yaralyzer

THE YARALYZER Visually inspect all of the regex matches and their sexier, more cloak and dagger cousins, the YARA matches found in binary data and/or text. See what happens when you force various character encodings upon those matched bytes. With colors. Quick Start pipx install yaralyzer Scan...

ocr-recon

ocr-recon This tool is useful to find a particular string in a list of URLs using tesseract's OCR Optical Character Recognition capabilities Usage Usage: python3 ocr-recon.py listwithURLs stringtosearch...

flawfinder

About This is "flawfinder" by David A. Wheeler. Flawfinder is a simple program that scans C/C++ source code and reports potential security flaws. It can be a useful tool for examining software for vulnerabilities, and it can also serve as a simple introduction to static source code analysis tools...

Liferay Portal - Open Redirect

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' U+FFFD, which allows remote...

GHSA-CXF4-7MRP-VVPR Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Related public issue context, not a duplicate Closed issue 1429 "Handle non-UTF-8 paths", 2024-03-24 raised exactly this general concern and even suggested detection via pregmatch'//u', $path !== 1 -- note the reporter's suggested check explicitly compares !== 1, which would correctly treat PCRE'...

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Related public issue context, not a duplicate Closed issue 1429 "Handle non-UTF-8 paths", 2024-03-24 raised exactly this general concern and even suggested detection via pregmatch'//u', $path !== 1 -- note the reporter's suggested check explicitly compares !== 1, which would correctly treat PCRE'...

psudohash

psudohash Cool New Features of v1.1.0 Special thanks to DavidAngelos: ▶️ Added a progress bar in every step to track execution. ▶️ Added options: In-order joins -i / --inorder: join keywords only in the original order e.g. foo,bar,baz → foo, bar, baz, foobar, foobaz, barbaz, foobarbaz. All-order...

Octopii

Octopii ⠀⠀⠀⠀⠀⠀⠀⣤⣤⣄⣀⡀⠀⠀⠀⢀⣠⣤⣤⣄⡀⠀⠀⠀⢀⣀⣠⣤⣤⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠸⣿⣿⡿⠿⢿⣷⡄⢠⣿⣿⣿⣿⣿⣿⡄⢀⣾⡿⠿⢿⣿⣿⠇⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠈⠉⠀⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⠀⠉⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⣠⣤⡀⠀⠀⠀⠀⠀⠀⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⠀⠀⠀⠀⠀⠀⢀⣤⣄⠀⠀⠀ ⠸⣿⣿⣿⣿⣿⣿⣿⣿⣦⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⣴⣿⣿⣿⣿⣿⣿⣿⣿⠇⠀⠀ ⠀⠉⠉⠁⠀⠀⠀⠀⣿⣿⠀⢸⣿⡇⠀⠉⣿⣿⣿⣿⠉⠀⢸⣿⡇⠀⣿⣿⠀⠀⠀⠀⠈⠉⠉⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣀⣈⣻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣟⣁⣀⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀...

CVE-2025-51860

CVE-2025-51860 Descripción de la vulnerabilidad TelegAI, una aplicación web para construir y chatear con personajes de IA, es vulnerable a Cross-Site Scripting Almacenado XSS en su componente de chat y en el componente contenedor de personajes. Un atacante puede lograr la ejecución arbitraria de...

CVE-2021-29156

CVE-2021-29156 Prueba de Concepto c 2021 GuidePoint Security Charlton Trezevant [email protected] Antecedentes Hoy GuidePoint se complace en publicar una herramienta funcional de Prueba de Concepto para CVE-2021-29156, una vulnerabilidad de inyección LDAP en ForgeRock OpenAM v13.0.0. Esta...

shortscan

🌀 Shortscan An IIS short filename enumeration tool. Functionality Shortscan is designed to quickly determine which files with short filenames exist on an IIS webserver. Once a short filename has been identified the tool will try to automatically identify the full filename. In addition to standard...

CVE-2021-32708

CVE-2021-32708 Las versiones afectadas de este paquete son vulnerables a una condición de carrera. La normalización de espacios en blanco utilizada en las versiones 1.x y 2.x elimina cualquier espacio en blanco Unicode. Bajo ciertas condiciones específicas, esto podría permitir que un usuario...

ocr-recon

ocr-recon 该工具利用 tesseract 的 OCR（光学字符识别）功能，在 URL 列表中查找特定字符串。 用法 用法: python3 ocr-recon.py listwithURLs stringtosearch...

Slink

Slink is an alphanumeric shellcode x86 encoder that use simple math operations to reformat characters beyond 7f. The tool creation was inspired by the following sploit EDB-ID: 44455. Here's the list of current features: Encode using 01-7f characters set. Exclude common bad characters such as...

CVE-2012-2982

CVE-2012-2982 描述 Webmin 1.590 及更早版本中的 file/show.cgi 允许远程认证用户通过路径名中的无效字符（例如 |（管道符））执行任意命令。 安装 1. git clone https://github.com/CpyRe/CVE-2012-2982.git 2. pip3 install -r requirements.txt 使用方法 1. nc -nlvp 2. python3 exp.py 或 python3 subprocess-exp.py 3. RCE!!...

CVE-2022-46485

CVE-2022-46485 ngDoS - ngSurvey Notas: La pregunta "slider" también puede ser vulnerable con un entero grande en lugar de una cadena. No se pudo confirmar en mi entorno local. Pasos de explotación Abre la página de la encuesta y busca un campo de texto o de comentarios. Rellena la encuesta...

CVE-2026-40791-WP-Time-Slots-Booking-Form-XSS

CVE-2026-40791: One Booking Slot to Admin XSS I found an unauthenticated stored XSS in the WordPress WP Time Slots Booking Form plugin. A public booking submission controls part of the stored time-slot value. The plugin later prints that value into the administrator Booking Orders page without...

CVE-2022-23935

CVE-2022-23935 The Exiftool software program, in versions prior to 12.38, has a security vulnerability that can be exploited through a specially crafted filename. This vulnerability allows for command injection, where an attacker can execute arbitrary commands on the system by appending a pipe...

CVE-2019-11395

https://www.exploit-db.com/exploits/47554 It is a version that modified the existing Python2 code to fit the Python3 format. Use the same Bad Character, but write the Payload according to each environment using msfvenom!...

CVE-2026-100674

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create...