CVE-2026-2699

CVE-2026-2699 — Progress ShareFile Storage Zones Controller Authentication Bypass Critical Authentication Bypass CVSS 9.8 in customer-managed Progress ShareFile Storage Zones Controller SZC ≤ 5.12.3. 📋 Overview CVE-2026-2699 is a severe authentication bypass vulnerability affecting the web...

EUVD-2026-95309

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks...

CVE-2025-26794-exploit

CVE-2025-26794: Exim ETRN SQL Injection Exploit A proof-of-concept exploit tool for CVE-2025-26794, demonstrating SQL injection vulnerability in Exim 4.98 mail server via the ETRN command when using SQLite DBM storage. ⚠️ Legal Disclaimer FOR AUTHORIZED SECURITY TESTING ONLY This tool is provided...

CVE-2026-105826

A flaw was found in ImageMagick. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted MATLAB MAT image containing highly compressed data. The MAT decoder fails to enforce configured temporary file size limits during decompression, allowing oversized temporary file...

shadowd

Logotipo Shadow Daemon es un cortafuegos de aplicaciones web que intercepta las peticiones a nivel de aplicación. Este repositorio contiene el componente principal de Shadow Daemon que maneja el análisis y almacenamiento de peticiones. Documentación Para la documentación completa, consulte...

CVE-2026-106393

An use after free flaw was found in the Storage component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/559793873...

CVE-2026-107829

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks...

CVE-2026-107829 Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks...

CVE-2026-107829

Jivejdon versions through 5.0 are vulnerable to a weak password storage issue. The application uses ToolsUtil.hash() in AccountDaoSql to store account passwords as unsalted MD5 digests . If an attacker gains access to the user table via database access or SQL injection , they can crack the passwo...

CVE-2026-107829 Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks...

CVE-2026-102368

Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware. Successful exploitation of this vulnerability may result in the...

CollaboratorPlusPlus

CollaboratorPlusPlus Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Corey Arthur, [email protected] http://www.github.com/nccgroup/CollaboratorPlusPlus This project is released under AGPL see LICENSE for more information Download from releases here. Backgrou...

CVE-2026-102368

Affected Tapo device firmware, specifically the Tapo S505 , contains a vulnerability where device-specific cryptographic material is stored in plaintext within nonvolatile storage. An attacker with physical access to the device can recover this sensitive material from the firmware. Successful exp...

EUVD-2026-95263

Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware. Successful exploitation of this vulnerability may result in the...

CVE-2026-102368 Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware

Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware. Successful exploitation of this vulnerability may result in the...

CVE-2026-102368 Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware

Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware. Successful exploitation of this vulnerability may result in the...

WMIcmd

The problem When doing low impact investigations and other similar activities you may want to minimize what is written to disk / obvious. This tool allows us to execute commands via WMI and get information not otherwise available via this channel. Purpose A small utility which only uses WMI to...

vcenter_saml_login

vCenter SAML ログインツール vCenter バックアップから IdP（Identity Provider）証明書を抽出し、Administrator としてログインするためのツール 背景 一般的に、エンゲージメント中は、ファイルサーバー上の vCenter バックアップへのアクセスを取得したり、最近の CVE を通じて VCSA ホストへの root アクセスを獲得したりすることがあります。vCenter vSphere UI にログインすることで、より多くのシステムや機密情報へのアクセスを容易に取得できるほか、顧客に対してこれらの発見による影響を示すことができます。...

CVE-2025-60791

CVE-2025-60791 CVE-2025-60791: 메모리 내 민감 정보의 평문 저장Cleartext Storage of Sensitive Information in Memory 취약점. Easywork Enterprise 2.1.3.354는 메모리 내 민감 정보의 평문 저장Cleartext Storage of Sensitive Information in Memory 취약점에 영향을 받습니다. 이 애플리케이션은 활성화 시도가 실패한 후에도 유효한 장치 바인딩 라이선스 키를 프로세스 메모리에 남겨둡니다. 디버거를 연결하거나...

CVE-2026-12948

CVE-2026-12948 Vulnerability Summary A stored cross-site scripting XSS vulnerability was identified in the web management interface of the Digi PortServer TS 4 H MEI. A specially crafted, authenticated request allows a script payload to be permanently written to device configuration storage. The...