155 matches found
Mailcow < 2026-03b - Href Link Injection
mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing. id: CVE-2026-40878 info: name: Mailcow 2026-03b - Href Link Injection author: ritikchaddha severity: low description: | mailc...
Mailcow Dockerized Swagger UI - Cross-Site Scripting
Mailcow-dockerized before 2022-09a uses a vulnerable version of Swagger UI before 4.11.1 that is affected by a DOM-based Cross-Site Scripting XSS vulnerability. When a user accesses the Swagger documentation with a crafted configUrl or url parameter containing JavaScript payloads, arbitrary code...
karonte
Karonte Karonte is a static analysis tool to detect multi-binary vulnerabilities in embedded firmware. The master branch provides the latest version of Karonte, ported to python3. For the original implementation and experiments presented in our paper, please checkout the IEEE-SP-20 branch and hav...
dockerized-android
Dockerized Android Dockerized Android 는 Docker 내에서 Android 에뮬레이터를 실행하고 브라우저를 통해 제어할 수 있는 컨테이너 기반 프레임워크입니다. 이 프로젝트는 모바일 보안 구성 요소를 Cyber Range에 통합하기 위한 시작점을 제공하기 위해 개발되었지만, 어떤 목적으로든 사용할 수 있습니다. 다만 개발 및 테스트 목적으로는 docker-android 프로젝트를 권장합니다. 목차 목차 소개 기능 아키텍처 핵심 구성 요소 UI 구성 요소 인스턴스 관리자 구성 요소 Docker 이미...
CVE-2023-23488-pmpro-2.8
Dockerizing a Vulnerability: CVE-2023-23488 This project aims to dockerize a specific vulnerability using Docker. The goal is to create an isolated environment in which the vulnerability can be exploited and tested securely. Vulnerable Application Paid Memberships Pro v2.9.8 WordPress Plugin -...
mailcow-dockerized
mailcow: dockerized - 🐮 + 🐋 = 💕 mailcow를 지원하고 싶으신가요? 더 나은 개발을 지원하기 위해 Servercow와 지원 계약을 고려해 주세요. 저희가 여러분을 지원하는 동안 여러분이 저희를 지원합니다. : 또한 SAL을 받을 수도 있습니다. 이는 의무나 반복 비용이 없는 일회성 결제입니다. 또는 소문을 퍼뜨리세요: 음메. GitHub 후원자분들께 감사드립니다 ❤️ GitHub Sponsors에서 저희를 지원해 주시는 모든 분께 큰 감사를 드립니다—여러분의 기여는 저희에게 큰 의미입니다! 다음 멋진...
manuka
Manuka Description Manuka is an Open-source intelligence OSINT honeypot that monitors reconnaissance attempts by threat actors and generates actionable intelligence for Blue Teamers. It creates a simulated environment consisting of staged OSINT sources, such as social media profiles and leaked...
kraken
Warning I have been reviewing the Kraken-Client code and since this was my first ever react app, its old, clunky and it needs major improvement the server needs some work too. In the next few weeks/months I will do my best to rewrite it in either updated React or in another framework. Please feel...
OSWE-Labs-Poc
OSWE -LABS Web Expert OSWE 認定資格のための Docker 化されたラボ。今後の AWAE トレーニングの準備 ... 別のプロジェクト: マルウェア解析 & サイバー脅威ハンティング https://github.com/svdwi/BlueBox OSWE 向けの利用可能なラボ 1. ATutor は、オープンソースの Web ベースの学習コンテンツ管理 システムです。Wikipedia 2. DNN は、Microsoft .NET に基づく Web コンテンツ管理システムおよび Web アプリケーション フレームワークです。 ATutor...
xss_vulnerability_challenges
XSS 취약점 시나리오 도전 과제 이 저장소는 몇 가지 XSS 취약점 도전 과제를 포함한 Docker 기반 PHP 애플리케이션입니다. 도전 과제의 아이디어는 다음과 같습니다: JavaScript 유효성 검사 우회 html 엔티티 우회 WAF 우회 블랙리스트 검증 우회 기본 XSS 검증 우회 XSS 공격을 위한 WAF 더블 인코딩 우회 이스케이프 문자 우회를 통한 XSS 공격 Docker를 사용한 빠른 시작 Docker Hub 사용 가장 빠름: 1. 도전 과제에 접근하려면 docker가 설치되어 있어야 합니다. 2. 다음 명령어...
redash-vulnerable
redash-vulnerable 🐛 CVE-2021-21239 に対して脆弱な Docker 化された Redash インスタンスです。Calif によって詳述されています。 使い方 💻 サーバーの起動（データを保持） root@kitploit: script/server これにより、Docker Compose を使用してデタッチモードで Redash サーバーが起動し、既存のデータは保持されます。サーバーは http://localhost:8080 で利用可能です。 最初から開始（すべてのデータを削除） root@kitploit: script/server...
CVE-2025-25198
CVE-2024-25198 mailcow: dockerized は、Docker ベースのオープンソースのグループウェア/メールスイートです。バージョン 2025-01a より前のバージョンでは、mailcow のパスワードリセット機能に脆弱性があり、攻撃者が Host HTTP ヘッダーを操作して、攻撃者が制御するドメインを指すパスワードリセットリンクを生成できます。ユーザーがこの改ざんされたリンクをクリックすると、アカウント乗っ取りにつながる可能性があります。 仕組み すべてのリクエストを待ち受ける HTTPS サーバーをセットアップし、選択した を Host ヘッダーに含む...
CVE-2021-4034
CVE-2021-4034 Polkit の権限昇格エクスプロイトです。再現性を高めるために Docker 化されています。 Docker の実行 root@kitploit: docker build -t cve20214034 . docker run -it --rm cve20214034 エクスプロイトの実行 root@kitploit: whoami user ./gain-root.sh whoami root 参考情報 元のアドバイザリ: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt...
TCL-xss-Labs
XSS Lab — The Cyber Ledger 💸 If this project helps you, consider supporting it with a $10 donation to keep it growing. Link: https://rzp.io/rzp/zgkC6h5B An interactive, self-hosted XSS training platform with 33 progressively harder challenges — designed for hackers, pentesters, and developers who...
CVE-2021-44228_dockernize
CVE-2021-44228 Log4Shell 脆弱性ラボ環境 はじめに このプロジェクトは、CVE-2021-44228（Log4Shell）として知られる深刻なLog4j脆弱性を安全に練習・理解するためのDocker化された環境を提供します。 主な特徴 安全なDocker化されたテスト環境 カスタムペイロードのテスト機能 攻撃者のLDAPサーバと脆弱なJavaアプリケーションを含む はじめ方 root@kitploit: docker compose up --build ペイロードテスト 1. /vulnerable/Makefileのテストセクションでペイロードを変更できます。...
vulnerable-web-app
vulnerable-web-app ⚠️ Intentionally vulnerable. A runna...
CVE-2026-40874
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with /api/v1/delete/fwdhost. Any authenticated user can call this API. Checks are only applied for edit/add actions,...
CVE-2026-7460
mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML...
CVE-2026-40875
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections" login history renders the client IP from login logs without HTML escaping. Because the server trusts the X-Real-IP header as the source IP...