EUVD-2026-109586

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /deletetransac.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been made public and could ...

AzureRedOps

AzureRedOps A Swiss Army tool for Azure / Entra ID red teaming. Author: Mr.Un1k0d3r TrueCyber Inc Version: 0.1 Language: Python 3.12+ Overview AzureRedOps is a offensive security toolkit for assessing the security posture of Microsoft Entra ID and Azure tenants. It wraps the most common red-team...

MAAD-AF

MAAD Attack Framework MAAD-AF is an open-source cloud attack tool for Microsoft 365 & Entra IDAzure AD environments. MAAD-AF offers simple, fast and effective security testing. Validate Microsoft cloud controls and test detection & response capabilities with a virutally zero-setup process, comple...

ASSAMEE

ASSAMEE ASSAMEE is a free advanced encryption tool that can be used to encrypt files and directories and store them on Anonfiles.com. It uses AES-256 encryption, which is a strong and secure encryption method. To access the encrypted files, a download ID is required to decrypt and download the da...

FOXCMS-CVE-2025-29306-POC

FOXCMS Parameter Injection RCE – CVE-2025-29306 This repository contains a Python-based PoC for a Remote Code Execution RCE vulnerability affecting FOXCMS v1.2, a Chinese open-source content management system. CVE-ID: CVE-2025-29306 Affects: FOXCMS v1.2 Type: Service Parameter Injection → Code...

CVE-2021-42668

cve-2021-42668 CVE-2021-42668 - SQL Injection vulnerability in the Engineers online portal system. Technical description: An SQL Injection vulnerability exists in the Engineers Online Portal. An attacker can leverage the vulnerable "id" parameter in the "myclassmates.php" web page in order to...

EntraGoat

EntraGoat - A Deliberately Vulnerable Entra ID Environment EntraGoat is a deliberately vulnerable Microsoft Entra ID infrastructure for security professionals. Deploy real-world identity misconfigurations and privilege escalation paths in your own tenant, then practice exploiting them in a safe,...

CVE-2024-32370

CVE-2024-32370 Vulnerability Description Issue An issue in HSC Cybersecurity HSC Mailinspector version 5.2.17-3 has been identified, allowing a remote attacker to obtain sensitive information via a crafted payload to the id parameter in the mliSystemUsers.php component. Vulnerable Component...

mitaka

Mitaka Mitaka is a browser extension that makes your OSINT Open Source Intelligence search & scan easier. Key features: Auto IoC indicators of compromise selection with refanging. E.g. example.com to example.com, testatexample.com to [email protected], hxxp://example.com to http://example.co...

GHunt

🌐 GHunt Online version : https://osint.industries 🐍 Now Python 3.13 compatible ! 😊 Description GHunt v2 is an offensive Google framework, designed to evolve efficiently. It's currently focused on OSINT, but any use related with Google is possible. Features : CLI usage and modules Python library...

EntraFalcon

EntraFalcon EntraFalcon is a PowerShell-based assessment tool for pentesters, security analysts, and system administrators to evaluate the security posture of a Microsoft Entra ID environment. Designed for ease of use, EntraFalcon runs on PowerShell 5.1 and 7, supports both Windows and Linux, and...

Azure

Azure Offensive Security Toolkit A collection of Bash and PowerShell scripts for Azure security assessments, covering IAM privilege escalation, container security, Key Vault exposure, Entra ID configuration, and more. Designed to run in Azure Cloud Shell or any authenticated terminal. Scripts IAM...

bola-CVE-2023-27524

bola-CVE-2023-27524 📄 README.md — BOLA CVE-2023-27524 Demo Project 🔐 Broken Object Level Authorization BOLA Demonstration CVE-2023-27524 Security Analysis & Fix --- 📌 Project Overview This project demonstrates a real-world Broken Object Level Authorization BOLA vulnerability and its secure...

the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602 — phpIPAM 1.8.2 REST API Authentication Bypass Unauthenticated authentication bypass in the phpIPAM REST API, caused by an object-cache key collision: the database row cached while resolving an API app's appid satisfies the subsequent appcode token check whenever the supplied token...

BlueKeep

Bluekeep PoC This repo contains research concerning CVE-2019-0708. Bluekeep or CVE-2019-0708 is an RCE exploit that effects the following versions of Windows systems: Windows 2003 Windows XP Windows Vista Windows 7 Windows Server 2008 Windows Server 2008 R2 The vulnerability occurs during...

AzureAD-Attack-Defense

Attack and Defense Playbook for Microsoft Entra This publication is a collection of various common attack scenarios on Microsoft Entra and how they can be mitigated or detected. All of the included scenarios, insights and comments are based on experiences from the contributors during their attack...

BadZure

BadZure BadZure is a Python tool that automates the creation of misconfigured Azure environments, enabling security teams to simulate adversary techniques, develop and test detection controls, and run purple team exercises across Entra ID and Azure infrastructure. It uses Terraform to populate...

CVE-2025-65670

CVE-2025-65670 An Insecure Direct Object Reference IDOR in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the...

CVE-2026-66384

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

CacheData_decrypt

CacheDatadecrypt A simple Toolkit to BF and decrypt Windows EntraId CacheData. usage: decryptcachedata.py -h pin,password ... CacheData bruteforcer. On a live windows host, to copy the folders with all subfolders and files: xcopy /H /E /G /C as SYSTEM. The script will automatically iterates on ea...