EUVD-2026-91674

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service...

CVE-2024-9162

CVE-2024-9162 All-in-One WP Migration and Backup SELECT optionname,optionvalue FROM wpoptions WHERE optionname='ai1wmsecretkey'; +------------------+--------------+ | optionname | optionvalue | +------------------+--------------+ | ai1wmsecretkey | PwrqqK3UHQJo | +------------------+-------------...

all-my-collection-repos

Все проекты по сбору ресурсов: Все инструменты с открытым исходным кодом по безопасности, которые я собрал: sec-tool-list: Более 21К. В форматах Markdown и Json. Репозитории с коллекциями ресурсов безопасности GitHub: 1000+ репозиториев GitHub по сбору ресурсов безопасности. Ресурсы по...

CVE-2026-105138

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

acltoolkit

acltoolkit acltoolkit est un couteau suisse pour les abus ACL. Il implémente de multiples abus ACL. Table des matières acltoolkit Table des matières Installation Utilisation Commandes get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation pip instal...

CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

EUVD-2026-94309

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2026-105138

The Obot platform versions 0.12.0 before 0.26.2 is vulnerable to a credential exposure flaw in the MCP Catalog Entry API . Due to insufficiently protected credentials, authenticated basic users with access to an entry can perform a GET request to /api/all-mcps/entries/{entry_id}. This action allo...

CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2024-34470

CVE-2024-34470 PoC и массовый сканер Обзор Это proof-of-concept PoC и массовый сканер для CVE-2024-34470: уязвимость Path Traversal в HSC Mailinspector затрагивает все версии до 5.2.18. Как использовать PoC в действии: Сканирование одной цели Для сканирования одного IP-адреса цели: python...

VHostScan

VHostScan Un scanner d'hôtes virtuels pouvant être utilisé avec des outils de pivotement, pour détecter les scénarios de type « catch-all », les alias et les pages par défaut dynamiques. Présenté pour la première fois à SecTalks BNE en septembre 2017 diaporama. Il s’agit d’une version améliorée d...

raspberrypi-setup

Configuration Raspberry Pi Ce playbook Ansible est conçu pour configurer rapidement votre Raspberry Pi. Il est compatible avec tous les modèles. Il a été testé avec succès sur plusieurs modèles, notamment le Pi Zero W, Pi Zero 2W et Pi 4B, entre autres. Le playbook devrait bien fonctionner sur...

wifiphisher

About Wifiphisher is a rogue Access Point framework for conducting red team engagements or Wi-Fi security testing. Using Wifiphisher, penetration testers can easily achieve a man-in-the-middle position against wireless clients by performing targeted Wi-Fi association attacks. Wifiphisher can be...

paskto

Paskto - Passive Web Scanner Paskto will passively scan the web using the Common Crawl internet index either by downloading the indexes on request or parsing data from your local system. URLs are then processed through Nikto and known URL lists to identify interesting content. Hash signatures are...

FinalRecon

Twitter - Telegram - thewhiteh4t's Blog FinalRecon — это универсальное средство автоматической веб-разведки , написанное на Python. Цель FinalRecon — предоставить обзор цели за короткое время, сохраняя при этом точность результатов. Вместо выполнения нескольких инструментов один за другим он...

CVE-2021-41773

CVE-2021-41773 CVE-2021-41773 POC с Docker Конфигурация Чтобы настроить файл httpd.conf, измените строку 251 в разделе с Require all denied на Require all granted. AllowOverride none Require all granted Создайте Dockerfile в вашем проекте FROM httpd:2.4.49 COPY ./httpd.conf...

yakit

Yakit – Plateforme de test de sécurité applicative interactive Consulter le livre blanc • Documentation officielle • Retours / Problèmes • Accéder au site officiel • Rejoindre la communauté • Architecture du projet :book:Choix de la langue : English • 中文 Introduction à Yakit La fusion sécurisée e...

exploit-CVE-2024-25723

Exploit pour CVE-2024-25723 Ce dépôt est dédié à l'adresse de CVE-2024-25723, une vulnérabilité de sécurité critique dans ZenML, avec une preuve de concept PoC éducative fournie pour illustrer le problème et encourager une correction rapide. La PoC montre comment un utilisateur non autorisé...

WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting

WordPress Select All Categories and Taxonomies plugin before 1.3.2 contains a cross-site scripting vulnerability. The settings page of the plugin does not properly sanitize the tab parameter before outputting it back. An attacker can inject arbitrary script in the browser of an unsuspecting user ...

All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path. This makes it possible for unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage...