92 matches found
CVE-2026-10170-RCE
Visitor Management System 1.0 – SQLi zu Remote Code Execution Angriffskette Schwachstelleninformationen...
redsun-bluehammer-undefend-detection-pack
Pacchetto di Rilevamento RedSun, BlueHammer, UnDefend e CrossFamily IMPORTANTE: Tutto il codice e la logica di rilevamento in questo repository è generata da intelligenza artificiale. Non vi è alcuna garanzia che questi script siano corretti, completi, sicuri o adatti a qualsiasi ambiente...
CyberStrikeAI
CyberStrikeAI 中文 | English The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next. CyberStrikeAI connects planning, execution, human oversight, evidence, and replay in one auditable...
CVE-2025-58434-AND-59528-POC
PoC Duale Flowise CVE — CVE-2025-58434 + CVE-2025-59528 ⚠️ Solo per scopi educativi e ricerca di sicurezza autorizzata. Eseguire questo strumento contro sistemi che non possiedi o per cui non hai autorizzazione scritta è illegale. Indice Panoramica Dettagli delle vulnerabilità CVE-2025-58434 —...
whiskeysamlandfriends
WhiskeySAML e amici TicketsPlease TicketsPlease: Libreria Python per assistere nella generazione di ticket Kerberos, recupero remoto delle configurazioni ADFS, generazione di token Golden SAML e recupero di token di accesso Azure. WhiskeySAML WhiskeySAML: Strumento proof of concept per un attacco...
ad-autopwn
AD AutoPwn Null-Authentifizierung zu Domain-Administrator — Automatisierte Active-Directory-Angriffskette Ein vollautomatisiertes Penetrationstest-Tool, das 25+ Angriffstechniken zu einer Kette verknüpft, um Active-Directory-Umgebungen zu kompromittieren. Entwickelt für autorisierte...
Zero-Day-Legacy
🎓 Abschlussprojekt — Ajloun National University ANU Fakultät für IT · Cybersicherheit und Cloud Computing · Studienjahr 2026 🏆 Höchste Note der Universität: 97% 📖 Überblick Zero-Day Legacy ist eine realistische, absichtlich verwundbare Boot-to-Root CTF Capture The Flag Labor-Maschine, die als...
soc-investigation-powershell-edrfreeze
Indagine su PowerShell/EDRFreeze Caso di studio LetsDefend Questa repository contiene un'indagine SOC documentata basata su uno scenario LetsDefend che coinvolge attività PowerShell sospetta, un payload ospitato su GitHub e l'esecuzione dello strumento EDRFreeze. Cosa include questa repository...
CVE-2021-3456
CVE-2021-3456 Una catena pratica che inizia con un innocuo file PDF e termina con una reverse shell su un'istanza AWS EC2 L'Inizio: Creare un Payload PDF Tutto inizia sul fronte dell'attacco. Utilizzando l'oggetto WScript integrato di PowerShell, incorporiamo uno script all'interno di un PDF che...
SniperRoost
SniperRoost Wird verwendet, um eine gültige Angriffskette zu generieren, die CVE-2017-11774 ausnutzt, verbunden mit der iranischen APT. Nur zu Forschungszwecken PoC. Bitte nicht für schädliche Zwecke verwenden...
PYSEC-2026-1348 Fides' Admin UI User Password Change Does Not Invalidate Current Session
Summary Admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors such as XSS can maintain access even after password reset. This issue is not directly...
AI is accelerating cyberattacks—here’s how to stay ahead
In March, we wrote that identity security has become the new pressure point for modern cyberattacks. Since then, AI has only increased that pressure. AI helps cyberattackers move faster across the attack chain: personalizing social engineering at scale, automating reconnaissance, analyzing leaked...
claude-security-scanner
🇨🇳 ⚡ bash git clone https://github.com/290298661...
HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics
Modern alert-triage systems reduce SOC burden by filtering false positives, but flagging a high-risk alert is only the start of incident response. Threat hunting requires reconstructing causal attack chains across heterogeneous, partially corrupted logs. Against APTs using anti-forensics parent-P...
When prompts become shells: RCE vulnerabilities in AI agent frameworks
In this article 1. A representative case study: Semantic Kernel 2. CVE-2026-26030: In-Memory Vector Store 3. CVE-2026-25592: Arbitrary file write through SessionsPythonPlugin 4. The vulnerability 5. Attack chain overview 6. Defending the agentic edge 7. Not bugs, but developed by design 8. CTF...
When prompts become shells: RCE vulnerabilities in AI agent frameworks
In this article 1. A representative case study: Semantic Kernel 2. CVE-2026-26030: In-Memory Vector Store 3. CVE-2026-25592: Arbitrary file write through SessionsPythonPlugin 4. The vulnerability 5. Attack chain overview 6. Defending the agentic edge 7. Not bugs, but developed by design 8. CTF...
CVE-2026-40175
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This...
CVE-2026-40175
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This...