ProtOSINT

ProtOSINT ProtOSINT is a Python script that helps you investigate Proton Mail accounts. Version This is ProtOSINT v2. The first version has been around for a few years, but Proton's API changed and the old checks stopped working, so this is a rewrite that brings the tool back to life. Big thanks ...

Bluto

BLUTO DNS Recon | Brute Forcer | DNS Zone Transfer | DNS Wild Card Checks | DNS Wild Card Brute Forcer | Email Enumeration | Staff Enumeration | Compromised Account Enumeration | MetaData Harvesting Author: Darryl Lane | Twitter: @darryllane101 https://github.com/darryllane/Bluto Like Bluto? Give...

weevely3

Weevely - Weaponized web shell Description Weevely is a web shell designed for post-exploitation purposes that can be extended over the network at runtime. Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks,...

sherlock

Encuentra cuentas de redes sociales por nombre de usuario en más de 400 redes sociales Instalación • Uso • Contribuir Instalación !WARNING Los paquetes para ParrotOS y Ubuntu 24.04, mantenidos por un tercero, parecen estar rotos. Los usuarios de estos sistemas deberían usar uv/pipx/pip o Docker...

MSOLSpray

MSOLSpray A password spraying tool for Microsoft Online accounts Azure/O365. The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled. BE VERY CAREFUL NOT TO LOCKOUT...

Scythe

Scythe scythe: enumerador de cuentas root@kitploit: El Enumerador de Cuentas está diseñado para facilitar la realización de enumeración de cuentas como parte de pruebas de seguridad. El framework ofrece la capacidad de crear fácilmente nuevos módulos archivos XML y acelerar el proceso de pruebas...

SSH-account-enumeration-verification-script

SSH-account-enumeration-verification-script SSH account enumeration verification scriptCVE-2018-15473...

EUVD-2026-83712

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email...

sterraxcyl

- S T E R R A - A unique SOCMINT tool to get informations on an instagram account from its following | followers...

CVE-2026-92915

WWBN AVideo through commit e01e41ecc no patched version available contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement $global'ignoreUserMustBeLoggedIn' = 1, takes usersid directly from the query string, and calls User::sendVerificationLi...

CVE-2026-92915

WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement, accepts users_id directly from the query string, and calls User::sendVerificationLink() with no session, CSRF, or ra...

CVE-2026-92915 WWBN AVideo userVerifyEmail.php Unauthenticated Access Control

WWBN AVideo through commit e01e41ecc no patched version available contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement $global'ignoreUserMustBeLoggedIn' = 1, takes usersid directly from the query string, and calls User::sendVerificationLi...

CVE-2026-91972

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding...

CVE-2026-91972 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding...

CVE-2026-91972

Vikunja versions before 2.6.0 fail to apply rate limiting to the /api/v2 public authentication endpoints (login, register, password-reset, and OAuth token routes). Remote unauthenticated attackers can perform unbounded credential guessing , account enumeration , and password-reset flooding withou...

CVE-2026-89173

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

CVE-2026-85210

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with openaccess, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filtercriterion parameters to retrieve usernames holding specific roles, banned flags, an...

EUVD-2026-70488

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with openaccess, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filtercriterion parameters to retrieve usernames holding specific roles, banned flags, an...

CVE-2026-82449

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...