Limit Login Attempts - Stored Cross-Site Scripting

Limit Login Attempts WordPress plugin 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges. id: CVE-2022-1029 info: name: Limit Login Attempts - Stored...

Jeg Elementor Kit < 2.5.7 - Unauthenticated Settings Update

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the...

Transposh WordPress Translation <= 1.0.8 - Unauthenticated Settings Change

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient permissions checking on the 'tptranslation' AJAX action and default settings which makes it possib...

EUVD-2026-94159

Improper Neutralization of Input During Web Page Generation “Cross-site Scripting” in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Updat...

CVE-2026-14911

Improper Neutralization of Input During Web Page Generation “Cross-site Scripting” in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Updat...

CVE-2026-14911

A Cross-site Scripting (XSS) vulnerability exists in ASUS router modules due to the improper neutralization of input during web page generation. A remote attacker can exploit this flaw by tricking an authenticated user into visiting a crafted URL. Successful exploitation may allow the attacker to...

mongoaudit

mongoaudit is a CLI tool for auditing MongoDB servers, detecting poor security settings and performing automated penetration testing. Installing Clone this repository and run the setup: git clone https://github.com/stampery/mongoaudit.git cd mongoaudit python setup.py install mongoaudit...

EUVD-2026-94158

A predictable seed in the pseudo-random number generator PRNG in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing...

CVE-2026-19396

A predictable seed in the pseudo-random number generator PRNG in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing...

CVE-2026-19396

The ASUS RT-BE57 router is vulnerable to an issue where a predictable seed in the pseudo-random number generator (PRNG) is used during IFTTT pairing token generation . This flaw allows an unauthenticated nearby user to derive the pairing token by observing values during an administrator-initiated...

TeamViewer-dumper-in-CPP

TeamViewer-dumper-in-CPP 실행 중인 TeamViewer 인스턴스에서 자식 창을 열거하여 TeamViewer ID, 비밀번호 및 계정 설정을 덤프합니다. 컴파일 및 요구 사항 1. CL로 컴파일 2. cl TeamViewerDump.cpp 3. 또는 cl TeamViewerDump.cpp /EHsc로 컴파일 4. 요구 사항 5. TeamViewer가 실행 중이어야 합니다 6. TeamViewer의 영어 GUI에서만 테스트됨 샘플 출력 C:\tools\ProjectsTeamViewerDump.exe...

SFPolDevChk

Salesforce Policy Deviation Checker NCC Group Plc가 오픈소스로 공개 - https://www.nccgroup.com/ Jerome Smith@exploresecurity가 개발 Stephen Tomkinson@neonbunny9에게 감사 https://www.github.com/nccgroup/SFPolDevChk AGPL 라이선스로 배포됨 - 자세한 내용은 LICENSE를 참조하세요. 설명 Salesforce에서는 최상위 Organization 레벨에서 설정된 비밀번호 정책과 세션 설정...

audit_couchdb

Audit CouchDB: The simple, clear, CouchDB security assessment Audit CouchDB is a simple tool with a powerful message. Given an Apache CouchDB URL, it will tell you everything you ever wanted to know about its security. Objective Audit CouchDB will perform the following actions: 1. Learn every...

adfsbrute

adfsbrute A script to test credentials against Active Directory Federation Services ADFS, calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks. The main idea is carrying out password spraying attacks with a random and high delay between each test and...

CVE-2020-15916

KO GenLANConfigAttack - 는 CVE-2020-15916 을 악용하는 PoC로, 기기의 LAN 구성을 무단으로 변경할 수 있는 취약점입니다. 기능 LAN 구성 취약점 악용 악성 페이로드를 전송하여 네트워크 설정 변경 LAN 제어를 위한 보안 메커니즘 우회 사용 방법 1. 이 저장소를 클론합니다: git clone https://github.com/geniuszly/CVE-2020-15916 2. 종속성을 설치합니다: pip install -r requirements.txt 3. 익스플로잇을 실행합니다:...

CVE-2019-9978

CVE-2019-9978 CVE-2019-9978 - PoC Social WarFare 플러그인에서의 RCE system'cat /etc/passwd' 파일명 payload.txt로 저장하고 서버에 업로드하세요. URI는 다음과 같아야 합니다: https://yoursite.com/payload.txt. 마지막으로, --target과 --payload-uri 옵션을 제공하세요: $ python cve-2019-9978.py --target http://vulntarget.com \ --payload-uri...

PT-2026-107385

Improper Neutralization of Input During Web Page Generation “Cross-site Scripting” in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Updat...

CVE-2022-32060

Snipe-IT 버전 v6.0.2 취약점 설명: Snipe-IT v6.0.2의 브랜딩 설정 업데이트 구성 요소에서 임의 파일 업로드 취약점으로 인해 공격자가 조작된 파일을 통해 임의 코드를 실행할 수 있습니다. 공격 벡터: 브랜딩 설정 업데이트 페이지에서 악성 파일을 업로드할 때 파일 업로드 취약점을 발견했습니다. 페이로드 : https://github.com/bypazs/GrimTheRipper/blob/main/GrimTheRipperTeam.svg 테스트 환경: 1. Snipe-IT 버전 v6.0.2 2. Google...

web-traffic-generator

web-traffic-generator A quick and dirty HTTP/S "organic" traffic generator. About Just a simple poorly written Python script that aimlessly "browses" the internet by starting at pre-defined ROOTURLS and randomly "clicking" links on pages until the pre-defined MAXDEPTH is met. I created this as a...

firefox: thunderbird: Sandbox escape in the Remote Settings Client component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Remote Settings Client component...