keeweb

Password Manager KeeWeb Password Manager🔑 KeeWeb is a browser and desktop password manager which is capable of opening up existing KeePass database kdbx files, or creating new vaults to store your important credentials in. !Versiongithub-version-imggithub-version-uri...

wig

wig - WebApp Information Gatherer wig is a web application information gathering tool, which can identify numerous Content Management Systems and other administrative applications. The application fingerprinting is based on checksums and string matching of known files for different versions of...

msmailprobe

msmailprobe Office 365 and Exchange Enumeration It is widely known that OWA Outlook Webapp is vulnerable to time-based user enumeration attacks. This tool leverages all known, and even some lesser-known services exposed by default Exchange installations to enumerate users. It also targets Office...

domain-to-webapp

domain-to-webapp A simple bash script for finding web application hosted within a domain Requirements curl Subfinder docker image Usage $./webAppChecker businesssolutions.com ./ouputdir ./scope.txt | \ | | \ \ / /| | / \ | | | |/ | ' \ / | | ' \ | / \ \ \ /\ / / \ ' \ / \ | ' | ' \ | || | | | | |...

redjoust

ᵔᴥᵔ RedJoust A quick and easy to use security reconnaissance webapp tool, does OSINT, analysis and red-teaming in both passive and active mode. Written in nodeJS and Electron. Join the community Join the community of Kawaiipantsu / THUGSred and participate in the dev talk around Redjoust or simpl...

adapt

Summary ADAPT is a tool that performs Automated Dynamic Application Penetration Testing for web applications. It is designed to increase accuracy, speed, and confidence in penetration testing efforts. ADAPT automatically tests for multiple industry standard OWASP Top 10 vulnerabilities, and outpu...

Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting

Zarafa WebApp 2.0.1.47791 and earlier contains an unauthenticated reflected cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. id: CVE-2019-7219 info: name: Zarafa WebApp =2.0.1.47791 -...

XWiki - Information Disclosure

XWiki 16.7.0 to 16.10.11, 17.4.4, and 17.7.0 using XJetty contains an information disclosure vulnerability caused by exposed context allowing static access to files in webapp/ folder, letting attackers access sensitive files, exploit requires use of XJetty package. id: CVE-2025-55749 info: name:...

Mahoraga-Webapp-Defender

Mahoraga Webapp Defender AI-powered reactive webapp defense system designed to withstand AI-powered hacks in real-time. Table of Contents Mahoraga Webapp Defender Table of Contents Introduction Target Website Mahoraga Defender Architecture Dual Environments Agent Pipeline How to Start Getting rea...

webapp-exploits

webapp-exploits Web Application Exploit Development...

CVE-2019-7219

CVE-2019-7219 CVE-2019-7219 Zarafa Webapp Author: verifysecurity At least Webapp version 1.6-46049 till 2.0.1.47791 are affected. hxxps://127.0.0.1/webapp/?fccc0"5f43d=1...

Gallery-Plugin-SQL-Injection

Exploit Title: Wordpress Video Gallery - YouTube Gallery and Vimeo Gallery Plugin SQL Injection Date: 2024-07-05 Exploit Author: tmrswrr Category : Webapps Vendor Homepage: https://total-soft.com/wp-video-gallery/ Version 2.3.6 1. Access the Admin Panel: Navigate to the admin panel of your...

Astra Linux – Vulnerability in Chromium

Chromium: CVE-2021-30622 – Use after free in WebApp installations...

GHSA-4672-HWV6-GQ62 Trigger.dev: Cross-environment deployment cancel

Summary Trigger.dev isolates each project into multiple environments dev, staging, prod, and per-PR preview branches, each with its own secret API key — the environment is a trust boundary a dev/preview/CI key is lower-trust than a prod key. Most API routes enforce this by scoping resource lookup...

Trigger.dev: Blind SSRF via alert-channel webhook

Summary A WEBHOOK alert channel stores a user-supplied url. When an alert fires deployment/run failure, error groups, the webapp server alertsWorker - DeliverAlertService POSTs the HMAC-signed alert payload to that URL via fetchwebhook.url, .... The URL is never validated against a host allowlist...

GHSA-Q567-CR4X-96W4 Trigger.dev: Blind SSRF via alert-channel webhook

Summary A WEBHOOK alert channel stores a user-supplied url. When an alert fires deployment/run failure, error groups, the webapp server alertsWorker - DeliverAlertService POSTs the HMAC-signed alert payload to that URL via fetchwebhook.url, .... The URL is never validated against a host allowlist...

CLEANSTART-2024-OU15582 Chromium: CVE-2021-30622 Use after free in WebApp Installs

Security vulnerability affects the chromium package. Chromium: CVE-2021-30622 Use after free in WebApp Installs...

CLEANSTART-2024-VI83166 Use after free in WebApp Installs in Google Chrome prior to 102

Security vulnerability affects the chromium package. Use after free in WebApp Installs in Google Chrome prior to 102...

CLEANSTART-2024-TO71899 Use after free in WebApp Provider in Google Chrome prior to 103

Security vulnerability affects the chromium package. Use after free in WebApp Provider in Google Chrome prior to 103...

Rocky Linux 9.6 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ciqsa-2026_1496)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261496 advisory. This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 9.6. It addresses 37 CVEs: CVE-2016-5425, CVE-2024-23672, CVE-2018-1304,...