Name-That-Hash

➡️ Discord | Website ⬅️ The Modern Hash Identification System pip3 install name-that-hash && nth Web App with no install needed 🤔 What is this? Have you ever come across a hash such as 5f4dcc3b5aa765d61d8327deb882cf99 and wondered what type of hash that is? 🤔 Name-that-hash will name that hash...

novahot

novahot novahotはペネトレーションテスター向けのウェブシェルフレームワークです。JSONベースのAPIを実装しており、任意の言語で書かれたトロイの木馬と通信できます。デフォルトでは、PHP、Ruby、Pythonで書かれたトロイの木馬が付属しています。 システムコマンドの実行に加えて、novahotはmysql、sqlite3、psqlなどのインタラクティブターミナルをエミュレートできます。また、「仮想コマンド」を実装しており、ユーザーが好みのアプリケーションを使用してリモートファイルのアップロード、ダウンロード、編集、表示をローカルで行うことができます。 インストール...

CVE-2024-6624

CVE-2024-6624 | JSON API User = 3.9.3 - 未认证的权限提升 这是一个 Python 脚本，用于利用 WordPress 的 JSON API User = 3.9.3 插件中的 CVE-2024-6624 漏洞。该工具允许未认证的攻击者注册新用户，并在未经授权的情况下将其权限提升为管理员。 使用方法 准备 1. 确保你的系统上安装了 Python 2.7。 2. 安装 requests 依赖： root@kitploit: pip install requests 3. 准备一个包含目标 URL 列表的文本文件（urls.txt）（每行一个 URL）...

Mass-Scanner-CVE-2026-1405

⚡ Mass-Scanner-CVE-2026-1405 Escáner Masivo Limpio de WordPress para CVE-2026-1405 🧠 Descripción General Un escáner limpio y ligero diseñado para comprobar la exposición a CVE-2026-1405 en múltiples objetivos WordPress. Se centra en: escaneo masivo rápido de múltiples objetivos salida limpia en...

CVE-2024-6624

CVE-2024-6624 JSON API User = 3.9.3 - 未认证权限提升 描述 JSON API User 插件（WordPress）在所有版本（包括 3.9.3）中存在权限提升漏洞。这是由于对自定义用户元字段的控制不当所致。这使得未认证的攻击者可以在站点上注册为管理员。该插件还需要同时安装 JSON API 插件。 root@kitploit: State: PUBLISHED Score: 9.8 CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Privileges: None Attack Vector: No...

CVE-2026-75162

An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentia...

EUVD-2026-71452

An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentia...

CVE-2026-54569

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

GHSA-JRW6-7X4Q-W25J senaite.core Vulnerable to Eval Injection and Missing Authorization

Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...

senaite.core Vulnerable to Eval Injection and Missing Authorization

Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...

CVE-2026-54569 SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

CVE-2026-54569 SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

CVE-2026-54569

SENAITE.CORE (versions 2.0.0–2.6.0), the core framework for the SENAITE laboratory information management system, permits unauthenticated remote code execution through a two-request chain. State-changing JSON API routes in update.py fail to enforce the senaite.core: Access JSON API permission bef...

PT-2026-82209

Name of the Vulnerable Software and Affected Versions SENAITE.CORE versions 2.0.0 through 2.6.0 Description An unauthenticated remote code execution issue exists in the SENAITE JSON API due to a chain of missing authorization and unsafe evaluation of input. The state-changing routes in...

MINI-Q97P-7R8M-562R

Bulletin has no description...

📄 WordPress JSON API User 3.9.2 Unauthenticated Privilege Escalation

WordPress JSON API User plugin version 3.9.2 contains an unauthenticated privilege escalation to administrator vulnerability through Mass-Assignment. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrate...

GHSA-PJHX-3C3W-9V23 API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

Impact ApiPropertysecurity: ... is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context'cachekey', which is set unconditionally before delegati...

CVE-2026-9626

The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the postcomment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the postcomment function, which passes the attacker-controlled...

CVE-2026-9626

The CVE-2026-9626 entry concerns the WordPress JSON API User plugin (

CVE-2026-9626

The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the postcomment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the postcomment function, which passes the attacker-controlled...