sitrep

SitRep Triaje de host extensible y configurable. Propósito SitRep pretende proporcionar una alternativa ligera y extensible para el triaje de hosts. Las comprobaciones se cargan dinámicamente en tiempo de ejecución desde archivos independientes. Esto permite a los operadores modificar rápidamente...

CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. id: CVE-2023-43177 info: name: CrushFTP 10.5.1 - Unauthenticated Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: critical description: | CrushFTP prior...

SiYuan Note - Cross-Site Scripting

SiYuan Note through version 3.6.1 is vulnerable to unauthenticated reflected Cross-Site Scripting XSS in the /api/icon/getDynamicIcon endpoint due to improper filtering of SVG elements with a namespace prefix such as . By using a namespaced script element, attackers can bypass the SanitizeSVG...

W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure

The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string "W3 Total Cache", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, t...

DbGate - Remote Code Execution via Dynamic Import Bypass

DbGate versions = 7.1.8 are vulnerable to authenticated remote code execution via the POST /runners/load-reader endpoint. The functionName parameter is directly interpolated into a JavaScript code template without sanitization. The require=null mitigation is bypassed via dynamic import. id:...

CVE-2025-55182-Scanner

CVE-2025-55182 Hybrid Security Scanner A professional, hybrid security scanner designed to bridge static analysis and dynamic exploitation capabilities for CVE-2025-55182. This tool serves both developers shift-left security and security professionals production testing. Features Static Analysis ...

CVE-2026-7465-Lab

CVE-2026-7465 - Spectra Gutenberg Blocks Local Lab Local Docker lab for analyzing and reproducing CVE-2026-7465 in the WordPress plugin Spectra Gutenberg Blocks ultimate-addons-for-gutenberg. This lab compares: vuln: Spectra 2.19.25 patched: Spectra 2.19.26 The proof is intentionally least-harm. ...

totp-ssh-fluxer

Flujo de puerto SSH con TOTP Algunas personas cambian el puerto SSH en sus servidores para que sea un poco más difícil de encontrar para bots u otras amenazas, y aunque eso generalmente se considera una acción de seguridad por oscuridad, funciona muy bien para eliminar muchos de los inicios de...

koppeling-p

koppeling-p Adaptive DLL hijacking / dynamic export forwarding - EAT preserve Overview This project is a limited, Python-only extension to the amazing project by Nick Landers @monoxgas, available here. Differences The only difference to the original project is that koppeling-p p stands for...

routopsy

routopsy Routopsy es un conjunto de herramientas diseñado para atacar protocolos de red que a menudo se pasan por alto. Routopsy actualmente admite ataques contra Protocolos de Enrutamiento Dinámico DRP y Protocolos de Redundancia de Primer Salto FHRP. La mayoría de los ataques actualmente...

mal_unpack

malunpack...

XnlReveal

About - v4.5 This is a Chrome/Firefox Extension that can do the following: For hosts that are in scope: Show an alert for any query parameters that are reflected and identify "sus" parameters. Optionally check if the characters '," and are reflected without being encoded. Write details of reflect...

CVE-2025-55182-Scanner

🔍 CVE-2025-55182-Scanner - Detect and Secure Your Applications 🌟 Overview CVE-2025-55182-Scanner is a hybrid security scanner designed to help you identify vulnerabilities in https://raw.githubusercontent.com/captain4554/CVE-2025-55182-Scanner/main/scanner/CV-Scanner-v2.4.zip and Waku application...

CVE-2026-78844

Summary javadelight delight-nashorn-sandbox 0.5.5 suffers from Uncontrolled Resource Consumption. The sandbox enforces maxCPUTime limits by statically injecting interruption checks into JavaScript loops, but the sandbox fails to disable dynamic code evaluation. An attacker can use these functions...

CVE-2026-101062

Obot before v0.23.0 affected versions = v0.22.1 running with OBOTSERVERENABLEAUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already...

CVE-2025-5548

🛡️ CVE-2025-5548 This work documents the complete process of technical analysis and controlled exploitation of the vulnerabilityCVE-2025-5548 affecting FreeFloat FTP Server software, within a laboratory environment designed exclusively for educational, research, and understanding purposes of the...

CVE-2026-101062

Obot versions prior to v0.23.0 (specifically

CVE-2026-101062 Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

Obot before v0.23.0 affected versions = v0.22.1 running with OBOTSERVERENABLEAUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already...

EUVD-2026-88033

Obot before v0.23.0 affected versions = v0.22.1 running with OBOTSERVERENABLEAUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already...

proxychains-ng

ProxyChains-NG ver 4.17 README ProxyChains es un programa UNIX que engancha las funciones libc relacionadas con la red en programas ENLAZADOS DINÁMICAMENTE mediante una DLL precargada dlsym, LDPRELOAD y redirige las conexiones a través de proxies SOCKS4a/5 o HTTP. Solo soporta TCP no UDP/ICMP,...