aws-enumerator

AWS Service Enumeration 免責事項 このツールはベータ版です（テスト中）。破壊的なAPIコールは使用されていません（読み取り専用アクション）。ツールに問題がないことを願っています。問題が発生した場合は、チケットを送信してください。 説明 AWS Enumeratorは、ブラックボックステスト中のペネトレーションテスターの調査のために、サービス列挙と情報ダンプのために作成されました。このツールは、セキュリティ研究者がAWSアカウントの認証情報を侵害した場合のクラウドレビューのプロセスを加速することを目的としています。 AWS...

Wordpress-XMLRPC-Brute-Force-Exploit

Wordpress XMLRPC System Multicall 暴力破解利用工具 by 1N3 最后更新：20170215 https://crowdshield.com 关于： 这是一个针对 Wordpress xmlrpc.php System Multicall 函数的漏洞利用工具，影响当时最新版本的 Wordpress（3.5.1）。该工具通过每次向 xmlrpc.php 发送 1,000 次以上的认证尝试来“暴力破解”有效的 Wordpress 用户，并会遍历整个字典文件，直到获取到有效的用户响应。随后它将有选择地获取并显示有效的用户名和密码以进行登录。 用法：...

ibrute

ACTUALIZACIÓN Si te preocupa la seguridad del almacenamiento en la nube, por favor lee ¿Y si yo fuera una nube? y deja tus comentarios. Gracias. Se acabó la diversión, Apple acaba de parchearlo Aquí tienes el pOc de fuerza bruta de contraseñas de appleID. Es solo un p0c, así que no hay...

BruteX

BruteX DESCRIZIONE: Esegue automaticamente brute force su tutti i servizi attivi su un target Porte aperte Nomi utente Password INSTALLAZIONE: root@kitploit: ./install.sh UTILIZZO: root@kitploit: brutex target DOCKER:...

flowise-arbitrary-file-read-getFileFromStorage

Flowise बिना प्रमाणीकरण के मनमानी फ़ाइल रीड getFileFromStorage — प्रस्तावित नया CVE CVE-2025-71338 से एक अलग भेद्यता जो write sink है। यह एक बिना प्रमाणीकरण के मनमानी फ़ाइल रीड है, Flowise document-store लोडर "rehydrate" पथ में, 1.7.1 – 2.2.3 को प्रभावित करती है, 2.2.4 में ठीक हुई।...

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign...

PT-2026-69885

Name of the Vulnerable Software and Affected Versions use-reducer-async affected versions not specified Description Malicious commits were introduced into the default branch of the repository, which executed remote attacker-controlled code on developer workstations during the npm install process...

Malicious code in @or-sdk/identifiers (npm)

npm/@or-sdk/identifiers is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

SUSE CVE-2026-53632

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...

EUVD-2026-38299

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...

CVE-2026-12049

A flaw was found in pgAdmin 4. This open redirect vulnerability exists in the multi-factor authentication MFA flow. An authenticated user could be tricked into clicking a specially crafted link, which would redirect them to an attacker-controlled website. This could increase the success rate of...

PT-2026-49575

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.1 Description The launch-editor NPM package allows the access of arbitrary paths, including Windows UNC Universal Naming Convention paths. On Windows systems, accessing a UNC path triggers an automatic NTLM...

CVE-2026-46622 SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the apitokens database table. Any attacker who obtains read access to the database — through SQL injection, a leaked backup, a...

CVE-2026-46622

SolidInvoice before v2.3.17 stores API tokens in plaintext in the api_tokens database table. If an attacker gains read access to the database (e.g., via SQL injection, leaked backups, misconfigured replicas, or insider access), they can immediately obtain all API credentials for every user with n...

CVE-2026-36182

GNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing attackers to obtain root credentials and privileges via a bruteforce attack...

CVE-2026-10843

A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise...

CVE-2026-25861

QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt function within classes/Tools.php, which concatenates a static cookie...

forman: Foreman: Remote Code Execution via command injection in WebSocket proxy

A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating...

CVE-2026-1961

A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating...

SUSE CVE-2026-27575

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords e.g., 1234, password without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password. An...