raven

Raven Currently is not being maintained Raven is a Linkedin information gathering tool that can be used by pentesters to gather information about an organization employees using Linkedin. Disclaimer root@kitploit: Please do not use this program to do stupid things. The author does not keep any...

Employee Records System 1.0 - Unauthenticated File Upload RCE

Employee Records System version 1.0 contains an unrestricted file upload vulnerability in uploadID.php that allows remote unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution. id: CVE-2021-4462 info: name: Employee Records System 1.0 - Unauthenticated File...

CrossLinked

CrossLinked CrossLinked is a LinkedIn enumeration tool that uses search engine scraping to collect valid employee names from an organization. This technique provides accurate results without the use of API keys, credentials, or accessing LinkedIn directly! Table of Contents Install Prerequisites...

CVE-2025-67315

CSRF による任意従業員の無効化 概要 従業員管理 機能にはクロスサイトリクエストフォージェリ CSRF の脆弱性があります。 攻撃者はログイン済みの管理者をだまして、管理者の知らないうちに同意なく従業員（例：inid=1）を無効化する偽装リクエストを送信させることができます。 CVSS 基本スコア: 5.4（MEDIUM） ベクトル文字列: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L 影響を受ける機能 モジュール: 管理パネル → 従業員 → 従業員管理 アクション: 従業員の無効化（inid パラメータ経由） 再現手順 1...

LinkedInDumper

LinkedInDumper LinkedIn API에서 회사 직원 정보를 덤프하는 Python 3 스크립트 💬 설명 LinkedInDumper는 LinkedIn 소셜 네트워킹 플랫폼에서 직원 데이터를 덤프하는 Python 3 스크립트입니다. 결과에는 이름, 성, 직위직함, 위치 및 사용자의 프로필 링크가 포함됩니다. 회사 직원이 10명 이하인 경우 모든 직원을 검색하는 데 API 호출이 2번만 필요합니다. 그렇지 않으면 API 결과를 페이지 단위로 탐색해야 합니다. --email-format CLI 플래그를 사용하면 검색된 이름...

ScrapedIn

ScrapedIn LinkedIn 스크래핑 도구 이 도구는 레드 팀 또는 소셜 엔지니어링 작업을 위해 LinkedIn.com 웹사이트/API를 사용한 정찰 수행을 지원합니다. 특정 회사 검색을 수행하여 대상 회사에서 근무하는 직원의 상세 목록을 추출합니다. 대상 회사의 이름을 입력하면 도구가 LinkedIn 회사 ID를 확인하는 데 도움을 주며, 이 ID를 사용하여 검색을 수행합니다. 참고: 이 도구는 20개 미만의 요청을 전송하여 모든 검색의 최대 결과1,000개의 연락처를 추출합니다. 출력은 XLSX 파일로 저장되지만,...

CVE-2026-71483 Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an...

D4TA-HUNTER

ビデオデモ: https://darkhacking.es/d4ta-hunter-framework-osint-para-kali-linux マイウェブサイト: https://microjoan.com 私のブログ: https://darkhacking.es/ コーヒーをごちそうする: https://www.buymeacoffee.com/microjoan 免責事項...

CVE-2021-43657

CVE-2021-43657 これはCVE-2021-43657のリファレンス/POCです。 この脆弱性は、従業員タスク管理システムを担当するオープンソースソフトウェアを試していたときに発見されました。...

training-security-awareness

Free Security Awareness Training for Employees — Open Source Interactive SCORM Library 130+ free, open-source security awareness training exercises for employees — hands-on, interactive SCORM modules covering phishing awareness training, phishing simulation, GDPR training, EU AI Act compliance, A...

CVE-2024-22369

CVE-2024-22369 クレジット このPoCは、華為オープンソース管理センターのZiyang Chen氏が構築した再現コードに基づいています。 その再現コードは、このPoCの作成に使用され、いくつかの調整とクリーンアップが行われ、さらに自動化が強化されました。 環境の準備 Mysqlインスタンスが必要です。 docker run --name some-mysql -p 3306:3306 -e MYSQLROOTPASSWORD=my-secret-pw -e MYSQLDATABASE=db -d mysql 次に、必要なテーブルを作成する必要があります。...

CVE-2024-25175

CVE-2024-25175 HTTPレスポンススプリッティングによる反射型XSS 説明 : この脆弱性を悪用すると、特別に細工されたリンクをクリックした際に、被害者のブラウザでJavaScriptコードが実行される（クロスサイトスクリプティング）可能性があります。この脆弱性は、Webサーバーが改行（\r\n または CR\LF、urlencodeでは %0d%0a）を正しく処理しないために発生します。 影響 : 反射型XSS CVSSv3.1ベクター : AV:N/AC:L/PR:N/UI:R/S:C:C/L:I/L:A:N 6.1 CWE : CWE-20: 不適切な入力検証...

CVE-2025-40677

エクスプロイトタイトル: Summar Employee Portal 3.98.0 未満の認証済みSQLインジェクション - CVE-2025-40677 Google Dork: inurl:"/MemberPages/quienesquien.aspx" 日付: 09/22/2025 エクスプロイト作者: Peter Gabaldon - https://pgj11.com/ ベンダーホームページ: https://www.summar.es/ ソフトウェアリンク:...

CVE-2026-14311: Missing Authorization

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/ endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated...

CVE-2026-47094

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...

EUVD-2026-80933

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...

CVE-2026-92364

A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit ha...

EUVD-2026-80741

A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit ha...

CVE-2026-47094: Authorization Bypass Through User-Controlled Key

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...

CVE-2026-92364: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit ha...