Malware-Exhibit

⚠️⚠️ Malware-Exhibit ⚠️⚠️ !TypeScripthttps:/...

Firebase-Extractor

Firebase-Extractor //Mobile OSINT// هذه الأداة مكتوبة بلغة python2، والغرض منها تحليل جميع النتائج من بحث Bing. بشكل أساسي، عندما يتم العثور على رابط firebaseio لتطبيق، يمكن للمستخدم استخدام هذه الأداة بدلاً من البحث عن البيانات الحساسة يدويًا عبر نتائج البحث. تعمل هذه الأداة باستخدام رابط Fireba...

slicer

Slicer A tool to automate the recon process on an APK file. Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have null permissions and can be externally provoked. Note : The APK has to be extracted via jadx or...

baserunner

Baserunner A tool for exploring and exploiting Firebase datastores. See this post on our blog for an overview of how Firebase works and why we developed this tool. Set up 1. git clone https://github.com/iosiro/baserunner.git 2. cd baserunner 3. npm install 4. npm run build 5. npm start 6. Go to...

baserunner

Baserunner Un outil pour explorer et exploiter les magasins de données Firebase. Voir ce billet sur notre blog pour un aperçu du fonctionnement de Firebase et des raisons pour lesquelles nous avons développé cet outil. Configuration 1. git clone https://github.com/iosiro/baserunner.git 2. cd...

firebaseExploiter

Scanner et Exploit Firebase CLI non sécurisé. Fonctionnalités • Installation • Utilisation Fonctionnalités Analyse de vulnérabilité en masse à partir d'une liste d'hôtes Données JSON personnalisées dans exploit.json à téléverser lors de l'exploitation Chemin d'URI personnalisé pour l'exploitation...

firebase

firebase استغلال قواعد بيانات Firebase الضعيفة أو غير المهيأة بشكل صحيح إخلاء المسؤولية: البرنامج المقدم مخصص للأغراض التعليمية فقط. استخدمه على مسؤوليتك الخاصة، ولا يمكن تحميل المنشئ المسؤولية عن أي أضرار قد تنتج. يُرجى الاستخدام بمسؤولية! المتطلبات الأساسية وحدات بايثون غير قياسية: dnsdumpster...

FireShodanMap

FireShodanMap FireShodanMap هي خريطة زمنية حقيقية تدمج Firebase وShodan. يتم إجراء بحث باستخدام Shodan للبحث عن الأجهزة الضعيفة وتظهر على الخريطة للتحليل. جميع البيانات المحدثة في Firebase تكون في الوقت الفعلي. التغييرات لدينا ملف باسم "fireshodan.py" مسؤول عن ملء قاعدة بيانات Firebase، نحتاج إلى...

telegram_bbbot

telegrambbbot Telegram Bug Bounty Bot https://telegram.me/bugbountychannel History This bot adopted special for deploying to Heroku General purposes of this got - "Be helpful for infosec community!" Bot use https://github.com/maddevsio/bbcrawler for fetching information Used heroku...

telegram_bbbot

telegrambbbot Telegram бот для Bug Bounty https://telegram.me/bugbountychannel История Этот бот адаптирован специально для развертывания на Heroku Общая цель этого бота — «Быть полезным для сообщества infosec!» Бот использует https://github.com/maddevsio/bbcrawler для получения информации В...

CVE-2026-76793

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

CVE-2026-76793 Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

EUVD-2026-64224

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

CVE-2026-76793

The Firebase Authentication WordPress plugin before 1.7.1 fails to verify the email address in a Firebase authentication token before matching it to a WordPress account and issuing a session. This allows unauthenticated attackers to log in as any user, including administrators, by crafting a toke...

EUVD-2026-58506

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-72857

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

PT-2026-71912

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-47364

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

CVE-2026-47364

Summary of CVE-2026-47364 : The Datadog Android app, on every successful login, calls FirebaseCrashlytics.setUserId with the signed-in Datadog UUID (a stable per-user identifier) and ties it to the device’s Firebase installation ID on Google’s backend. Separately, uncaught exceptions are forwarde...

EUVD-2026-54569

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...