Hollow

Hollow hollow è un generatore di loader per shellcode. Fornisci un binario shellcode grezzo e un profilo, e produce un loader PE Windows compilato con il tuo shellcode crittografato al suo interno. Per Iniziare I binari sono disponibili nella pagina releases, oppure compila dal sorgente:...

Cve-2026-27944-Tools-Exploit

🚀 CVE-2026-27944: Exploração de Backup Não Autenticado do Nginx UI 📌 Descrição 27944.py é uma ferramenta de exploração para CVE-2026-27944 que permite ao atacante baixar e descriptografar backups do Nginx UI sem autenticação. Esta vulnerabilidade está presente no Nginx UI versão 2.3.2 e permite...

steganography

Strumento di Steganografia per Immagini Semplice strumento C++ di crittografia e steganografia che utilizza crittografia protetta da password per proteggere il contenuto di un file, e poi lo incorpora nei dati dei pixel di un'immagine utilizzando la codifica del bit meno significativo. Per sistem...

AnonX

NOTA O script AnonX foi baseado na API pública do we-transfer e parou de funcionar após três semanas do seu lançamento. “Todas as coisas boas devem chegar ao fim, então é com o coração pesado e lágrimas contidas que devemos anunciar que vamos aposentar nossa API pública. Tempos tristes.” diz...

CVE-2025-55182-RCE-shell

CVE-2025-55182-RCE-shell Burp Suite/antsword - Shell interattiva dirottamento HTTP + POST + AES-256-CBC/BASE64 Rilevamento -dnslog Rilevamento senza output DNSLog Nuclei -poc Rilevamento Echo di vulnerabilità Sfruttamento -exp Shell interattiva echo base64 -exp2 Shell interattiva dirottamento HTT...

PhantomFS

PhantomFS ProjFS-Anbieter. Stellt Dateien bereit, deren Inhalt davon abhängt, welcher Prozess sie liest. Die Nutzlast wird AES-256-CBC-verschlüsselt auf der Festplatte gespeichert und erst zur Laufzeit im Speicher entschlüsselt. Dies sollte kein EDR umgehen, da die Nutzlast auf die Festplatte...

CVE-2026-15341

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronizesession function, hooked on init and therefore executed on every request, performs no nonce, capability, or shared-secr...

CVE-2026-15341

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronizesession function, hooked on init and therefore executed on every request, performs no nonce, capability, or shared-secr...

CVE-2026-15341 User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronizesession function, hooked on init and therefore executed on every request, performs no nonce, capability, or shared-secr...

EUVD-2026-58842

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronizesession function, hooked on init and therefore executed on every request, performs no nonce, capability, or shared-secr...

CVE-2026-15341

CVE-2026-15341 affects the WordPress plugin User Session Synchronizer (versions up to and including 1.4.0). The vulnerability arises in synchronize_session() (hooked on init) which performs no nonce, capability, or shared-secret validation for attacker-supplied ussync-key, ussync-token, and ussyn...

PT-2026-72146

Name of the Vulnerable Software and Affected Versions User Session Synchronizer versions prior to 1.4.1 Description An authentication bypass exists that can lead to account takeover. The synchronize session function, which executes on every request, fails to validate nonces, capabilities, or shar...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthenticated cryptographic key disclosure and potential RCE in all versions up to and including 0.1.3.6. The root cause is storing an encrypted options file as options-{migrate_key}.txt in wp-content/ins...

CVE-2026-13457 InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

EUVD-2026-56930

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

PT-2026-70886

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migrate key.txt in...

MAL-2026-13360 Malicious code in uzair-rajput-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...

PYSEC-2026-1807 pubnub Insufficient Entropy vulnerability

Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0;...