wifi_db

!Contributorshttp...

Signal K Server <= 2.18.0 - Information Disclosure

Signal K Server versions up to and including 2.18.0 expose the /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer endpoints without authentication. These routes were missing from the authentication middleware configuration, letting any unauthenticated user retrieve the ful...

WireTapper

📡 WireTapper !NOTE Wireless OSINT & Signal Intelligence Platform WireTapper is a wireless OSINT tool designed to discover, map, and analyze radio-based devices using passive signal intelligence. It provides investigators, researchers, and security analysts with real-time visibility into the...

machine_learning_security

Machine Learning and Security Source codes about machine learning and security. Line up. Cyber security and Machine Learning course The elementary training course of Machine learning for security engineer. Vulnerabilities of Machine Learning Summary of Machine Learning vulnerability. Analytics...

HashCheck

PasswordHashCheck This project aims to assist in the search for leaked passwords while maintaining a high level of privacy using the k-anonymity method. To achieve this, the APIs of different services are used, sending only a part of the Hash of the password we want to check, for example, the fir...

cve-2025-66398

⚠️ cve-2025-66398 - Simple RCE Proof of Concept Tool ⚙️ About This Tool This project demonstrates a remote code execution RCE vulnerability in Signal K Server versions 2.18.0 and earlier. The proof of concept PoC shows how an attacker could run commands on a vulnerable device. This tool is designed...

cve-2025-66398

CVE-2025-66398 — Signal K Server RCE PoC 📜 Description CVE-2025-66398 is a Signal K Server issue where an unauthenticated attacker can poison the server’s restore state via /skServer/validateBackup, then hijack config via /skServer/restore to inject a backdoor admin account and optionally achieve...

nebulousAD

⚠️ A Note to NebulousAD Users As of April 14th, NuID will no longer be hosting the NebulousAD API that this code communicates with. As a small team of developers, we've found it isn't feasible to actively support, monitor, and develop both the NebulousAD portal as well as our Authentication...

Unlearnable-Clusters

Unlearnable Clusters: Towards Label-agnostic Unlearnable Examples Code relative to "Unlearnable Clusters: Towards Label-agnostic Unlearnable Examples", CVPR2023. Preprocess First, run preprocess.py to rename the dataset directory python preprocess.py --config config/preprocess.yaml -f rename...

Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution

Summary Path traversal in the Signal K resources and applicationData APIs lets an unauthenticated or low-privileged user read, write and delete files outside the storage root. Reading /security.json discloses the JWT signing secret, enabling admin token forgery and remote code execution. Details...

CVE-2025-49125

Issue Finder: Greg Khttps://github.com/gregk4sec...

EUVD-2026-112491

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

CVE-2026-118690

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

CVE-2026-118690 Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

CVE-2026-118690

The Signal K Server version before 2.33.0 is vulnerable to a missing authentication flaw in the /skServer/ziplogs endpoint. This vulnerability allows unauthenticated remote attackers to download log archives containing a security.json file. By extracting the JWT secretKey from this file, an attac...

CVE-2026-118690 Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

CVE-2026-118690: SignalK signalk-server: Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote…

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

CVE-2026-115999

A vulnerability has been found in mansi-k RestaurantIMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqliconnect of the file lsmodal.php. The manipulation of the argument loginid/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follo...

CVE-2026-115999

A SQL injection vulnerability exists in mansi-k Restaurant_IMS (d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694). The flaw is located in the mysqli_connect function within the lsmodal.php file, where the manipulation of the login_id/epsw arguments allows for remote exploitation . Due to a rolling releas...

EUVD-2026-109328

A vulnerability has been found in mansi-k RestaurantIMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqliconnect of the file lsmodal.php. The manipulation of the argument loginid/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follo...