CVE-2026-93580

The InPost PL WordPress plugin (specifically InPost for WooCommerce versions 1.7.5 - 1.9.7 ) is vulnerable to unauthenticated order status forgery. The root cause is a failure to verify the authenticity of incoming shipment webhook requests , as the plugin relies on a non-secret identifier and an...

EUVD-2026-89623

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...

CVE-2026-102877

The Fider application (versions prior to 0.38.0 ) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is a time-of-check time-of-use (TOCTOU) gap during URL validation for webhooks and custom OAuth provider endpoints. An attacker who controls DNS can utilize a DNS rebinding attac...

EUVD-2026-89409

Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send...

CVE-2026-53988

Dockhand versions prior to 1.0.40 are vulnerable to an authentication bypass in the git webhook endpoints caused by a null webhook secret guard condition. This allows unauthenticated remote attackers to enumerate stack IDs and send unsigned webhook requests to trigger arbitrary stack redeployment...

cve-2026-22874-gitea-ssrf-allowlist

CVE-2026-22874 — Protección SSRF incompleta en la lista de permitidos de webhook y migración de Gitea Informe técnico y referencias para CVE-2026-22874 GHSA-2r5c-gw76-rh3w: una lista de permitidos SSRF incompleta en la entrega de webhooks y la migración de repositorios de Gitea, corregida en Gite...

BTPS-SecPack

El Paquete de Seguridad PowerShell del Equipo Azul Usar Microsoft Teams para Alertas en Lugar de Correo Electrónico Si deseas usar Microsoft Teams para enviar alertas en lugar de usar correo electrónico, deberás cargar la rama microsoft-teams de este repositorio, que tiene las modificaciones para...

tiktok-scraper

TikTok Scraper & Downloader Scrape and download useful information from TikTok. No login or password are required This is not an official API support and etc. This is just a scraper that is using TikTok Web API to scrape media and related meta information. Content Features To Do Contribution...

shomon

ShoMon es un alimentador de alertas de Shodan para TheHive escrito en GoLang. ¡Con la versión 2.0, es más potente que nunca! Funcionalidades Se puede utilizar como Webhook o como lector de Stream El Webhook abre un endpoint API REST para que Shodan envíe alertas. Esto significa que necesitas hace...

cve-collector

CVE-Collector Simple Latest CVE Collector Written in Python There are various methods for collecting the latest CVE Common Vulnerabilities and Exposures information. This code was created to provide guidance on how to collect, what information to include, and how to code when creating a CVE...

CVE-2025-7441

CVE-2025-7441 StoryChief 1.0.42 - 任意文件上传 漏洞 CVE-2025-7441 - 技术总结 受影响组件： StoryChief WordPress 插件 漏洞类型： 未认证的任意文件上传 漏洞端点： /wp-json/storychief/webhook 根本原因： 该插件接受一个 JSON webhook 载荷，其中含有一个 URL（位于 data.featuredimage.data.sizes.full），并在此 URL 上执行服务器端 HTTP GET 请求，但缺少充分的验证（无域名白名单、MIME/内容检查不足，且文件保存于公共上传路径）。...

ghostbuster

Table of Contents Table of Contents Ghostbuster The problem Project Features Installing Ghostbuster Using Ghostbuster Example Output Setting up your AWS accounts Setting up Cloudflare Optional Authors License Ghostbuster Eliminate dangling elastic IPs by performing analysis on your resources with...

CVE-2026-34207

CVE-2026-34207 SSRF过滤器检查了主机名字符串，但实际目的地是由后续的DNS决定的。这一漏洞使得攻击者控制的Webhook URL能够到达回环地址、元数据服务和私有网络目标。 介绍 我在审查Typebot （一个开源聊天机器人构建器）时发现了这个漏洞，心中带着一个简单的安全问题： 如果SSRF保护验证的是主机名字符串，而实际目的地是由后续的DNS决定的，会发生什么？ 在这个案例中，这个问题引出了一个真正的漏洞。 Typebot 的 Webhook / HTTP 请求块的 SSRF 保护仅验证了： URL 字符串， 封禁了主机名字面量， 以及字面量 IP 格式 它没有...

CVE-2026-5556-Kubernetes-Admission-Controller-Bypass-via-Case-Sensitivity

CVE-2026-5556 – Bypass del controlador de admisión de Kubernetes mediante sensibilidad a mayúsculas y minúsculas Código del programa webhook de admisión en Python + exploit !/usr/bin/env python3 admissionwebhook.py - Vulnerable webhook that rejects pods with specific name from flask import Flask,...

path-traversal-CVE-2026-14628

Demostración de Path Traversal - Caso de estudio: CVE-2026-14628 Una demostración mínima y ejecutable de la clase de vulnerabilidad Path Traversal CWE-22 , utilizando el recientemente divulgado CVE-2026-14628 como punto de referencia del mundo real. La vulnerabilidad real CVE-2026-14628 afecta a...

bbrecon

此项目不再维护，我已将爬虫基础设施下线。 由于受众规模不足以证明维护的合理性。 Bug Bounty Recon（bbrecon）是一项免费的“侦察即服务”，专为漏洞赏金猎人和安全研究人员设计。该API旨在持续提供互联网“安全港”攻击面的最新地图，排除范围外的目标。 它附带一个符合人体工程学的CLI和Python库。 重要声明 尽管我们已努力确保bbrecon返回的结果可靠且可信，但本服务及其运营者对您使用所提供数据的行为概不负责。 请仔细检查您的范围，并确保您停留在安全港内。 功能特性 公开项目 - 公开漏洞赏金项目，支持索引和筛选搜索 域名 - 各项目范围内的域名 通知 -...

CVE-2021-22214

CVE-2021-22214 Descripción - PoC para CVE-2021-22214: Vulnerabilidad SSRF sin autenticación en Gitlab CI Lint API - Creado por antx el 2021-11-01. Detalle - Cuando las solicitudes a la red interna para webhooks están habilitadas, una vulnerabilidad de falsificación de solicitudes del lado del...

CVE-2021-25735

CVE-2021-25735 Explotación de CVE-2021-25735: Omisión del Webhook de Admisión de Validación de Kubernetes Configurar el entorno vulnerable Comencemos ejecutando el script gencerts.sh para generar certificados y claves TLS. bash gencerts.sh Para implementar el controlador de admisión necesitas...

lazyrecon

root@kitploit: | | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 is a subdomain discovery tool that finds and resolves valid subdomains then performs SSRF/LFI/SQLi fuzzing, brute-force and port scanning. It has a simple modular architecture and...

CVE-2025-1974-poc

POC of IngressNightmare, RCE in Ingress NGINX CVE-2025-1974 Developed from: https://github.com/zwxxb/CVE-2025-1974/blob/main/poc.py https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilitieshow-did-we-discover-ingressnightmare-24 Thanks 使用说明 forward the admission webhook kubectl port-forwar...