进行未经授权的访问或使用是违法的。请自行承担使用风险。 功能 ✅ SHA-512 密码哈希 ，使用随机盐（$6$） ✅ 动态 shadow 老化检测 ——...
acropadetect
Acropadetect 用于检测 Acropalypse（CVE-2023-21036）的 Web 工具...
CMS_Detector
CMSDetector Python2 捐赠： BTC : 31mtLHqhaXXyCMnT2EU73U8fwYwigiEEU1 Perfect Money : U22270614...
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNSResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchTarget: https://github.com/MervinPraison/PraisonAIWeakness: CWE-918 Server-Side Request Forgery SSRF.--- SummaryThe SSRF guard...
CVE-2026-61643 FastGPT: workflow runtime can execute another user's private HTTP toolset
FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-/. The normal toolset routes deny access, but the workflow...
CVE-2026-15668
A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...
CVE-2026-15668 louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery
A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...
CVE-2026-15668 louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery
A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...
CVE-2026-11720
The CVE-2026-11720 entry describes a path traversal flaw in the HTTP tool URL builder of googleapis/mcp-toolbox. User-controlled pathParams are substituted into a configured tool path and then parsed as a relative URL; while scheme/host/user info are checked, final resolution uses ResolveReferenc...
CVE-2025-67634 Software Acquisition Guide Supplier Response Web Tool XSS
The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The JavaScript would...
CVE-2025-67634 Software Acquisition Guide Supplier Response Web Tool XSS
The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The JavaScript would...
CISA Software Acquisition Guide Supplier Response Web Tool 安全漏洞
CISA Software Acquisition Guide Supplier Response Web Tool is an interactive Web tool from the CISA organization in the United States. A security vulnerability exists in versions of the CISA Software Acquisition Guide Supplier Response Web Tool prior to 2025-12-11, which stems from a cross-site...
CVE-2025-49145
Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks mostly administrators can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature...
EUVD-2025-15961
Malicious code in bioql PyPI...
trashhost
xss tool and sqli detector...
CVE-2025-44897
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bytftpsrvip parameter in the webtoolupgradeManagerpost function...