SerialKillerBypassGadgetCollection

SerialKiller: Collezione di Bypass Gadget Descrizione Collezione di Bypass Gadget utilizzabili nelle catene di Gadget di deserializzazione JVM per bypassare la deserializzazione difensiva degli "Look-Ahead ObjectInputStreams". Rilasciata come parte del talk RSA 2016 "SerialKiller: Silently Pwning...

vba2clr

TLDR: Solo sperimentando diversi modi per caricare assembly CLR .NET in VBA localmente e remotamente usando AppDomain.ExecuteAssembly o qualsiasi altro metodo utile dopo aver aggirato AccessVBOM l'accesso programmatico al progetto Visual Basic non è attendibile da VBA. vba2clr..vba: Imposta la...

CVE-2024-27198-RCE

Dork per la mappatura del cyberspazio Fofa root@kitploit: app="JETBRAINS-TeamCity" ZoomEye root@kitploit: app:"JetBrains TeamCity" Hunter.how root@kitploit: product.name="TeamCity" Shodan root@kitploit: http.component:"teamcity" Come usare Sto usando Python3.9. root@kitploit: pip install requests...

CVE-2026-81026

MasterStudy LMS WordPress plugin versions prior to 3.7.40 contain an unauthenticated payment bypass via PayPal IPN (Instant Payment Notification). The plugin fails to verify the amount, receiver, currency, or status of an incoming payment notification before marking the corresponding order as com...

CVE-2026-81026 MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...

CVE-2026-77010

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin (through 1.0.3 ) fails to perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code. This allows unauthenticated users to obtain a signed meeting join link for any classro...

CVE-2026-77704

The Booking for Appointments and Events Calendar (Amelia) WordPress plugin before 2.4.9 contains a missing capability check that allows authenticated customers to change the status of appointments they are booked on. This includes self-approving bookings left in a pending state and overwriting an...

CVE-2026-77010 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom,...

CVE-2026-18234

CVE-2026-18234 affects the MStore API WordPress plugin before version 4.21.1 . The vulnerability stems from two flaws in the plugin's wallet payment handling: it does not verify that the targeted order belongs to the requester, and it fails to deduct the wallet balance for most payment methods. T...

CVE-2026-76548

CVE-2026-76548 affects the User Profile Builder WordPress plugin in versions before 4.0.1 . The front-end file upload feature fails to properly restrict access, granting unauthenticated visitors capabilities normally reserved for privileged roles. This allows attackers to list the site's media li...

CVE-2026-18234 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...

CVE-2026-76548 Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...

CVE-2026-18233

CVE-2026-18233 affects the MStore API WordPress plugin before 4.21.1 . The plugin fails to verify that an order targeted by one of its delivery endpoints actually belongs to the requester. This allows any authenticated user—even those with the lowest Subscriber role—to mark arbitrary orders as co...

EUVD-2026-68047

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

CVE-2026-16947 Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to ...

MoreImpacketExamples

MoreImpacketExamples Dieses Repository enthält ein paar kurze Python-Skripte, die mit der Bibliothek Impacket erstellt wurden. Das Hauptziel dieses Projekts ist es, mir selbst und anderen zu helfen, die den Übergang von der Verwendung der mitgelieferten Impacket-Beispiele zur...

Fugu15

Fugu15 Fugu15 ist ein semi-untethered, dauerhaft signierter Jailbreak für iOS 15. Er enthält einen Code-Signing-Bypass, einen Kernel-Exploit, einen Kernel-PAC-Bypass und einen PPL-Bypass. Zusätzlich kann er über Safari installiert werden, d. h. ein Computer ist nicht erforderlich, außer für einen...

Payload-Download-Cradles

Payload Download Cradles Dies sind verschiedene Arten von Download-Cradles, die als Inspiration dienen sollen, um damit zu spielen und neue Download-Cradles zu erstellen, um AV/EPP/EDR im Kontext von Download-Cradle-Erkennungen zu umgehen. Beachte: Das Entfernen oder Verschleiern von Signaturen a...

AMSI-ETW-Patch

AMSI-ETW-Patch questa repo contiene informazioni per patchare AMSI ed ETW usando una patch a singolo byte per entrambi. L'idea era limitare il rilevamento della patch stessa dato che è un singolo byte. AMSI patch-amsi-x64.c L'idea è che AMSI esegua molti controlli di validazione prima di...

ExecASLR-ekoparty

ExecASLR - Missbrauch von Intel-Branch-Prädiktoren zur Umgehung von ASLR Was ist ASLR Address Space Layout Randomization ist eine Schutzmaßnahme, die es schwerer machen soll, Speicherkorruptionsangriffe auszunutzen. In einem Szenario einer Pufferüberlauf-Schwachstelle muss ein Angreifer, der...