phantom-frida

phantom-frida phantom-frida builds Android Frida Server and Gadget from source while changing a targeted set of observable runtime identifiers. It is a builder and verification harness, not a promise that every application-specific detection method is defeated. The current compatibility target is...

androguard

Androguard Do you think your phone has been pwned ? please check IsMyPhonePwned New tool: Goauld Dynamic injection tool for Linux/Android See the new version of Androguard: https://github.com/androguard/androguard/tree/ng Installation Quick installation: root@kitploit: pip install androguard...

socid-extractor

socidextractor Превратите любую публичную страницу профиля в структурированную запись аккаунта — имена пользователей, отображаемые имена, биографии, аватары, местоположения, даты регистрации, количество подписчиков, внешние ссылки и стабильные внутренние идентификаторы , которые однозначно...

OpenProject < 12.5.4 - Project Identifiers Exposure

OpenProject versions before 12.5.6 generate a publicly accessible robots.txt file revealing project identifiers, even if the instance is set to 'Login required', letting attackers gather project info, exploit requires no authentication. id: CVE-2023-33960 info: name: OpenProject 12.5.4 - Project...

CVE-2021-42694

CVE-2021-42694 最近公開されたホモグリフ攻撃の脆弱性を利用して悪意のあるファイルを生成します。この脆弱性は、少なくとも C、C++、C、Go、Python、Rust、JS などで発見されています。 cve.mitre.org より引用 Unicode仕様14.0までの文字定義に問題が発見されました。この仕様により、攻撃者はホモグリフを使って、視覚的には対象の識別子と同一に見える関数名などのソースコード識別子を生成できます。攻撃者はこれを利用して、下流ソフトウェアで欺瞞的に呼び出される上流ソフトウェア依存関係内の敵対的識別子定義を介してコードを注入できます。...

CVE-2026-11107-Insecure-Direct-Object-Reference-with-Predictable-UUIDv1

CVE-2026-11107 – 예측 가능한 UUIDv1을 통한 안전하지 않은 직접 객체 참조 프로그램 코드 Python Flask root@kitploit: idorserver.py - API with UUIDv1 user IDs import uuid, time from flask import Flask, request, jsonify app = Flaskname Generate predictable UUIDv1 based on timestamp + MAC users = struuid.uuid1: "name": "Alice",...

CVE-2025-69727

CVE-2025-69727 Поставщик продукта INDEX-EDUCATION Затронутая кодовая база продукта PRONOTE - 202X.X.X 2025.2.8 Описание В INDEX-EDUCATION PRONOTE до версии 2025.2.8 существует уязвимость неправильного контроля доступа. Затронутые компоненты composeUrlImgPhotoIndividu позволяют создавать прямые...

CVE-2026-11375

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers...

EUVD-2026-83036

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers...

CVE-2026-11375

IBM MQ (Server component) and IBM MQ Appliance are affected by a stack buffer overflow triggered when processing XA transaction identifiers , allowing an authenticated remote attacker to cause denial of service or potentially execute arbitrary code (CVSS 8.8, CWE-122). Affected versions span IBM ...

CVE-2026-11375 IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers...

CVE-2026-92809

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs...

CVE-2026-92765

ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can supply arbitrary scan identifiers to retrieve complete web vulnerability data including titles,...

CVE-2026-92809 PrestaShop psgdpr through 1.4.3 GDPR Log Forgery

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs...

CVE-2026-92605

IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to...

CVE-2026-84612

An authorization issue was addressed with improved access control. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to read persistent device identifiers...

CVE-2026-84612

An authorization issue was addressed with improved access control. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to read persistent device identifiers...

EUVD-2026-77960

An authorization issue was addressed with improved access control. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to read persistent device identifiers...

CVE-2026-84612

CVE-2026-84612 is an authorization issue in Apple's DeviceCheck component that allows an app to read persistent device identifiers . The flaw was addressed with improved access control and is fixed across iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Taho...

Astra Linux – Vulnerability in Zabbix

When a URL is added to the map element, it is recorded in the database with a sequential ID. When adding a new URL, the system retrieves the previous value of the sysmapelementurlid and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by...