39513 matches found
EUVD-2026-87651
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP...
EUVD-2026-87650
stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...
EUVD-2026-87764
Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...
CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass
Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...
EUVD-2026-87715
Capgo CLI npm package @capgo/cli through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CANMANAGEDRAFTAPPSGLOBAL...
EUVD-2026-87707
Capgo capgo.app through version 12.261.0 contains an incomplete access-control fix for the public.ssoproviders table. Migration 20260826100000ssoprovidersblockdirectactiveinsert.sql installs a BEFORE UPDATE guard enforcessoproviderclientupdateguard that freezes only the dnsverifiedat, domain,...
EUVD-2026-87702
Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including...
smartbrute
Description The smart password spraying and bruteforcing tool for Active Directory Domain Services. ⚠️ This project works. But the filthy coding makes it more PoC than a stable tool. I may or may not rewrite this in the future, but at least you have everything here to work with bruteforce on any...
DblTekGoIPPwn
DblTekGoIPPwn Tool to exploit challenge response system in vulnerable DblTek GoIP devices. Can generate responses to specified challenges, test hosts for the vulnerability, run commands on vulnerable hosts, send SMS messages from a host, and drop into a root shell on any vulnerable host. The...
Whisker
Whisker Whisker is a C tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account. This tool is based on code from DSInternals by Michael Grafnetter @MGrafnetter. For this...
CVE-2023-43149
CVE-2023-43149 作者 : Aitor Herrero Fuentes ベンダー: SPA-Cart ベンダーホームページ: https://spa-cart.com/ ソフトウェアリンク: https://demo.spa-cart.com/admin バージョン: 1.9.0.3 テスト環境: Windows 10 Pro CSRF ルートアカウント追加 demo.spa-cart.com...
juicy-potato
Juicy Potato 황금 권한 남용 RottenPotatoNG의 달콤한 버전으로, 약간의 주스가 첨가되었습니다. 즉, Windows 서비스 계정에서 NT AUTHORITY\SYSTEM으로의 또 다른 로컬 권한 상승 도구 입니다 요약 RottenPotatoNG 및 그 변종은 BITS 서비스가 127.0.0.1:6666에서 MiTM 리스너를 가지고 있고 SeImpersonate 또는 SeAssignPrimaryToken 권한이 있을 때의 권한 상승 체인을 활용합니다. Windows 빌드 검토 중에 BITS가 의도적으로 비활성화...
CVE-2018-20555
CVE-2018-20555 Design Chemical社製のWordPressプラグイン「Social Network Tabs」は、ユーザーのTwitterのaccesstoken、accesstokensecret、consumerkey、consumersecretを2回漏洩させており、これによりTwitterアカウントが乗っ取られる可能性があります。 これは、Twitterウィジェットが表示されるページ内の以下のコード行によって引き起こされます： root@kitploit: jQuerydocument.readyfunction $ var config =...
Bluto
BLUTO DNS Recon | Brute Forcer | DNS Zone Transfer | DNS Wild Card Checks | DNS Wild Card Brute Forcer | Email Enumeration | Staff Enumeration | Compromised Account Enumeration | MetaData Harvesting Author: Darryl Lane | Twitter: @darryllane101 https://github.com/darryllane/Bluto Like Bluto? Give...
ios-mac-app
Proton VPN for iOS and macOS Copyright c 2025 Proton Technologies AG 依存関係 このプロジェクトは、すべての依存関係に Swift Package Manager を使用しています。ターゲットを実行する前に、Xcode でパッケージを解決できるようにしてください。 サードパーティの依存関係 ACKNOWLEDGEMENTS.md セットアップ お使いのマシンで Git LFS を有効にしてください このリポジトリをクローンしてください サブモジュールもクローンしてください git submodule init + git...
fbchecker
ABANDONED Facebook block multiple access with their API FACEBOOK MASS ACCOUNT CHECKER Facebook Mass Account Checker Without Locked Account Simple Installation : root@kitploit: apt install git php -y git clone https://github.com/fdciabdul/fbchecker cd fbchecker php fbcheck.php Usage root@kitploit:...
fbchecker
폐기됨 페이스북이 API를 통한 다중 접근을 차단함 페이스북 대량 계정 체커 잠금 계정 없이 페이스북 대량 계정 체커 간단한 설치 : root@kitploit: apt install git php -y git clone https://github.com/fdciabdul/fbchecker cd fbchecker php fbcheck.php 사용법 root@kitploit: php fbcheck.php target.txt 웹사이트 : taqinwebs...
socid-extractor
socidextractor 모든 공개 프로필 페이지를 구조화된 계정 레코드로 변환하세요. 사용자 이름, 표시 이름, 바이오, 아바타, 위치, 가입일, 팔로워 수, 외부 링크, 그리고 이름 변경, 재설계, 삭제 후에도 계정을 고유하게 식별하는 안정적인 내부 식별자 까지 포함합니다. socidextractor는 130개 이상의 플랫폼에서 HTML 페이지와 API 응답을 파싱하여 평평한 기계 판독 가능 계정 필드 딕셔너리를 반환합니다. API 키가 필요 없고, 헤드리스 브라우저도 필요 없습니다. 응답 텍스트에 대한 단일 함수 호출만...
LetsDefend-SOC235-Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515-EventID-197
LetsDefend-SOC235-Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515-EventID-197 私は、CVE-2023-22515（Atlassian Confluence のゼロデイ脆弱性）の悪用試行の可能性を示す重大度の高いアラートに直面しました。このアラートは、外部 IP から Confluence サーバーを狙った不審な GET リクエストを示しており、不正な管理者アクセスを獲得しようとする試みが示唆されました。 この脆弱性により、攻撃者は細工したリクエストを Confluence...