interactsh-web

Cliente Web de Interactsh Una interfaz web basada en Next.js para Interactsh Primeros Pasos Requisitos Previos Node.js 20+ requerido para React 19 npm, yarn o pnpm Instalación 1. Clona el repositorio: root@kitploit: git clone https://github.com/projectdiscovery/interactsh-web.git cd interactsh-we...

Zimbra - Cross-Site Scripting via ICS Files

Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event...

skyhook

Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...

nishang

Nishang Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing. By Nikhil Mittal Founder of Altered Security - Hands-on red team and...

CVE-2022-27925

CVE-2022-27925 Zimbra RCE 2022 Este repositorio es parte del hgrab-framework dork title: "Zimbra Web Client Sign In" Producto afectado Zimbra Collaboration Suite Network Edition 9.0.0 Patch 23 y anteriores Zimbra Collaboration Suite Network Edition 8.8.15 Patch 30 y anteriores Instalación Instale...

CVE-2025-47812

CVE-2025-47812 此检测方法的工作原理是什么？ 该Nuclei模板通过识别Web客户端HTML响应中暴露的版本低于7.4.4的Wing FTP Server实例，来检测易受CVE-2025-47812攻击的目标。 如何运行此脚本？ 1. 从此处下载Nuclei 2. 将模板复制到本地系统 3. 运行以下命令：nuclei -u https://yourHost.com -t template.yaml 参考资料 https://nvd.nist.gov/vuln/detail/CVE-2025-47812 https://www.wftpserver.com/...

cve-2021-21980-mock-server

Clippy of the Dead - CVE-2021-21980 测试环境与Nuclei模板 本仓库包含一个用于检测 CVE-2021-21980（vSphere Web Client 路径遍历）的高置信度 Nuclei 模板，以及一个模拟该漏洞行为的小型模拟环境，用于安全的本地测试。 文件： cve-2021-21980.yaml：包含多种编码变体和匹配器的 Nuclei 模板 app.py：模拟 /eam/vib 路径遍历漏洞的小型 Flask 应用 Dockerfile：带有自签名 TLS 证书的模拟服务器容器镜像 docker-compose.yml：运行模拟服务器，监听主...

vcenter-cve-2021-21980-lab

CVE-2021-21980 易受攻击的测试环境 概述 模拟VMware vSphere Web Client路径遍历漏洞的真实测试环境。 ⚠️ 警告： 易受攻击的测试环境。请勿暴露到互联网！ 快速开始 构建并运行 root@kitploit: podman build -t vcenter-lab . podman run -d -p 443:443 --name vcenter-lab vcenter-lab 手动测试 root@kitploit: curl -k...

CVE-2025-30349

Horde IMP 漏洞 – 通过HTML编码混淆 – XSS payload Horde 5.2.23; IMP 6.2.27 漏洞详情在 Details.md 文件中说明。 该 PoC 创建并发送一封包含利用该漏洞的 payload 的电子邮件给收件人。此类邮件需要在 Horde Web 客户端中查看，而非任何其他客户端（如桌面客户端）。...

Malicious code in analytics-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8893c0594fed4d622c0e347b4e8f899d5b00e11c15fe31e09169a9fae8e82be package.json at line 11 declares a dependency whose key equals this package's own name analytics-web-client and whose source is a bare HTTPS URL...

MAL-2026-15526 Malicious code in analytics-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8893c0594fed4d622c0e347b4e8f899d5b00e11c15fe31e09169a9fae8e82be package.json at line 11 declares a dependency whose key equals this package's own name analytics-web-client and whose source is a bare HTTPS URL...

CVE-2026-73572

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

CVE-2026-73574

Zimbra Collaboration versions before 10.1.17 are affected by a local file inclusion (LFI) vulnerability in the Forward servlet of the Classic Web Client. The root cause is improper validation of the fu request parameter, allowing an unauthenticated attacker to supply a crafted path and disclose p...

EUVD-2026-58071

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

CVE-2026-73572

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

PT-2026-71678

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description A stored cross-site scripting XSS issue exists in the Zimbra Classic Web Client. This occurs because the system does not sufficiently sanitize specific attachment content during...

CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-46714

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-46714

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-14540

A Server-Side Request Forgery SSRF vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client...