ZeroPulse

ZeroPulse Una moderna piattaforma di Command & Control C2 con integrazione Cloudflare Tunnel CodeFactor 📋 Indice Panoramica Caratteristiche Architettura Prerequisiti Installazione Configurazione Utilizzo Documentazione API Sicurezza Struttura del Progetto...

CVE-2025-23266

CVE-2025-23266 저자: Mark Mallia 대상 플랫폼: Ubuntu 22.04, FastAPI v2.4.3 → v2.5.1로 패치 2025‑10‑02 1 – 간단히: 이 공격이 수반하는 것은 FastAPI의 parserequest 루틴은 HTTP 요청 헤더를 호출자의 스택에 있는 작은 버퍼로 복사합니다. 공격자가 너무 긴 헤더를 보내면 해당 버퍼가 오버플로되어 그 뒤에 있는 반환 주소 를 덮어씁니다. 그러면 공격자는 동일한 요청 내부로 다시 점프하여 임의 코드를 실행하고 호스트 머신의 전체 제어권을 획득합니다. ...

Recon-Scan

Recon-Scan ReconScan은 FastAPI 백엔드, 비동기 워커 파이프라인, 단일 페이지 프론트엔드를 갖춘 오픈소스 패시브 리콘 스캐너입니다. 배포된 사이트는 https://recon-scan.vercel.app/에서 확인할 수 있습니다. 핵심은 빠른 신호입니다. 스캔을 실행하고, 모듈별 결과를 얻고, AI 요약을 확인한 후 이를 정리된 PDF 보고서로 내보낼 수 있습니다. 이 프로젝트의 특징 그리고 아닌 것 패시브 리콘입니다. 엔드포인트를 무차별 대입하거나, 퍼징하거나, 능동적인 익스플로잇 로직을 실행하지 않습니다...

k4_cve-2023-41064

k4cve-2023-41064 Passaggi per eseguire il progetto Configurazione del frontend: Vai nella cartella del frontend: bash Copier Modifier cd frontend Installa le dipendenze Node.js richieste eseguendo: bash Copier Modifier npm install Configurazione del backend: Vai nella cartella del backend: bash...

Reconator

Reconator ist ein automatisiertes Aufklärungs-Framework. Füge ein Ziel hinzu – einzeln oder in Stapeln – und der Worker führt ca. 17 Recon-Module dagegen aus Subdomain-Enumeration, Dirbrute, JS/Link-Mining, WAF-Fingerprint, Takeover-Prüfung, GF-Triage u.v.m.. Das Dashboard zeigt die Ausgabe jedes...

iKy

Descrizione | Installazione | Sito web | Moduli | Problemi | Supporto iKy Descrizione iKy è uno strumento OSINT che raccoglie informazioni da un indirizzo email o altri selettori e mostra i risultati in un'interfaccia visiva. aggiornamento in sospeso: riflette il frontend precedente Video...

Stormspotter

O Stormspotter cria um "grafo de ataque" dos recursos em uma assinatura do Azure. Ele permite que equipes vermelhas e testadores de penetração visualizem a superfície de ataque e as oportunidades de pivô dentro de um inquilino, e potencializa seus defensores para orientar e priorizar rapidamente ...

DeepAudit

DeepAudit - AI-Audit-Team für alle – Schwachstellenanalyse für jedermann zugänglich 🦸‍♂️...

CVE-2026-54553

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

CVE-2026-54553 Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

damn-vulnerable-MCP-server

Compatibilità SSE di Cursor per Damn Vulnerable MCP Questo documento fornisce una panoramica degli aggiornamenti apportati al progetto Damn Vulnerable Model Context Protocol DVMCP per renderlo compatibile con l'implementazione Server-Sent Events SSE di Cursor. Panoramica Il progetto DVMCP origina...

SubMon

SubMon Alguns dizem que bug bounty não é apenas sobre encontrar bugs, mas ser o "primeiro" a encontrá-los. Estou construindo esta ferramenta para notificar caçadores quando novos subdomínios aparecerem. Funcionalidades Você pode adicionar seu alvo favorito: nome + domínio. Depois, você pode clica...

CVE-2026-46645-Analysis-Lab

CVE-2026-46645 - SQLAdmin ajaxlookup Bypass de Autorização Resumo Executivo Este repositório contém um laboratório Docker local para reproduzir a CVE-2026-46645, uma vulnerabilidade de bypass de autorização que afeta o endpoint ajaxlookup do SQLAdmin. SQLAdmin é uma interface administrativa para...

MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...

PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

Summary PraisonAI's async Jobs API the FastAPI service in praisonai/jobs/ installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs executed against the operator's configured LLM...

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

Summary praisonai serve agents and praisonai serve unified both accept --api-key for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI. Affected...

bring-your-own-key-cve-2026-73678-unauthenticated-rce-in-mindsdb-cowork

CVE-2026-73678 — RCE non autenticata in MindsDB Minds Platform / MindsHub Cowork PoC per CVE-2026-73678 CVSS 3.1 10.0 Critico , AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Analisi completa: www.hunt-benito.com/blog/bring-your-own-key-cve-2026-73678-unauthenticated-rce-in-mindsdb-cowork/ Il sidecar FastA...

darkgrid

DarkGrid – Dashboard Globale di Threat Intelligence Dashboard OSINT di threat intelligence: un globo 3D e un feed in tempo reale che mostrano infrastrutture dannose da fonti pubbliche come AbuseIPDB e OpenPhish. https://github.com/user-attachments/assets/e4f6a4fa-6ff4-4ad1-8e5c-5b50ce6ad722...

BadHost-CVE-2026-48710-Exploit

BadHost – CVE-2026-48710 Scanner Nur-Erkennungs-Scanner für den BadHost -Authentifizierungsumgehungsangriff in Starlette / FastAPI – bei dem die Auth-Middleware request.url.path anstelle von request.scope"path" liest, sodass ein präparierter Host-Header einen erlaubten Pfad einschleusen und die...

enforcement-coverage

تغطية الإنفاذ تكتشف مسارات API التي تحمل تحكمًا في التفويض أضعف من مساراتها الشقيقة. عثرت على CVE-2026-45316 في Open WebUI من الكود المصدري وحده، دون أي معرفة مسبقة بنشرة أمنية: root@kitploit: MISMATCH POST /notes/id/pin notes.py:pinnotebyid 3/3 comparable write operations on note require...