PT-2026-126438

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacke...

PT-2026-126436

PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Relative Path Traversal vulnerability in the certificate. A...

PT-2026-126395

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Access Control vulnerability. An...

sqliv

SQLiv Massive SQL injection scanner Features 1. multiple domain scanning with SQL injection dork by Bing, Google, or Yahoo 2. targetted scanning by providing specific domain with crawling 3. reverse domain scanning both SQLi scanning and domain info checking are done in multiprocessing so the...

ZeroLogon-CVE-2020-1472-lab

ZeroLogon-CVE-2020-1472 Explanation and demonstration of the ZeroLogon CVE-2020-1472 vulnerability The purpose of this lab is strictly educational. Its execution is not recommended in production environments or those that do not belong to you. About the Vulnerability Context of the vulnerability...

CVE-2026-41089-Netlogon-RCE

🚨 CVE-2026-41089: Critical Windows Netlogon RCE Unauthenticated Remote Code Execution on Active Directory Domain Controllers 🧠 Conceptual Overview I am publishing this technical breakdown of CVE-2026-41089 , an exceptionally critical vulnerability residing deep within the Windows Netlogon service...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

CVE-2026-41089

CVE-2026-41089 — Windows Netlogon CLDAP Stack Buffer Overflow RCE Exploit CVE-ID: CVE-2026-41089 CVSS: 9.8 Critical CWE: CWE-121 Stack-based Buffer Overflow Attack Vector: UDP/389 CLDAP SearchRequest Impact: Remote Code Execution RCE / Denial of Service DoS Affected Versions: Windows Server 2012 ...

CVE-2020-1472

CVE-2020-1472 CVE 2020-1472 Validation script Assumption: WinRM is enabled between domain controllers. Required permissions: If child domains are present: Enterprise admin If single forest, single domain: Domain admin This script must be run on a primary domain controller with required permission...

reverseip_py

reverseippy Domain parser for IPAddress.com Reverse IP Lookup. Writen in Python 3. What is Reverse IP? Reverse IP refers to the process of looking up all the domain names that are hosted on a particular IP address. This can be useful for a variety of reasons, such as identifying all the websites...

Malicious code in @capsense/ccx-welcome-page (npm)

Source: ossf-package-analysis 08a76d2425b34728eb502d47ba660eefd26e944864de58d8022e82c367dd55b2 The OpenSSF Package Analysis project identified '@capsense/ccx-welcome-page' @ 99.99.100 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in @capsense/ccx-welcome-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f63b73ae5e707b0eecee16f97f8ab26b350d135547448fbf6e005ba33303060 The package publishes under the @capsense scope at version 99.99.100 and wires all three npm lifecycle hooks preinstall, install, postinstall to run...

MAL-2026-18294 Malicious code in @capsense/ccx-welcome-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f63b73ae5e707b0eecee16f97f8ab26b350d135547448fbf6e005ba33303060 The package publishes under the @capsense scope at version 99.99.100 and wires all three npm lifecycle hooks preinstall, install, postinstall to run...

MAL-2026-18295 Malicious code in @capsense/core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd830a923fd6fbe61525c9d152a75384cbd42624a45edc957c2f055ff8fa61a8 @capsense/[email protected] is published to the public npm registry under a scoped name at an implausibly high version, a shape used to override an...

Malicious code in @capsense/core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd830a923fd6fbe61525c9d152a75384cbd42624a45edc957c2f055ff8fa61a8 @capsense/[email protected] is published to the public npm registry under a scoped name at an implausibly high version, a shape used to override an...

SharpHound2

THIS IS NOW DEPRECATED IN FAVOR OF SHARPHOUND3. DATA COLLECTED USING THIS METHOD WILL NOT WORK WITH BLOODHOUND 3.0 SharpHound - C Rewrite of the BloodHound Ingestor Get SharpHound The latest build of SharpHound will always be in the BloodHound repository here Compile Instructions Sharphound is...

CVE-2026-116069 NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field

NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local host...

CVE-2026-116069 NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field

NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local host...

CVE-2026-116069

NiubiGEO versions prior to 0.3.2 are vulnerable to an unauthenticated server-side request forgery (SSRF) . The flaw exists in the POST /audit-plan endpoint, where an attacker can provide a crafted domain value to force the server to fetch internal addresses. By submitting IP literals , localhost ...

Mandiant-Azure-AD-Investigator

Mandiant Azure AD Investigator Focusing on UNC2452 TTPs Overview This repository contains a PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity. Some indicators are "high-fidelity" indicators of compromise, while other artifacts are so calle...