3605 matches found
waf-checker
Una potente aplicación web para probar qué tan bien protege tu Cortafuegos de Aplicaciones Web WAF contra vectores de ataque comunes. → waf-checker.com ← Características Pruebas de seguridad 19+ categorías de ataque listas para usar: Inyección SQL, XSS, Path Traversal, Inyección de Comandos, SSRF...
macphish
macphish Office for Mac Macro Payload Generator Attack vectors There are 4 attack vectors available: beacon creds meterpreter meterpreter-grant For the 'creds' method, macphish can generate the Applescript script directly, in case you need to run it from a shell. beacon On execution, this payload...
kube-alien
Kube-alien This tool launches attack on k8s cluster from within. That means you already need to have an access with permission to deploy pods in a cluster to run it. After running the kube-alien pod it tries to takeover cluster's nodes by adding your public key to node's /root/.ssh/authorizedkeys...
graphql-threat-matrix
GraphQL 威胁矩阵 为什么使用 graphql-threat-matrix？ graphql-threat-matrix 专为漏洞赏金猎人、安全研究人员和黑客打造，旨在帮助发现多种 GraphQL 实现中的漏洞。 不同 GraphQL 实现如何解释和遵循 GraphQL 规范的差异，可能导致安全漏洞和独特的攻击向量。通过分析和比较不同实现中驱动安全风险的因素，GraphQL 生态系统可以做出更安全的部署决策，并共同提升所有实现的安全成熟度。 图例 ✅ - 默认启用 ⚠️ - 默认禁用 ❌ - 不支持 实现 | 验证 | 字段建议 | 查询深度限制 | 查询成本分析 | 自动持久化查询...
web-check
Web-Check Inteligencia de código abierto integral y bajo demanda para cualquier sitio web 🌐web-check.xyz Con el amable apoyo de: NinjaPear API para obtener perfiles B2B completos desde cualquier URL | Hostinger Despliega Web-Check con un solo clic en Hostinger | Warp Diseñado para programar con...
CVE-2021-29156
CVE-2021-29156 done right This Proof of Concept is realized because the other PoC publicly available is broken ✨ Install go install github.com/5amu/CVE-2021-29156@latest References https://nvd.nist.gov/vuln/detail/CVE-2021-29156 https://portswigger.net/research/hidden-oauth-attack-vectors...
CVE-2018-7600
POC de CVE-2018-7600 Drupal RCE CVE-2018-7600 ¡No olvides poner tu dirección en el script ! Descripción: Existe una vulnerabilidad de ejecución remota de código en múltiples subsistemas de Drupal 7.x y 8.x. Esto potencialmente permite a los atacantes explotar múltiples vectores de ataque en un...
Windows-RCE-exploits
Mi otro repositorio de GitHub para pruebas de proveedores contra ataques sin archivos - https://github.com/smgorelik/VendorSimTestScripts Windows-RCE-exploits La base de datos de muestras de exploits es un repositorio de exploits de RCE ejecución remota de código y Pruebas de Concepto para WINDOW...
CVE-2018-7600.
Informe de análisis de Drupal RCE de IGLOO Corp, Won Chi Hyun Drupal RCE CVE-2018-7600 ¡No olvides poner tu dirección en el script! Descripción: Existe una vulnerabilidad de ejecución remota de código en múltiples subsistemas de Drupal 7.x y 8.x. Esto potencialmente permite a los atacantes explot...
CVE-2026-67316
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...
CVE-2026-7232
The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'parameter name' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
EUVD-2026-46610
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to...
CVE-2026-8476 Disk Cache Deserialization Remote Code Execution Vulnerability
IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads function to deserialize cached objects from disk without validation, integrity verification, or...
Hackers Use Fake Claude Code Guide and AI PDFs to Spread AsyncRAT Malware
Hackers are using fake Claude Code guide and AI PDFs to spread AsyncRAT malware via Windows attack using PowerShell and Defender exclusions...
Important: postgresql
Issue Overview: Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets, PQfn..., resultisint=0, ... stores...
Exploit for CVE-2019-5513
VMware Horizon /broker/xml Vulnerability Scanner !Security...
PT-2026-42695
Name of the Vulnerable Software and Affected Versions Plonky3 versions prior to 0.4.3 Plonky3 versions prior to 0.5.3 Description An attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This...
Malicious code in ethers-wallet-packages (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beda1480a40189cc8177ace4e3d6fd9773ad81f4cbe5a6c07e3004427846dc8d The package impersonates the legitimate @ethersproject/wallet source files are otherwise verbatim copies, including the internal version string...
Toward Securing AI Agents like Operating Systems
Autonomous agents based on large language models LLMs are rapidly emerging as a general-purpose technology, with recent systems such as OpenClaw extending their capabilities through broad tool use, third-party skills, and deeper integration into user environments. At the same time, these agentic...
