DropboxC2C

DropboxC2C DropboxC2C is a post-exploitation agent which uses Dropbox Infrastructure for command and control operations. DO NOT USE THIS FOR MALICIOUS PURPOSES. THE AUTHOR IS NOT RESPONSIBLE FOR ANY MISUSE OF THIS PROGRAM. Dropbox-C2C is an old project of mine to use a thirdparty for command and...

python-uncompyle6

|buildstatus| |Pypi Installs| |Latest Version| |Supported Python Versions| |packagestatus| .. contents:: uncompyle6 A native Python cross-version decompiler and fragment decompiler. The successor to decompyle, uncompyle, and uncompyle2. I gave a talk on this at BlackHat Asia 2024 . Introduction...

DBC2

DBC2 LAST/CURRENT VERSION: 0.2.6 Author: Arno0x0x - @Arno0x0x DBC2 DropboxC2 is a modular post-exploitation tool, composed of an agent running on the victim's machine, a controler, running on any machine, powershell modules, and Dropbox servers as a means of communication. This project was...

CVE-2024-49607

CVE-2024-49607 WP Dropbox Dropins = 1.0 - Unauthenticated Arbitrary File Upload Description: The WP Dropbox Dropins plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to upload arbitrary file...

external_c2_framework

externalc2 framework Python framework for usage with Cobalt Strike's External C2 specification as described in the spec. The primary design goal is to be a very modular implementation of the external c2 spec that provides enough abstraction to easily implement C2 channels for Cobalt Strike...

lanGhost

⚠️ Warning! This project is no longer maintained and may not work as excepted. A LAN dropbox chatbot controllable via Telegram features: installation: warning: lanGhost is designed for Raspberry Pis Raspbian /Kali for RPi. Running it on other/desktop distros could cause issues and may not work as...

CVE-2026-93986

A flaw was found in rclone. This path traversal vulnerability allows a remote attacker to craft special names in server and third-party listing responses. These crafted names, containing directory traversal sequences, could potentially enable writing outside the intended destination directory...

WordPress WP Cloud Plugins - Dropbox (Out-of-the-Box) plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

WordPress WP Cloud Plugins - Dropbox Out-of-the-Box plugin 2.0-3.8.3 - Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Out-of-the-Box versions 2.0-3.8.3...

CVE-2026-81102

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

EUVD-2026-67030

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81102 Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81102: Origin Validation Error

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

PT-2026-82575

Name of the Vulnerable Software and Affected Versions Dash MCP server affected versions not specified Description In network mode, the server binds its listener to the loopback address but fails to verify the host name of incoming requests. Within src/mcp server dash.py, the server is configured...

WordPress Easy Dropbox Integration plugin < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX vulnerability

Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Easy Integration for Dropbox versions 2.2.0...

CVE-2026-15958

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

EUVD-2026-52590

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

CVE-2026-15958

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

CVE-2026-15958 Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

CVE-2026-15958 Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

CVE-2026-15958

The Easy Integration for Dropbox WordPress plugin, in versions prior to 2.2.0 , is vulnerable to an authentication bypass. The plugin fails to perform proper authorization checks on several file-management AJAX actions that are accessible to unauthenticated users. This flaw allows an unauthentica...