CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset

CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset Information on the vulnerability Wordpress has a password reset feature that contains a vulnerability which might in some cases allow attackers to get hold of the password reset link without previous authentication. Such attack could lea...

o365enum

Office 365 User Enumeration Enumerate valid usernames from Office 365 using ActiveSync, Autodiscover, or office.com login page. Usage o365enum will read usernames from the file provided as first parameter. The file should have one username per line. The output is CSV-based for easier parsing. Val...

rdap

OpenRDAP is a command line RDAP client implementation in Go. https://www.openrdap.org - homepage https://www.openrdap.org/demo - live demo Features Command line RDAP client Output formats: text, JSON, WHOIS style Query types supported: ip domain autnum nameserver entity help url domain-search...

CVE-2026-102274

A flaw was found in pyjwt. The library fails to properly handle errors when parsing a JSON Web Key JWK set that contains a malformed RSA key alongside valid keys. A remote attacker can supply or inject a malformed key to abort the processing of the entire key set, resulting in authentication...

cve-2024-0012-gui-poc

CVE-2024-0012 and CVE-2024-9474 Authentication Bypass in the Management Web Interface PAN-SA-2024-0015 and Authenticated Command Injection in Palo Alto PAN-OS. See the blog post for technical details. Exploit authors Original exploit written by Sonny of watchTowr @watchtowrcyber. Code and GUI...

CVE-2020-1958

CVE-2020-1958 PoC CVE-2020-1958 is high severity LDAP injection vulnerability in Apache Druid 0.17.0. It allows an attacker to bypass LDAP search filter and to retrieve any LDAP attribute values of users that exist on the LDAP server. From official Apache Druid advisory: When LDAP authentication ...

CVE-2025-47227

CVE-2025-47227 Exploit for CVE-2025-47227 - ScriptCase Password Reset Pre-Auth CVE-2025-47227 is a pre-auth authentication bypass CVSS 9.8 in the ScriptCase Production Environment ≤ 9.12.006. The login.php endpoint allows resetting the administrator password without a token, email validation, or...

cpanel2shell-scanner

cpanel2shell-scanner A high-fidelity scanner for the cPanel/WHM authentication bypass tracked as CVE-2026-41940. It identifies vulnerable hosts without producing the false-negatives common to public proofs-of-concept and detections, and without triggering the account lockout and root-IP-allowlist...

aws-iam-authenticator

AWS IAM Authenticator for Kubernetes A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster. The initial work on this tool was driven by Heptio. The project receives contributions from multiple community engineers and is currently maintained by Heptio and Amazon EKS OSS...

BrowserBox

BrowserBox by DOSAYGO Secure, modern Remote Browser Isolation RBI with a clientless experience 🖥️ NEW in v18.10.0 — the BrowserBox desktop app...

CVE-2026-27966

CVE-2026-27966 — Langflow Remote Code Execution Scanner Pre-Auth Route Injection + Vertex Injection → Python Code Execution Overview CVE-2026-27966 is a critical-severity CVSS 9.8 pre-authentication remote code execution vulnerability in Langflow versions prior to 1.8.0. The vulnerability stems...

tfc

Tinfoil Chat Tinfoil Chat TFC is a FOSS+FHD peer-to-peer messaging system that relies on high assurance hardware architecture to protect users from passive collection, MITM attacks and most importantly, remote key exfiltration. TFC is designed for people with one of the most complex threat models...

latma

Herramienta de análisis de movimiento lateral El analizador de movimiento lateral LATMA recopila registros de autenticación del dominio y entornos de Azure AD y busca posibles ataques de movimiento lateral y actividad sospechosa. El movimiento lateral puede ocurrir en el entorno de AD o entre la...

latma

Lateral movement analyzer tool Lateral movement analyzer LATMA collects authentication logs from the domain and Azure AD environments and searches for potential lateral movement attacks and suspicious activity, the lateral movement can be in the AD environment or between cloud and on-prem. The to...

360WFP_Exploit

360WFPExploit Una prueba de concepto PoC que demuestra el posible abuso de la interfaz del controlador WFP de 360 Security 360netmonx64wfp.sys, con el objetivo de verificar el riesgo de que las interfaces IOCTL sin autenticación del llamante puedan ser utilizadas indebidamente por programas de...

LinkedInDumper

LinkedInDumper Script de Python 3 para volcar empleados de empresas desde la API de LinkedIn 💬 Descripción LinkedInDumper es un script de Python 3 que vuelca datos de empleados desde la plataforma de redes sociales LinkedIn. Los resultados incluyen nombre, apellido, cargo puesto, ubicación y un...

CVE-2026-24061

CVE-2026-24061 GNU inetutils-telnetd - Remote Authentication Bypass A security research tool for exploiting CVE-2026-24061, a critical remote authentication bypass vulnerability in GNU inetutils-telnetd that allows instant root shell access without authentication. Table of Contents Vulnerability...

CVE-2026-102273

A flaw was found in PyJWT. This vulnerability allows an unauthenticated remote attacker to bypass authentication by forging arbitrary JSON Web Tokens JWTs. When an application allows both symmetric and asymmetric algorithms, PyJWT fails to properly validate public JSON Web Key JWK container...

CVE-2026-102272

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

CVE-2026-102271

A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules DER format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code HMAC operations. If an application supports both asymmetric and...