Security update 5.2.1 for Multi-Linux Manager Server, Proxy and Retail Branch Server

Description: This update fixes the following issues: proxy-httpd-image: Version 5.2.10 Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.2.1 proxy-salt-broker-image: Version 5.2.9 Image rebuilt to the newest version with updated dependencies for SUSE...

eWeLink-QR-Code

eWeLink mobile Application - Incorrect Access Control Vulnerability CVE-2021-27941 Unconstrained Web access to the device's private encryption key in the QR code pairing mode in the eWeLink mobile application through 4.9.2 on Android and through 4.9.1 on iOS allows a physically proximate attacker...

CVE-2023-24329-lab

CVE-2023-24329 — Parser Differential Lab Educational use only. This lab exists to demonstrate a real vulnerability in a safe, isolated environment. Never run this against systems you do not own. Never reuse the intentionally broken filter code in any production system. A self-contained Docker lab...

CVE-2025-13380

AI Engine for WordPress: ChatGPT, GPT Content Generator = 1.0.1 - Authenticated Contributor+ Arbitrary File Read The AI Engine for WordPress plugin contains a vulnerability in its image insertion feature that allows any authenticated user with post editing capabilities Contributor, Author, Editor...

xwiki-cve-2025-24893-exploit

XWiki CVE-2025-24893 Exploit Unauthenticated Remote Code Execution exploit for XWiki versions vulnerable to CVE-2025-24893. Vulnerability Overview XWiki versions prior to 15.10.9 are vulnerable to unauthenticated RCE through Groovy script injection in the SolrSearch RSS feed handler. The...

n8n-cve-2025-68613

CVE-2025-68613 – n8n Expression Injection RCE Toolkit ini menyediakan scanner dan exploit PoC untuk kerentanan kritis CVE-2025-68613 pada n8n Workflow Automation Platform. This repository provides scanner and exploit PoC scripts for the critical CVE-2025-68613 vulnerability affecting n8n Workflow...

msteams

msteams A Mythic C2 Profile that uses the Microsoft Graph API to communicate through a Microsoft Teams channel. How It Works Agent Microsoft Teams Channel C2 Server Mythic 1. The agent authenticates to Microsoft Entra ID via OAuth2 client credentials 2. Posts its Mythic message base64-encoded,...

CVE-2026-8794

CVE-2026-8794 — Username Enumeration via Authentication Timing Side-Channel in PaperCut NG Field| Details ---|--- CVE ID| CVE-2026-8794 Product| PaperCut NG Affected Version| 25.0.11 Build 75758 and earlier CWE| CWE-208 — Observable Timing Discrepancy CVSS Score| 3.7 Low — standalone; escalates...

POC-GeoLeak-CVE-2026-52715

GeoLeak — PoC for CVE-2026-52715 Educational Proof of Concept for GeoLeak CVE-2026-52715, an unauthenticated SQL injection CVSS 9.3 in the GEO my WordPress = 4.5.5 plugin for WordPress. The swlatlng and nelatlng map boundary parameters are interpolated without sanitization into the WHERE clause...

CVE-2026-85487

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

CVE-2026-85423

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the...

CVE-2026-85097

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...

nginx-cve-2026-42945-check

NGINX CVE-2026-42945 Local Checker Language: 中文 | English This repository provides two standalone local scripts for checking whether a Linux or Windows server has Nginx, OpenResty, or Tengine instances that may be exposed to CVE-2026-42945 related risk. The scripts are read-only. They do not run ...

CVE-2025-34291_cors_security_scanner

CVE-2025-34291corssecurityscanner A lightweight Python-based security assessment tool for detecting dangerous Cross-Origin Resource Sharing CORS misconfigurations - CVE-2025-34291. CORS Security Scanner A lightweight Python-based security assessment tool for detecting dangerous Cross-Origin...

bugbounty-arsenal-resources

BugBounty Arsenal Resources Curated workflows, tools and references for bug bounty hunters and web security researchers. What is BugBounty Arsenal? BugBounty Arsenal is a practical web testing platform focused on recon workflows, endpoint discovery and security testing utilities. The goal is to...

Hybrid Submit

Hybrid Analysis Batch Submission Script This Python script recursively scans a folder and submits executable, script, document, and other relevant files to Hybrid Analysis Falcon Sandbox for automated malware analysis. Features Recursively walks through directories Submits only supported file typ...

CVE-2025-58434-poc

CVE-2025-58434 — Flowise Account Takeover via Token Disclosure ⚠️ This repository is for educational and authorized security research only. Unauthorized use against systems you do not own or have explicit permission to test is illegal. Table of Contents Overview Vulnerability Details Attack Flow...

kube-dementor

Kube-Dementor — Kubernetes Attack Graph Analyzer Kubernetes s...

CTF-Web-Exploitation

Nether Portal Desync HUUP "I travel not on established roads but leap freely across the void. Package me wrong, and I'll deliver a secret to the wrong doorstep." Description The challenge features an HTTP/3 QUIC application layered over UDP. Because UDP is stateless and the proxy doesn't enforce...

CVE-2026-85097 Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...