OutOfTune

OutOfTune 受原始 Pytune 启发，OutOfTune 在 Entra ID 中注册一个恶意设备，将其注册到 Intune MDM，并检查最终的合规状态。 目前仅支持 Windows 设备（这是我的主要目标），未来可能会添加其他平台。 配套博客： https://stra-x.github.io/Re-Engineering-Pytune-Rogue-devices-in-the-age-of-conditional-access/...

Certi-Bhai

Certi-Bhai: Kit de Explotación de AD CS Certi-Bhai es una colección completa de herramientas de explotación en PowerShell para atacar vulnerabilidades de Servicios de Certificados de Active Directory AD CS. Este kit implementa varios Escenarios de Escalada ESC que demuestran configuraciones de...

CVE-2026-54121

👻 CVE-2026-54121 — CertiGhost Active Directory 证书服务 AD CS 权限提升 👋 概述 CVE-2026-54121（"Certighost"） 是一个影响 Microsoft Active Directory 证书服务（AD CS） 的高危权限提升漏洞。 该漏洞允许已认证的域用户滥用证书注册行为，获取能够模拟 域控制器 的证书，从而可能导致 整个 Active Directory 环境被攻陷 。 ⚠️ 本仓库 仅用于 授权的安全研究、检测工程和防御性测试。 ✨ 功能特性 📖 技术漏洞说明 🔍 检测指南 🛡️ 缓解建议 🧪 入侵指标（IoCs）...

virt-firmware

OVMF / armvirt 固件卷的工具 这是一个用于 edk2 固件镜像的小型工具集合。它们支持解码和打印固件卷的内容。变量存储（OVMFVARS.fd）可以被修改，例如用于注册安全启动证书。 virt-fw-dump 解码并打印固件卷的内容。 用法：virt-fw-dump -i 。 更多信息请尝试 virt-fw-dump --help，包含一些用于过滤输出的选项。 virt-fw-vars 打印和编辑变量存储卷。 目前专注于注册证书和启用安全启动。 打印变量：virt-fw-vars -i --print。 注册证书： root@kitploit: virt-fw-vars ...

Certighost-CVE-2026-54121

Document Type: Detection Use Case Related CVE: CVE-2026-54121 Certighost Author: Youssef Benchater Detection Use Case: Certighost CVE-2026-54121 This document describes the Splunk detection built for CVE-2026-54121. It follows the standard detection use case format so it can sit in a detection...

CVE-2026-88817

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access t...

EUVD-2026-80695

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access t...

CVE-2026-88817

Curiosity Workspace is affected by a privilege escalation vulnerability in its legacy access group creation endpoint . An authenticated, non-guest user could enroll themselves as an administrator and member of an existing access group without an invitation or approval. However, the flaw did not g...

CVE-2026-86447 LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...

WordPress LearnPress plugin 4.4.6 - Unauthenticated Student Enrollment Disclosure vulnerability

Unauthenticated Student Enrollment Disclosure vulnerability discovered by vuxvinh in WordPress Plugin LearnPress versions 4.4.6...

Published-CVE

已发布的CVE 此仓库包含两个安全漏洞的描述和利用代码： 1. CVE-2023-33580：在学生学习中心管理系统V1.0中的存储型跨站脚本（XSS），允许攻击者执行任意JavaScript代码。 2. CVE-2023-33584：在报名系统项目V1.0中的SQL注入（SQLI），使攻击者能够绕过认证并获得未授权访问。 对于每个漏洞，提供了详细描述、利用作者、供应商主页、软件链接以及复现漏洞的步骤。...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the...

CVE-2026-82848 Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...

CVE-2026-82848

CVE-2026-82848 affects the Masteriyo LMS WordPress plugin, versions 1.3.1 through 2.3.3 (fixed in 3.4.0 ). The root cause is a missing authorization check on the plugin's REST API endpoint that returns course enrolment records. This allows unauthenticated users to enumerate sequential record iden...

WordPress Masteriyo LMS plugin 1.3.1-2.3.3 - Unauthenticated Course Enrollment Disclosure vulnerability

Unauthenticated Course Enrollment Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Masteriyo - LMS versions 1.3.1-2.3.3...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-31613 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns...

CVE-2026-12843 LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

CVE-2026-12843

The LearnDash LMS WordPress plugin is affected by an authorization bypass in versions 4.25.0 through 5.1.6 , caused by improper verification of user authorization via a REST endpoint. Unauthenticated attackers can enroll arbitrary users in paid courses without payment verification, effectively by...

WordPress LearnDash LMS plugin 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint vulnerability

WordPress LearnDash LMS plugin 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint vulnerability discovered by Applied Cybernetics in WordPress Plugin LearnDash LMS versions 4.25.0-5.1.6...

CVE-2026-55513

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollmenttokenttl security setting and per-network networkconfig.enrollmenttokenttl overrides. API host creatio...