EUVD-2026-87823

heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to URLs taken from user-created credentials webhookurl / flaresolverrurl using an unguarded HTTP client, bypassing the SSRF egress guard that...

CVE-2026-100857

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration...

The vulnerability of the QAFA Firmware for telecommunications equipment lies in its ability to bypass authentication using a user-controlled key. This allows attackers to gain access to the administrative web console.

The vulnerability of the QAFA Firmware for telecommunications equipment relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the administrative web console...

CVE-2026-78582

Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...

EUVD-2026-87657

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validatin...

CVE-2026-100654 vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

vLLM before 0.29.0 accepts user-controlled stoptokenids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When mintokens 0, the stop token ids a...

EUVD-2026-87701

Flowise through 3.1.4 Enterprise/platform mode with SSO enabled contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin SSOBase.ts:80-94 copies the user record from the database — including the...

Dumb0

Dumb0 인기 포럼과 CMS에서 사용자를 덤프하는 간단한 도구입니다 WordPress, SMF, vBulletin, IP Board, XEN forums, myBB, useBB, vanilla, bbPress.... 27개의 포럼/CMS를 지원합니다 리스트를 늘리는 데 도움을 주세요!: root@kitploit: SMF -- 심플 머신 포럼 IPB -- Invision Power Board XEN -- Xen Foro VB -- vBulletin myBB -- useBB -- vanilla -- bbPress -- WP --...

TotalRecall

TotalRecall Reloaded Breaking Windows Recall. Again. image Microsoft가 VBS 엔클레이브, AES-256-GCM 암호화, Windows Hello 인증, Protected Process Light 호스트를 사용하여 Recall을 재설계했을 때, 메시지는 분명했습니다: 데이터는 금고에 잠겨 있다는 것입니다. 금고는 견고합니다. 그러나 배달 트럭은 그렇지 않습니다. Recall 타임라인을 렌더링하는 프로세스인 AIXHost.exe에는 PPL, AppContainer, 코드 무결...

CVE-2026-24061

CVE-2026-24061-PoC ⚠ このツールは学習目的のみで作成されています。管理された環境以外での不正使用は固く禁止されています。 CVE-2026-24061 は、GNU Inetutils バージョン 1.9.3～2.7 の telnetd における深刻な脆弱性 CVSS 9.8 であり、リモートの攻撃者が USER 環境変数を介して -f root を渡すことで認証をバイパスし、root アクセスを取得することを可能にします。このツールは、この脆弱性の悪用をシミュレートするために作成されました。 要件 Windows OS/Linux Python 3.4+ 使用方法 こ...

pwndoc

PwnDoc PwnDoc is a pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. The main goal is to have more time to Pwn and less time to Doc by mutualizing data like vulnerabilities between users. Documentation Installation Data Roles...

pwndoc

PwnDoc PwnDoc는 침투 테스트 보고 애플리케이션으로, 발견 내용을 쉽고 간단하게 작성하고 사용자 정의 가능한 Docx 보고서를 생성할 수 있습니다. 주요 목표는 취약점과 같은 데이터를 사용자 간에 공유하여 Pwn 에 더 많은 시간을 할애하고 Doc 에 더 적은 시간을 쓰는 것입니다. 문서 설치 데이터 역할 취약점 감사 템플릿 설정 프로필 기능 다국어 지원 다중 데이터 지원 뛰어난 사용자 정의 재사용 가능한 감사 및 취약점 데이터 관리 사용자 정의 섹션 생성 취약점에 사용자 정의 필드 추가 CVSS v3 및 v4 점수를...

CVE-2024-0204

CVE-2024-0204: GoAnywhere MFT における認証バイパス GoAnywhere MFT で新しい管理ユーザーを作成するスクリプト。 ブログ記事 詳細はこちら: https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/ 使用方法 パスワードは GoAnywhere MFT の複雑性要件を満たすため、最低8文字必要です。 root@kitploit: % python3 CVE-2024-0204.py -h usage:...

multi-juicer

CTF 및 보안 교육을 OWASP Juice Shop과 함께 실행하는 것은 일반적으로 꽤 까다롭습니다. Juice Shop은 한 번에 여러 사용자가 사용하도록 설계되지 않았기 때문입니다. 모든 사람에게 자신의 머신에서 Juice Shop을 시작하는 방법을 지시하는 것은 괜찮지만, 너무 많은 소중한 시간을 빼앗아 갑니다. MultiJuicer를 사용하면 중앙 Kubernetes 클러스터에서 각 참가자에게 별도의 Juice Shop 인스턴스를 실행하여 로컬 Juice Shop 인스턴스 없이 이벤트를 실행할 수 있습니다. 기능: 필...

CVE-2017-7921-EXP

CVE-2017-7921 エクスプロイト Hikvision デバイスで、不適切な認証の問題が発見されました。 ​ 不適切な認証の脆弱性は、アプリケーションがユーザーを適切に、または正しく認証しない場合に発生します。 ​ これにより、悪意のあるユーザーがシステム上で権限を昇格させ、機密情報にアクセスできる可能性があります。 ​ https://seclists.org/fulldisclosure/2017/Sep/23 ​ 脆弱性の詳細: ​ ---------------------- ​ すべてのユーザーとその役割の一覧を取得する: ​...

auth

Auth - Supabaseによる認証とユーザー管理 Authは、Goで書かれたユーザー管理・認証サーバーであり、Supabase の以下のような機能を支えています: JWTの発行 PostgRESTによる行レベルセキュリティ ユーザー管理 メール、パスワード、マジックリンク、電話番号でのサインイン 外部プロバイダーでのサインイン Google、Apple、Facebook、Discord、... これは元々、優れた NetlifyによるGoTrueコードベース に基づいていますが、両者は機能と能力において大幅に分岐しています。 プロジェクトに貢献したい場合は、貢献ガイド...

CVE-2026-84097

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

socid-extractor

socidextractor Turn any public profile page into a structured account record — usernames, display names, bios, avatars, locations, joined-at dates, follower counts, external links, and the stable internal identifiers that uniquely pin an account across renames, redesigns, and deletions...

apidetector

APIDetector is a powerful and efficient tool designed for testing exposed Swagger endpoints in various subdomains with unique smart capabilities to detect false-positives. It's particularly useful for security professionals and developers who are engaged in API testing and vulnerability scanning...

ofrak

OFRAK OFRAK Open Firmware Reverse Analysis Konsole is a binary analysis and modification platform. OFRAK combines the ability to: Identify and Unpack many binary formats Analyze unpacked binaries with field-tested reverse engineering tools Modify and Repack binaries with powerful patching...