climber

Climber Automated auditing tool to check UNIX/Linux systems misconfigurations which may allow local privilege escalation. Dependencies python = 2.7 python-crypto python-mako python-paramiko Note Climber needs Exscript, a Python module and a template processor for automating network connections ov...

basalt

!DOI 10.5281/zenodo.22072811https://img.shields.io/badge/DOI-10.5281/zen...

BIT-PARSE-2026-109303 Parse Server before 8.6.93 and 9.0.0 before 9.10.1 protectedFields Bypass via Relation Count Query

Parse Server before 8.6.93 and 9.0.0 before 9.10.1 does not enforce identity-scoped protectedFields authenticated, role, or per-user groups on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning object can...

cve-2025-24985

cve-2025-24985 Compute the number of cluster of a VHD file to detect overflow. Supportted boot sectors: MBR GPT Usage python -m cve202524985 -f Setup Nix With direnv: direnv allow Or Without direnv: nix develop Peotry WIP Docker WIP TODO: Auto build libvhdi with poetry Setup poetry install Fix...

CVE-2011-3192

CVE-2011-3192 Run it using python 3.7 or 3.10 tested on it 1. git clone https://github.com/futurezayka/CVE-2011-3192.git 2. cd ./CVE-2011-3192 3. pip install -r requirements.txt 4. python3 exploit.py host tasks example python3 exploit.py https://example.com 50...

jadx

JADX jadx - Dex to Java decompiler Command-line and GUI tools for producing Java source code from Android Dex and APK files !WARNING Please note that in most cases jadx can't decompile 100% of the code, so errors will occur. Check the Troubleshooting guide for workarounds. Main features: decompil...

massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

Sassy Social Share <= 3.3.3 - Cross-Site Scripting

The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateorssssharingcount' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

ChurchCRM - SQL Injection

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper...

snowpick

snowpick is a ServiceNow exposure scanner that finds misconfigured widget ACLs, REST API access controls, and unauthenticated data exposure. ServiceNow exposes data through two common public surfaces: Service Portal widgets and the Table REST API. When access controls on either surface are...

DEBIAN-CVE-2026-98511

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveaubopinlocked nouveaubopinlocked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...

CVE-2026-98850

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98511

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveaubopinlocked nouveaubopinlocked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets...

EUVD-2026-103790

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98850

The Linux kernel contains a vulnerability in net/packet where the tpacket_snd() function fails to bound the len_sum variable. Because userspace can recycle completed frames concurrently, len_sum can wrap into a negative range after sufficient transmissions. Specifically, certain frame sizes can p...

CVE-2026-98850 net/packet: prevent TX_RING byte count overflow

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98850

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98679

The Linux kernel contains a vulnerability in the IIO core (specifically kxcjk-1013) where duplicate writes to the event enable attribute are not properly filtered. While repeated enable requests are ignored, a repeated disable request triggers kxcjk1013_set_power_state(data, false), which drops a...

CVE-2026-98679 iio: accel: kxcjk-1013: reject duplicate event disable

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject duplicate event disable The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013writeeventconfig already ignores repeated enable requests, but a repeated disable reques...