deep-C

Deep-C Deep-C is an Android Deep Link Exploitation Framework that automatically decompiles APKs, identifies exposed and insecure deep link entry points, validates exploitability using static analysis and optional AI verification , and generates executable adb Proof-of-Concepts PoCs. Deep-C is...

CVE-2021-25374_Samsung-Account-Access

CVE-2021-25374 - Samsung Account Access Script This script can be used to gain access to a victim's Samsung Account if they have a specific version of Samsung Members installed on their Samsung Device, and if the victim's device is from the US or Korea region. How to use this script: 1. Host a we...

vulnhawk

AI-powered code security scanner that finds vulnerabilities Semgrep and CodeQL miss. Quick Start • GitHub Action • Comparison • Languages • FAQ The Problem Traditional SAST tools rely on pattern matching and AST rules. They excel at catching known vulnerability patterns, but they fundamentally...

clawguard

🦞 ClawGuard v3 Enterprise AI Agent Security Toolkit - SKILL.md Driven Active Defense Core Concept The core defense of ClawGuard v3 is not in the code, but in SKILL.md! Each module's SKILL.md itself is a complete defense guide: Tells the Agent when to trigger Guides the Agent how to detect Provide...

CVE-2014-8609-exploit

CVE-2014-8609-exploit During the study of pending intent exploitation, I created my PoC application of CVE-2014-8609 Reference: 1. https://seclists.org/fulldisclosure/2014/Nov/81 2. https://github.com/locisvv/Vulnerable-CVE-2014-8609...

CVE-2026-20516

CVE-2026-20516: MiracastService confused deputy on Android TV Research and disclosure by Davide Di Matteo @Dingo97. This is my first credited CVE. I found an improperly exported, system-privileged Miracast service while researching a PEAQ Android TV. A caller can supply an intent extra that makes...

CVE-2026-105208

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

CVE-2026-105208 ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

CVE-2026-105208

ZITADEL versions 4.x before 4.17.3 and 3.x through 3.4.15 are vulnerable to session hijacking due to the use of unauthenticated, malleable encryption for IdP intent tokens. This flaw allows authenticated users to tamper with their own tokens to be accepted for another user's external login intent...

CVE-2026-105208 ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

PT-2026-104632

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

CVE-2026-12960

CVE-2026-12960 Improper Export of Android Application Components in the ASUS Router App A component bundled in the ASUS Router Android app com.asus.aihome was declared android:exported="true" with no android:permission. Any other app on the same device, holding zero permissions, could send it a...

Reactivating Alignment: Defending LLMs from Jailbreaks Via Intention-Aware Input-Output Matching

Large language models LLMs remain vulnerable to jailbreak attacks that conceal harmful intent within complex adversarial prompts. Existing defenses primarily rely on input perturbation or harmful-output suppression, but they rarely model where malicious intent resides, resulting in brittle...

xiaomi-cve-2024-45352

xiaomi-cve-2024-45352 Informe técnico sobre vulnerabilidad crítica de Xiaomi Resumen de la vulnerabilidad Se descubrió una vulnerabilidad en el navegador predeterminado de Xiaomi com.android.browser en varios dispositivos MIUI. La aplicación no valida correctamente los intents pasados mediante...

CVE-2023-31014_Lab

CVE-2023-31014 Implicit Intent Hijacking Lab An educational Android Lab created based on the public report of CVE-2023-31014 in NVIDIA GeForce NOW for Android. It does not include NVIDIA source code, actual Action strings, or real authentication credentials. Facts confirmed from the public report...

CVE-2020-23349_Lab

CVE-2020-23349 Android Lab An educational project that reproduces the Intent Redirection vulnerability in Sina Weibo Android SDK 4.2.7 locally. Use only on authorized test devices or emulators. Do not use it against real user apps. Structure victim: vulnerable app that includes the actual...

BadIntent

BadIntent Introduction BadIntent is the missing link between the Burp Suite and the core Android's IPC/Messaging-system. BadIntent consists of two parts, an Xposed-based module running on Android and a Burp-plugin. Based on this interplay, it is possible to use the Burp's common workflow and all...

PT-2026-104140

Name of the Vulnerable Software and Affected Versions LatePoint | Calendar & Scheduling for WordPress versions prior to 5.7.2 Description An Insecure Direct Object Reference exists via the OsPaypalConnectController::create order for transaction action, which is registered as a public route throug...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration vulnerability

Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration vulnerability discovered by Niv Kochan, Matan Bachar in WordPress Plugin LatePoint versions = 5.7.1...

TheLastBundleMismatch

Mysterious patch Let's start this time with the patch that appeared as fix for CVE-2023-45777 in Android Security Bulletin: diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java b/services/core/java/com/android/server/accounts/AccountManagerService.java index...