The vulnerability of the platform for creating individual web applications in CRM systems is related to deficiencies in authentication procedures. This allows attackers to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the platform for creating individual web applications in CRM systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow attackers, operating remotely, to circumvent existing security mechanisms and gain unauthorized access to...

The vulnerability of the QAFA Firmware for telecommunications equipment lies in its ability to bypass authentication using a user-controlled key. This allows attackers to gain access to the administrative web console.

The vulnerability of the QAFA Firmware for telecommunications equipment relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the administrative web console...

The vulnerability of the Directum Web Agent component of the Directum RX system, which arises due to insufficient validation of input data, allows a perpetrator to execute arbitrary code.

The vulnerability of the Directum Web Agent component of the Directum RX system exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially crafted file...

lazyrecon

/ \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | Uso ./lazyrecon.sh -d domain.com Para excluir subdominios específicos: ./lazyrecon.sh -d domain.com -e excluded.domain.com,other.domain.com Acerca de...

social-analyzer

Social Analyzer - API, CLI, and Web App for analyzing & finding a person's profile across +1000 social media \ websites. It includes different analysis and detection modules, and you can choose which modules to use during the investigation process. The detection modules utilize a rating mechanism...

fuzzdb

FuzzDB was created to increase the likelihood of finding application security vulnerabilities through dynamic application security testing. It's the first and most comprehensive open dictionary of fault injection patterns, predictable resource locations, and regex for matching server responses...

Resources-for-Beginner-Bug-Bounty-Hunters

Resources-for-Beginner-Bug-Bounty-Hunters Intro Current Version: 2023.01 Welcome to our web hacking and bug bounty hunting resource repository! A curated collection of web hacking tools, tips, and resources is available here. We hope that this repository will be a valuable resource for you as you...

web-application-firewall-

Web Application Firewall Simulation Overview This project demonstrates a Web Application Firewall WAF simulation using Flask and a vulnerability checker for CVE-2017-5638. The WAF middleware blocks HTTP requests containing specific patterns, and the vulnerability checker tests for and exploits th...

CVEs

CVE List CVE-2024-22890: My e-Diary App - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22890.md CVE-2024-22909 : Online-Exam-System - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22909.md...

CVE-2024-4577

CVE-2024-4577 - Inyección de Argumentos RCE en PHP-CGI | | ---|---|--- CVE| Descripción| CVSSv3 CVE-2024-4577| Vulnerabilidad de Inyección de Argumentos en PHP-CGI| 9.8 | | "CVE-2024-4577 es una vulnerabilidad crítica de inyección de argumentos en PHP que puede ser explotada para lograr ejecución...

CVE-2025-24813-POC

JSP Web Shell Uploader A simple Python tool for uploading a basic JSP web shell to one or more targets via HTTP PUT requests. ⚠️ For educational and authorized penetration testing only. Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../...

CVE-2012-1723

Web browser drive-by that exploits CVE-2012-1723 for remote code execution. A walk-through and technical details can be found at https://ethaniel.me/2017/02/09/practice-the-past-cve-2012-1723/...

Lockdoor-Framework

Lockdoor v2.3 ⚠️ This project is not maintained anymore. ⚠️ Find more at https://g.co/kgs/TtYRJJP Table of contents Table of contents Changelog 📌 : Badges 📌 : Support me 💰 : Contributors ⭐ : Versions 06/2021 : 2.3 03/2020 : 2.2.3 Blogs & Articles 📰 : Overview 📙 : Features 📙 : Pentesting Tools...

Mythic

Mythic Un framework multiplataforma de post-explotación y red teaming construido con GoLang, Docker, docker-compose y una interfaz de navegador web. Está diseñado para proporcionar una interfaz colaborativa y fácil de usar para operadores, gerentes y generación de informes durante el red teaming...

CyberChef

CyberChef La navaja suiza del ciberespacio CyberChef es una aplicación web sencilla e intuitiva para realizar todo tipo de operaciones «cibernéticas» dentro de un navegador web. Estas operaciones incluyen codificaciones sencillas como XOR y Base64, cifrados más complejos como AES, DES y Blowfish,...

CVE-2026-10290-SQLI

Hotel and Tourism Reservation System - Unauthenticated SQL Injection in tour.php Vulnerability Details Field| Details ---|--- Title| Hotel and Tourism Reservation System - SQL Injection via tour GET Parameter Vendor| code-projects.org Vendor URL|...

vcenter-cve-2021-21980-lab

CVE-2021-21980 Vulnerable Test Environment Overview Realistic test environment simulating VMware vSphere Web Client path traversal vulnerability. ⚠️ WARNING: Vulnerable test environment. Do NOT expose to internet! Quick Start Build and Run podman build -t vcenter-lab . podman run -d -p 443:443...

open-source-web-scanners

Escáneres web de código abierto Una lista de escáneres de seguridad web de código abierto en GitHub y GitLab, ordenados por estrellas. No proporciona un análisis profundo; para más análisis o una gama más amplia de herramientas, consulte los enlaces a continuación. Tenga en cuenta que algunos...

Massive-Web-Application-Penetration-Testing-Bug-Bounty-Notes

Pruebas de Penetración, De Principiante a Experto! Esta guía está diseñada tanto para principiantes como para testers de penetración experimentados. Cubre todos los aspectos de las pruebas de penetración de aplicaciones web, incluyendo conceptos fundamentales, configuración de entornos de prueba...

weevely3

Weevely - Weaponized web shell Description Weevely is a web shell designed for post-exploitation purposes that can be extended over the network at runtime. Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks,...