vuln-bank-mobile

💳 App mobile Vulnerable Bank Vulnerable Bank è un'applicazione mobile volutamente insicura progettata per ingegneri della sicurezza, penetration tester e studenti di sicurezza delle app mobili per esercitarsi e dimostrare lo sfruttamento reale di pratiche di codifica insicure. Questa app mobile...

CVE-2025-29015

CVE-2025-29017 - Internet Banking System 2.0.0 Stored XSS em pagesaccount.php Descrição Existe uma vulnerabilidade de Cross-Site Scripting XSS Armazenado no Code Astro Internet Banking System 2.0.0 através do parâmetro name em /admin/pagesaccount.php. Código JavaScript malicioso pode ser injetado...

CVE-2025-29018

CVE-2025-29018 - Sistema Bancario Online 2.0.0 XSS Archiviato in pagesaddacctype.php Descrizione Una vulnerabilità Cross-Site Scripting XSS Archiviato è presente in Code Astro Internet Banking System 2.0.0 a causa di input non sanitizzato nel parametro name in pagesaddacctype.php. Gli aggressori...

zeek-gozi-detector

Gozi Malware Detector Este pacote Zeek detecta atividade do malware bancário Gozi. Recursos: Os arquivos RAR que este pacote procura foram discutidos nos seguintes artigos: https://unit42.paloaltonetworks.com/march-wireshark-gozi-answers/...

CVE-2025-14221

Beschreibung 1. CVE-2025-14221 2. Entdecker: Fatma Trabelsi 3. Anbieter des Produkts: SourceCodester 4. Betroffenes Produkt: Online Banking System 1.0 POC In der Funktion zur Aktualisierung des Benutzerprofils der Anwendung besteht eine Schwachstelle bezüglich gespeichertem Cross-Site-Scripting...

CVE-2024-56924

CVE-2024-56924 Descrizione della vulnerabilità Una vulnerabilità di Cross-Site Request Forgery CSRF esiste nel sistema Internet Banking "astro" versione 2.0.0, che consente a un attaccante remoto di effettuare azioni non autorizzate per conto di utenti autenticati, come gli amministratori, senza...

CVE-2026-21978

CVE-2026-21978 La mia CVE in Oracle FLEXCUBE Universal Banking Link: https://www.oracle.com/security-alerts/cpujan2026.html...

Exploiting-CVE-2021-44228-Log4Shell-in-a-Banking-Environment

Sfruttamento di CVE-2021-44228 Log4Shell in un Ambiente Bancario Obiettivo: Dimostrare lo sfruttamento della vulnerabilità Log4Shell CVE-2021-44228 all'interno di un ambiente applicativo bancario simulato. Ambito: 1: Configurare un'applicazione bancaria vulnerabile utilizzando Apache Log4j...

CVE-2025-29017

CVE-2025-29017 - Esecuzione di codice remoto tramite caricamento immagine profilo in Internet Banking System 2.0.0 Descrizione Esiste una vulnerabilità di Esecuzione di Codice Remoto RCE in Code Astro Internet Banking System 2.0.0 a causa di una convalida impropria del caricamento dei file nel...

vuln-bank

Applicazione Bancaria Vulnerabile 🏦 Un'applicazione web deliberatamente vulnerabile per esercitarsi nel testing della sicurezza applicativa di Web, API e LLM, nella revisione sicura del codice e nell'implementazione della sicurezza nelle pipeline CI/CD. ⚠️ AVVISO: Questa applicazione è...

Qakbot

Questo repository non contiene un README...

CVE-2026-77780 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

Cybersecurity researchers have shed light on an updated version of ToxicPanda aka TgToxic that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. Zimperium zLabs, in a Wednesday report, said the Android malware also features...

EQGRP_Lost_in_Translation

EQGRP Lost in Translation Contenuto decriptato di odd.tar.xz.gpg, swift.tar.xz.gpg e windows.tar.xz.gpg Scaricato da https://yadi.sk/d/NJqzpqo3GxZA4 Post originale dei ShadowBrokers https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation windows : contiene exploit, implant e paylo...

CVE-2026-19870

Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company in the instance, and users holding the create...

Security Bulletin:Multiple security vulnerabilities in IBM Process Automation Manager Open Edition Starter Kit for Banking

Summary In addition to many updates of operating system level packages, Multiple vulnerabilities were addressed in IBM Process Automation Manager Open Edition Starter Kit for Banking -9.4.2 Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fai...

EUVD-2026-47418

Vulnerability in the Oracle Banking Origination product of Oracle Financial Services Applications component: Configuration. The supported version that is affected is 14.5.0.16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2026-47316

Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications component: Infrastructure. Supported versions that are affected are 14.6.0-14.8.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-47313

Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications component: Infrastructure. Supported versions that are affected are 14.6.0-14.8.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-47308

Vulnerability in the Oracle Banking Trade Finance Process Management product of Oracle Financial Services Applications component: Common. Supported versions that are affected are 14.6.0-14.8.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...