EUVD-2026-95633

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...

CVE-2026-94503 WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...

CVE-2026-96607

The Basix NEX-Forms nex-forms-express-wp-form-builder WordPress plugin (versions n/a through 9.3.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . This flaw is caused by the improper neutralization of input during web page generation . While the documents confirm the existence of the vu...

EUVD-2026-95604

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5...

EUVD-2026-95592

Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1...

CVE-2017-9841

🔍 Features Multi-threaded scanning for efficient testing of multiple targets Intelligent payload generation with unique identifiers for accurate validation Multiple vulnerability path checking across common web application structures Automatic response validation to confirm actual vulnerabilities...

google-dorks

google-dorks Update Jan 2026 Read this, my Medium Blog Space:👩‍💻Proviesec Security Medium Articles - read it Table of Contents Introduction My love google dork Search filters Operators Search Term OR Ideas Links Example Preventing GOOGLE DORKS Introduction ⭐ Star us on GitHub — it motivates a lot!...

AntiWeb_testing-Suite

ICS/OT AntiWeb: Testing Suite Introducción Una vulnerabilidad ha sido encontrada en aplicaciones web asociadas a ICS/OT que corren sobre servidores Anti-Web hasta su version 3.8.7. La vulnerabilidades que se han identificado afectan a varios fabricantes de renombre en la industria de la...

kestrel

The kernel-level visibility of Falco, with the live UI the kernel-native tools don't ship. Quickstart · Spec · Views · Roadmap Kestrel traces kernel events process exec, file access, network connections with an eBPF agent and streams them to a SvelteKit web app that renders a live activity feed,...

CVE-2019-17671

＃CVE-2019-17671 ＃url + /？static = 1＆order = asc...

TarantuBench

TarantuBench v1 A benchmark for evaluating AI agents on web security challenges, generated by the TarantuLabs engine. What is this? TarantuBench is a collection of 100 vulnerable web applications, each containing a hidden flag TARANTU.... An agent's job is to find and extract the flag by...

WebSafeCompiler

WebSafeCompiler WSC WebSafeCompiler WSC is an advanced utility websites compiler designed for the optimization, minification, and obfuscation if you need it of web applications and websites using Node.js. It enhances your web assets by reducing file sizes or providing durable protection against...

API-Wordlist

apiwordlist A wordlist of API names used for fuzzing web application APIs. Contents apiseeninwild.txt - This contains API function names I've seen in the wild. actions.txt - All API function name verbs objects.txt - All API function name nouns actions-uppercase.txt - API function name verbs with...

CVE-2026-88931

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

CVE-2026-106155

Progress Telerik Report Server prior to version 12.2.26.1007 is vulnerable to a stored cross-site scripting (XSS) flaw in the shared reporting engine. An authenticated report author can embed javascript: or vbscript: URLs within report navigation actions or HTML text box links. If another user vi...

pared

Pared Pared is a secure, high-performance Linux host security control plane and real-time administrative web console written in Crystal. Built on Kemal and Blueprint server-rendered components with SQLite3, a small vanilla-JS/WebSocket layer, and native libsystemd journal streaming, it unifies...

yaradbg-frontend

Introduction YaraDbg is a free web-based Yara debugger to help security analysts to write hunting or detection rules with less effort and more confidence. By using YaraDbg, you can perform a thorough root-cause-analysis RCA on why some of your Yara rules did or did not match with a specific file...

trackers

Web tracking is the practice by which websites identify and collect information about users. This is generally in the form of some subset of web browsing history. With more of us now using streaming services, mobile devices, laptops, wearables and indeed Internet of Things IoT at home and at work...

Awesome-Pentest

Collection of Pentest tools Contents Anonymity Tools Anti-virus Evasion Tools Books Defensive Programming Books Hacker's Handbook Series Books Lock Picking Books Malware Analysis Books Network Analysis Books Penetration Testing Books Reverse Engineering Books Social Engineering Books Windows Book...

CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – HTTP Cache Poisoning via Unkeyed Query Parameter Overview A web cache uses only the URL path as the cache key, ignoring query parameters. An attacker can append a malicious payload to an unkeyed parameter e.g., utmcampaign and poison the cache. Subsequent visitors receive the...