CBM

汽车后门制作器 Car Backdoor Maker 是一款用于制作攻击模板并将其加载到 The Bicho 的软件。 开始之前，请阅读如何 获取 The Bicho 硬件。 截图 安装与使用 本项目有自己的 维基，你可以在其中找到以下有用的文档： 安装 从源码编译 在 Linux 上运行 在 Windows 上运行 连接 The Bicho 基本设置 设置 CAN 帧 保存攻击模板 恢复攻击模板 高级设置 电话号码过滤器 停止命令 高级功能 杀死 ECU 帧 GPS 写入 The Bicho 内存 检查更新 免责声明 我们对不良使用不承担任何责任。 作者 Sheila A. Berta...

KubeStalk

KubeStalk KubeStalk 是一款从黑盒视角发现 Kubernetes 及关联基础设施攻击面的工具。该工具是在 Project Resonance - Wave 9 期间用于探测互联网上不安全 Kubernetes 集群的社区版本。 使用方式 下面的 GIF 演示了该工具的使用方式： 安装 KubeStalk 使用 Python 编写，需要 requests 库。 要安装该工具，你可以将仓库克隆到任意目录： git clone https://github.com/redhuntlabs/kubestalk 克隆后，你需要使用 python3 -m pip install...

cve_2024_0044

CVE 2024 0044 CVE-2024-0044, identificada en la función createSessionInternal del archivo PackageInstallerService.java, es una vulnerabilidad de alta gravedad que afecta a Android versiones 12 y 13. Esta vulnerabilidad permite a un atacante realizar un ataque "run-as any app", lo que conduce a un...

mfoc

MFOC es una implementación de código abierto del ataque "offline nested" de Nethemba. Este programa permite recuperar claves de autenticación de la tarjeta MIFARE Classic. Ten en cuenta que MFOC solo puede recuperar claves del objetivo si tiene una clave conocida: la predeterminada incorporada en...

EUVD-2026-88618

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-102244 MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-102244

MODSetter SurfSense versions up to 0.0.36 are vulnerable to a server-side request forgery (SSRF) flaw within the Document Export Feature . The vulnerability exists in an unspecified function located in surfsense_backend/app/routes/editor_routes.py. This flaw allows for remote manipulation that ca...

security-harness

Security Harness Un arnés de revisión de seguridad de aplicaciones multiagente para Claude Code y, más adelante, otros agentes de IA. Una habilidad de enrutador despacha a un pipeline completo de seguridad ofensiva que mapea una base de código, caza vulnerabilidades con una base de conocimiento p...

sshhipot

Version 2 is under development. Please switch to the v2 branch, build, and run with -h. SSHHiPot High-interaction SSH honeypot ok, it's really a logging ssh proxy. Still more or less a work-in-progress. Feel free to go install this repository if you'd like to try it. Run it with -h to see more...

CVE-2026-102243 MODSetter SurfSense MCP Connector Integration test command injection

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

CVE-2026-102243

A command injection vulnerability exists in MODSetter SurfSense up to version 2.0.3 . The flaw resides in the MCP Connector Integration component, specifically involving unknown processing of the /api/search-source/connectors/mcp/test file. This vulnerability allows for remote attacks. While the ...

EUVD-2026-88609

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

CVE-2026-102243 MODSetter SurfSense MCP Connector Integration test command injection

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

PHP-CGI-INTERNAL-RCE

PHP-CGI-INTERNAL-RCE Este PoC demuestra cómo un atacante puede encadenar Orange Tsai's CVE-2024-4577 con DNS rebinding para lograr ejecución remota de código en infraestructura de red interna directamente a través del navegador web de la víctima. Al eludir la Política del Mismo Origen SOP y...

wp_drupal_timing_attack

wpdrupaltimingattack Python 脚本，利用 CVE-2014-9016 和 CVE-2014-9034。 仅用于合法目的。...

CVE-2026-102240

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/networktools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has be...

CVE-2026-101858

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

CVE-2026-101860

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack...

CVE-2026-101859

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

EUVD-2026-88607

A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file /lib/functions/backupcommon.sh of the component Backup/Restore. This manipulation of the argument aespass causes use of hard-coded cryptographic key . It is possible to initiate...