EUVD-2026-65348

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...

CVE-2026-77134

CVE-2026-77134 is a Broken Access Control vulnerability in the TYPO3 extension femanager . The extension fails to require the dedicated admin confirmation token when processing an admin-approval request. Instead, a regular user confirmation hash—obtainable by any visitor through the public resend...

CVE-2019-20361-EXPLOIT

CVE-2019-20361-EXPLOIT Es gab einen Fehler im WordPress-Plugin Email Subscribers & Newsletters vor Version 4.3.1, der es ermöglichte, SQL-Anweisungen über den Hash-Parameter an die Datenbank zu übergeben eine blinde SQL-Injection-Schwachstelle. Dieses Skript ist eine „bereinigte Version“ des...

rainbowcrackalack

Rainbow Crackalack Autor: Joe Testa @therealjoetesta Sobre Este projeto produz código de código aberto para gerar tabelas arco-íris, bem como usá-las para consultar hashes de senhas. Embora a versão atual suporte apenas NTLM, versões futuras podem suportar MD5, SHA-1, SHA-256 e possivelmente mais...

fileintel

fileintel Questo è uno strumento usato per raccogliere varie fonti di intelligence per un dato file. Fileintel è scritto in modo modulare, in modo che nuove fonti di intelligence possano essere facilmente aggiunte. I file sono identificati dall'hash del file MD5, SHA1, SHA256. L'output è in forma...

ZeroLogon-Exploit

ZeroLogon - शोषण और उदाहरण परीक्षण PoC को Secura से संशोधित किया गया, CVE-2020-1472, मशीन के पासवर्ड को शून्य करने के लिए। मशीन पर पासवर्ड बदलने के लिए Microsoft के NetrServerPasswordSet2 फ़ंक्शन का उपयोग किया जाता है। यह शोषण Impacket के nrpc.py मॉड्यूल का लाभ उठाता है NetrServerPasswordSet2 को...

CVE-2025-24054_CVE-2025-24071-PoC

CVE-2025-24054 e CVE-2025-24071 - Perdita di Hash NTLM tramite sfruttamento di .library-ms Questa PoC dimostra lo sfruttamento della perdita di hash NTLM tramite file .library-ms su sistemi Windows non patchati Patch Tuesday di marzo 2025. ⚠️ Questo è solo a scopo educativo e di ricerca. Non...

afot

Automation FOrensics Tool Das Automation FOrensics Tool AFOT ist ein in Python erstelltes Automatisierungstool, das für Windows-Forensiken verwendet wird, um die folgenden Tools zu kombinieren: AnalyzePESig http://didierstevens.com/files/software/AnalyzePESigV0002.zip National Software Reference...

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook-

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook- Il 13 febbraio 2024 Microsoft ha pubblicato una grave vulnerabilità di sicurezza in Microsoft Outlook, identificata come CVE-2024-21413, nota come Moniker Link Vulnerability. La vulnerabilità consente a un attaccante di bypassare il meccanismo...

CVE-2024-43451-POC

Descrição Nome : CVE-2024-43451 Pontuação CVSSv3 : 6.5 Versões Afetadas : Todas as versões do Microsoft Windows anteriores ao Patch de Novembro de 2024 CVE-2024-43451 é uma vulnerabilidade de dia zero no Microsoft Windows que permite que atacantes capturem hashes de senha NTLMv2 com interação...

SMB_CVE-2025-24071

CVE-2025-24071 PoC SMB + Metodo di Estrazione TAR Questa è una PoC per sfruttare CVE-2025-24071 , una vulnerabilità in Windows che consente la divulgazione dell'hash NTLM tramite file .library-ms. Questa versione si differenzia leggermente dalle altre utilizzando un archivio .tar invece di .zip,...

CVE-2023-23397-PoW

CVE-2023-23397-PoW Prova di lavoro di CVE-2023-23397 per l'applicazione client Microsoft Outlook vulnerabile. Solo per scopi educativi e di ricerca. Anteprima di CVE-2023-23397 Questa CVE mira a recuperare l'hash NetNTLM dell'utente autenticato dal client Microsoft Outlook versione 2016, ad...

Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure

Automad 2.0.0-alpha.1 to 2.0.0-beta.27 contains a broken access control vulnerability caused by publicly accessible /api/user-collection/create-first-user endpoint returning full serialized user data, letting unauthenticated attackers retrieve bcrypt password hashes of all administrator accounts,...

H3C SSL VPN <=2022-07-10 - Cross-Site Scripting

H3C SSL VPN 2022-07-10 and prior contains a cookie-based cross-site scripting vulnerability in wnm/login/login.json svpnlang. id: CVE-2022-35416 info: name: H3C SSL VPN =2022-07-10 - Cross-Site Scripting author: 0x240x23elu severity: medium description: | H3C SSL VPN 2022-07-10 and prior contains...

SPIP BigUp Plugin - Remote Code Execution

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. id: CVE-2024-8517 info: name: SPIP BigUp Plugin - Remote Code Execution...

WordPress Redux Framework <=4.2.11 - Information Disclosure

WordPress Redux Framework plugin through 4.2.11 is susceptible to information disclosure. The plugin registers several unique AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php. These are predictable, given that they are based on an md5 has...

Lotus Domino R5 and R6 WebMail - Information Disclosure

Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled which is by default allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and t...

Email-exploit-Moniker-Link-CVE-2024-21413-

E-Mail-Exploit Moniker Link-CVE-2024-21413-Module — Dokumentation Übersicht: Ein praktischer PoC, der die Verwendung eines Moniker Links in einer HTML-E-Mail demonstriert, um eine SMB-Verbindung von Outlook auszulösen, sodass der netNTLMv2-Hash eines Opfers über Responder erfasst werden kann. Die...

chalumeau

Chalumeau Chalumeau is automated,extendable and customizable credential dumping tool based on powershell and python. Main Features Write your own Payloads In-Memory execution Extract Password List Dashboard reporting / Web Interface Parsing Mimikatz Dumping Tickets Screenshots Known Issues Parsin...

CVE-2023-3450

CVE-2023-3450 fofa：iconhash="-399311436" Beispiel：http://123.54.231.201:6060 Usage: python3 CVE-2023-3450.py -h, --help python3 CVE-2023-3450.py -u URL, --url URL python3 CVE-2023-3450.py -f FILE, --file FILE...