exploitarium

https://discord.gg/WytKH65ZR join up for research, help, documentation, and more useful information for those interested. Statement This repo was incomplete when published. In regard to AI usage, my fuzzing workflow was automated by AI with a strict workflow. I used GPT-5.3 for ALL the fuzzing, a...

CVE-2022-40684

CVE-2022-40684 CVE-2022-40684 단일 또는 배치 exp 사용 방법 공개 키 생성 python3 exp.py -u ip:port -k idrsa2048.pub -l hosts.txt로 파일 지정 일괄 실행 FOFA title="FortiGate"...

saas_enum

SaaS Enum SaaS Enum은 회사가 사용 중일 수 있는 SaaS 플랫폼을 발견하기 위한 명령줄 도구입니다. 이 도구는 알려진 공급자 패턴과 일치하는 DNS 항목을 찾고, 선택적으로 경량 HTTP 확인을 수행하여 확인합니다. 설치 pip install -r requirements.txt 사용법 기본 확인 회사의 짧은 이름서브도메인을 입력하여 모든 공급자에 대해 테스트합니다: python saasenum.py -i example 배치 모드 파일에서 여러 회사를 처리하고 결과를 CSV로 저장합니다: python...

pdbdownload

Portable ExecutablePE 파일과 연결된 PDB 파일을 다운로드하는 유틸리티입니다. 기능 msdl.microsoft.com에서 PDB 심볼을 다운로드합니다. 단일 또는 여러 개의 PortableExecutablePE 파일을 처리합니다. 데모 https://github.com/user-attachments/assets/095fb528-65a6-488e-bfa0-46101738a451 사용법 $./pdbdownload-linux-amd64 -h pdbdownload v1.0 - by Remi GASCOU...

Open-Redirect-Finder

Open-Redirect-Finder Open Redirect Finder 는 URL에서 오픈 리디렉션 취약점을 탐지하는 자동화 도구입니다. 기능 일괄 처리: 입력 파일에서 여러 URL을 한 번에 테스트할 수 있습니다. 자동 검증: 입력된 URL이 오픈 리디렉션에 취약한지 확인합니다. 페이로드 옵션: 기본 페이로드 옵션 1: 코드에 포함된 페이로드만 사용합니다. 사용자 정의 페이로드 옵션 2: 사용자가 custom.txt 파일을 통해 입력한 사용자 정의 페이로드를 사용합니다. 기본 및 사용자 정의 페이로드 결합 옵션 3: 기본...

Stego-Lab

Stego-Lab Стеганография. EXIF. Водяные знаки. Декодирование. Пакетная обработка. Профессиональные рабочие процессы для конфиденциальности изображений на iPhone, iPad и macOS. Веб-сайт · GitLab · Страница проекта · Политика конфиденциальности · Пресс-кит · Поддержка · Лицензия Почему Stego-Lab...

CVE-2026-11961

CVE-2026-11961 WordPress User Registration & Membership 플러그인에 영향을 주는 CVE-2026-11961 용 대량 익스플로잇 도구. 기능 플러그인 버전 탐지 단일 대상 지원 일괄 대상 처리 멀티스레드 지원 무작위 또는 사용자 지정 자격 증명 HTTP/HTTPS 프록시 지원 요청 시간 초과 설정 JSONL 출력 로그 파일 지원 Telegram 알림 강제 모드 --force 사용법 Show help python3 mass.py -h Single target python3 mass.py ...

CVE-2021-22005-

CVE-2021-22005- CVE-2021-22005 Python-скрипт для массовой проверки Среда выполнения: python3 Запуск: поместите URL-адреса для проверки в текстовый файл, например url.txt, затем выполните python3 url.txt...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Do not ignore the genmask when looking up a chain by its ID. When adding a rule to a chain whose ID is referenced, if that chain has been deleted in the same batch, the rule might end up referencing a deleted...

TEST-CVE-2023-32233

Использование после освобождения в Netfilter nftables при обработке пакетных запросов Детали уязвимости Затронутый код происходит из официального ядра Linux с https://kernel.org/ и является частью компонента Netfilter nftables net/netfilter/nftablesapi.c. Netfilter nftables позволяет обновлять св...

CVE-2026-82578

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks...

CVE-2026-82578 NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks...

EUVD-2026-76117

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks...

CVE-2026-82578 NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks...

CVE-2026-82578

NextGen Healthcare Mirth Connect is affected by an XXE injection vulnerability in its XML batch processing feature. When the XPath option is selected, raw batch input is processed through a default XPath/JAXP parser with no entity restrictions , allowing an unauthenticated, network-based attacker...

PT-2026-89882

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks...

CVE-2026-82578: Improper Restriction of XML External Entity Reference

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks...

CVE-2026-81643 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops results...

CVE-2026-81643 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops results...

CVE-2026-73558

A flaw was found in vLLM, an inference and serving engine for large language models. An integer overflow vulnerability in the actandmulkernel kernel allows a remote attacker to cause cross-user data leakage. By crafting specific requests processed in the same inference batch, an attacker can obta...