vbsmin

VBSmin VBScript minifier Features ⬜️ Remove extra whitespace Trailing whitespace Leading whitespace Blank lines Inline extra spaces 💬 Remove comments Single quote start of the line Single quote inline REM 1️⃣ One-line Line splitting underscore Colon Quick start Quick install $ gem install vbsmin...

CVE-2025-9491_POC

CVE-2025-9491 PoC de Ofuscación LNK Una herramienta de prueba de concepto para demostrar la vulnerabilidad de los archivos de acceso directo LNK de Windows ZDI-CAN-25373/CVE-2025-9491. Esta herramienta muestra cómo se pueden ocultar argumentos de línea de comandos maliciosos dentro de archivos .l...

drinkme

drinkme drinkme is a shellcode test harness. It reads shellcode from stdin and executes it. This allows pentesters to quickly test their payloads before deployment. Formats drinkme can handle shellcode in the following formats: "0x" "\x" "x" "" For example, NOP could be represented as any of...

GO-2026-6548 Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` in github.com/tomwright/dasel

Dasel: Selector lexer panics on trailing whitespace in parseCurRune in github.com/tomwright/dasel...

CVE-2026-33033-PoC

CVE-2026-33033 PoC Denial-of-service via base64 whitespace CPU amplification in DjangoMultiPartParser A single 2.5 MB HTTP request can tie up a Django worker for 5 seconds , achieving 2,100x CPU amplification over a normal request of the same size. No authentication is required. Affected Versions...

CVE-2023-24329-Exploit

Intro The URL parsing functions focus on splitting a URL string into its components, or on combining URL components into a URL string. urllib.parse.urlparse Simply urllib.parse used for parsing urls, we can bypass it with adding blanks before the url. This happens in python 3.11.4 and before. PoC...

CVE-2023-24329-lab

CVE-2023-24329 — Laboratorio de Diferencial de Analizador Parser Differential Solo con fines educativos. Este laboratorio existe para demostrar una vulnerabilidad real en un entorno seguro y aislado. No lo ejecutes nunca contra sistemas que no te pertenezcan. No reutilices el código de filtro...

CVE-2026-92232

Joomla! Core - 20260916 - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector...

CVE-2026-92232

The Joomla! Core component is vulnerable to a Cross-Site Scripting (XSS) filter bypass in the InputFilter component, specifically affecting versions 1.5.0-5.4.8 and 6.0.0-6.1.3 . The root cause is that the cleanAttribute method fails to properly sanitize HTML data URIs when injected whitespace ch...

CVE-2026-92232 Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260916 - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector...

EUVD-2026-89073

Joomla! Core - 20260916 - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector...

PT-2026-98740

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the netfilter nf conntrack sip component. The sip skip whitespace function returns the dptr pointer unchanged when the buffer is exhausted instead of...

EUVD-2026-84016

Dasel: Selector lexer panics on trailing whitespace in parseCurRune...

Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: dasel query 'a ' panics at selector/lexer/tokenize.go:60. The whitespace-skip loop right above lines 55-57 advances p.i to p.srcLen when the input is...

GHSA-65GG-G7RW-6CPC Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: dasel query 'a ' panics at selector/lexer/tokenize.go:60. The whitespace-skip loop right above lines 55-57 advances p.i to p.srcLen when the input is...

CVE-2026-54915 Tautulli: Open redirect via whitespace bypass in /auth/redirect

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirecturi parameter but leaves tab, line-feed, and carriage-return characters intact...

CVE-2026-54915

Tautulli , a Python-based monitoring tool for Plex Media Server, contains an open redirect vulnerability in its unauthenticated /auth/redirect endpoint (plexpy/webauth.py). The flaw stems from the endpoint stripping forward slashes from the user-controlled redirect_uri parameter while leaving tab...

CVE-2026-54915 Tautulli: Open redirect via whitespace bypass in /auth/redirect

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirecturi parameter but leaves tab, line-feed, and carriage-return characters intact...

DEBIAN-CVE-2026-62866

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. ...

CVE-2026-62866 Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. ...