hostintel

hostintel This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. The output is in CSV...

csv-plus_vulnerability

csv-plusvulnerability 👻 2-Click Arbitrary Code Execution Vulnerability. CVE-2022-21241 ⚠ This PoC was created to alert users and investigate vulnerabilities in their own CSV+, and is prohibited to be used for attacks. Vulnerability The following versions are vulnerable. CSV+ click me 👻...

CVE-2026-3629

CVE-2026-3629 - WordPress Privilege Escalation Checker A command-line tool to detect CVE-2026-3629 , a critical privilege escalation vulnerability in the "Import and export users and customers" WordPress plugin. 📢 Join Our Community Stay updated with the latest security tools, vulnerabilities, an...

iTop-CVEs-exploit

iTop-CVEs-exploit This repository contains exploits for iTOP CVE-2024-52002, 52000, 31998, 31448 that involve CSRF+XSS chaining to get admin privileges on the software. Set up 1. Download the vulnerable iTOP version from docker sudo docker run -d -p 8090:80 --name=my-itop2 vbkunin/itop:3.1.1 2...

remote-bitlocker-encryption-report

remote-bitlocker-encryption-report This PowerShell script takes a list of PC as input, gets their BitLocker encryption type remotely, and outputs the list as a CSV file to help mitigate against CVE-2018-12038. Prevent CVE-2018-12038 vulnerability Description of CVE-2018-12038 from NIST : An issue...

ConditionalAccessDocumentation

Document Conditional Access with PowerShell This PowerShell script documents your Microsoft Entra Conditional Access policies. The script exports all data as a csv file which can be pretty formatted as excel workbook. To ensure all policies can be retrieved and documented the script uses the...

CVE-2025-4190

CVE-2025-4190 — WordPress CSV Mass Importer ≤ 1.2 Arbitrary File Upload -purple 📌 Description The CSV Mass Importer plugin ≤ 1.2 for WordPress contains an Admin+ Arbitrary File Upload vulnerability. Due to improper validation of uploaded files, high-privilege users such as admin can upload...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

CVE-2023-33410

CVE-2023-33410 Minical 1.0.0 is vulnerable to CSV Injection. Vendor: https://github.com/minical/minical Demo Application: https://demo.minical.io/ PoC Step 1: Navigate to the Accounting module and click on Create New Customer. Step 2: Enter the payload in the Name field and Click on Create...

autotimeliner

AutoTimeliner Automagically extract forensic timeline from volatile memory dumps. AutoTimeliner runs multiple Volatility3 plugins against Windows, Linux, and macOS memory images, then merges their output into a single, sorted CSV timeline: Generic Timeline Plugin Plugin| What it captures ---|---...

mwebfp

LNHG - Massive Web Fingerprinter mwebfp Introduction The "LowNoiseHG LNHG Massive Web Fingerprinter " "mwebfp " from now on was conceived in July 2013 after realizing the usefulness of webserver screenshots to pentesters, during an engagement with large external or internal IP address ranges, as ...

imago-forensics

imago-forensics 🕵️ Imago is a python tool that extract digital evidences from images recursively. This tool is useful throughout a digital forensic investigation. If you need to extract digital evidences and you have a lot of images, through this tool you will be able to compare them easily. Imago...

tiktok-scraper

TikTok Scraper & Downloader Scrape and download useful information from TikTok. No login or password are required This is not an official API support and etc. This is just a scraper that is using TikTok Web API to scrape media and related meta information. Content Features To Do Contribution...

CVE-2023-36250

CVE-2023-36250 CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record. Vulnerability Type CSV Injection Discoverer Bruno Teixeira Reference http://gnome.com Affected Product Code Base GNOME...

Ivanti-Connect-Secure-Logs-Parser

Ivanti Secure Connect Logs Parser This repository provides a Python script designed to convert Ivanti Secure Connect .vc0 log files into CSV format for digital forensics and incident response. In particular, the parser: Extracts timestamps from Ivanti log files notably from .vc0 files. Converts...

cloudsploit

CloudSploit by Aqua - Cloud Security Scans Quick Start Generic $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ npm install $ ./index.js -h Docker $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ docker build . -t cloudsploit:0.0.1 $...

CVE-2020-25398

CVE-2020-25398 CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality. Information Description: Attacker can configure specific data, which could be exported to malicious csv file with code execution payload and runs after opening on user's machine...

IPGeoLocation

IPGeoLocation ==== A tool to retrieve IP Geolocation information Powered by ip-api Requirements Python 3.x termcolor colorama Download/Installation git clone https://github.com/maldevel/IPGeoLocation pip3 install -r requirements.txt --user if pip3 is missing: apt-get install python3-setuptools...

CVE-2026-109396

The Thelia platform (versions before 3.1.2 and 3.2.x before 3.2.1 ) is vulnerable to a CSV formula injection vulnerability. The issue resides in the CSVSerializer component, which exports fields like registration, checkout, or newsletter data verbatim. Unauthenticated visitors can exploit this by...

EUVD-2026-97493

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...