juicy-php

juicy-php Juicy-php - encuentra archivos de información de PHP con información jugosa...

what-you-reveal

╦ ╦╦ ╦╔═╗╔╦╗ ╦ ╦╔═╗╦ ╦ ╦═╗╔═╗╦ ╦╔═╗╔═╗╦ ║║║╠═╣╠═╣ ║ ╚╦╝║ ║║ ║ ╠╦╝║╣ ╚╗╔╝║╣ ╠═╣║ ╚╩╝╩ ╩╩ ╩ ╩ ╩ ╚═╝╚═╝ ╩╚═╚═╝ ╚╝ ╚═╝╩ ╩╩═╝ 系统分析工具 // 浏览器指纹演示 你所泄露的信息 是一款隐私分析工具，旨在准确展示你的浏览器向网站暴露了哪些信息。它采用复古终端美学设计，并提供基于透明度的可靠指标。 安装 root@kitploit: 克隆仓库 git clone https://github.com/saatvik333/what-you-reveal.git 安装依赖 bun...

vimana-framework

Overview Vimana is a modular security framework for auditing Python APIs and Web applications. The plugin-based architecture enables security professionals to assess, fuzz, and analyze Python projects through automated and manual techniques. Core Capabilities: Vulnerability detection and...

CVE-2026-87028

CVE-2026-87028 is a cross-board Insecure Direct Object Reference (IDOR) in the Board Custom Slot Preview endpoint of Concrete CMS 9.0.0 through 9.5.3 . The endpoint failed to verify that a submitted InstanceItem belonged to the board instance the requesting user was authorized to edit, and did no...

CVE-2026-77411

creationtimestamp| type| source ---|---|--- 2026-09-16 16:11:43+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjq6qwgz24 2026-09-16 18:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnprymag52n...

CVE-2026-90049

creationtimestamp| type| source ---|---|--- 2026-09-16 16:10:43+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjog5vsz2p 2026-09-16 17:40:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnoocmrev2r...

bucket-stream

🚨 Bucket Stream is no longer maintained. If you need support or consultation for your red teaming endeavours, drop me an e-mail [email protected] 🚨 Bucket Stream Find interesting Amazon S3 Buckets by watching certificate transparency logs. This tool simply listens to various certificate...

keycloak-services: keycloak-services: Incomplete fix for arbitrary filesystem path probing via keystore parameters

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...

how2heap

Educational Heap Exploitation This repo is for learning various heap exploitation techniques. We use Ubuntu's Libc releases as the gold-standard. Each technique is verified to work on corresponding Ubuntu releases. You can run apt source libc6 to download the source code of the Libc you are using...

Pantheon

Pantheon 关于 Pantheon Pantheon 是一款 GUI 应用程序，允许用户显示来自不同国家的网络摄像头信息，并为未受保护的摄像头提供集成的实时视频流。 功能 Pantheon 允许用户执行一个 API 爬虫。最初的功能设计是不依赖任何 API（例如 Insecam），但 Google 的服务条款不断干扰原始的抓取机制。 安装 1. git clone https://github.com/josh0xA/Pantheon.git 2. cd Pantheon 3. pip3 install -r requirements.txt 运行：python3...

CVE-2026-92395

creationtimestamp| type| source ---|---|--- 2026-09-16 14:38:26+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mvnejesvw22a 2026-09-16 16:11:55+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjqkpjsk2r 2026-09-16 18:00:12+00:00| seen|...

NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure

The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getitem function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data includi...

Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected...

User Meta WP Plugin < 3.1 - Sensitive Information Exposure

The User Meta is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0 via the /views/debug.php file. This makes it possible for unauthenticated attackers, with to extract sensitive configuration data. id: CVE-2024-33575 info: name: User Meta WP Plugin 3.1 -...

Argo CD Unauthenticated Access to sensitive setting

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. id: CVE-2024-37152 info: name: Ar...

WyreStorm Apollo VX20 - Information Disclosure

An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext credentials for the SoftAP access point Router /device/config using an HTTP GET request. id: CVE-2024-25735 info: name: WyreStorm Apollo VX20 - Information Disclosure author: johnk3r...

PHPIPAM <v1.5.1 - Missing Authorization

In phpIPAM 1.5.1, an unauthenticated user could download the list of high-usage IP subnets that contains sensitive information such as a subnet description, IP ranges, and usage rates via findfullsubnets.php endpoint. The bug lies in the fact that findfullsubnets.php does not verify if the user i...

Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection

Alt-n/MDaemon Security Gateway through 8.5.0 is susceptible to XML injection via SecurityGateway.dll?view=login. An attacker can inject an arbitrary XML argument by adding a new parameter in the HTTP request URL. As a result, the XML parser fails the validation process and discloses information...

Redash Setup Configuration - Default Secrets Disclosure

Redash Setup Configuration is vulnerable to default secrets disclosure Insecure Default Initialization of Resource. If an admin sets up Redash versions =10.0 and prior without explicitly specifying the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables, a default value is used for both...

MicroStrategy Library <11.1.3 - Cross-Site Scripting

MicroStrategy Library before 11.1.3 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...