CISA-KEV

CISA-KEV Executive Summary This repository provides automated tracking and analysis of both CISA's KEV and VulnCheck KEV catalogs, cross-referenced with Nuclei security templates and public proof-of-concept exploits. By integrating VulnCheck KEV, coverage expands from 1,557 to 4,720 total unique...

CVE-2026-15409-15410-Framework

1 CVE-2026-15409 | 2 CVE-2026-15410 SonicWall SMA1000 - SSRF → Erlang RCE → Root Privesc Фреймворк для эксплуатации и инструмент безопасного обнаружения ! Только этичное использование — авторизованные тесты Этот репозиторий предоставляет инструменты исключительно для авторизованных специалистов п...

rxerium-templates

Курируемая коллекция из 144+ шаблонов Nuclei , ориентированных на zero-day и активно эксплуатируемые уязвимости в дикой природе , а также несколько прочих шаблонов. Шаблоны используют пассивные методы обнаружения сопоставление версий/дат и организованы по годам для удобной навигации. ⚠️ Примечание...

CVE_Prioritizer

CVE Prioritizer CVE Prioritizer — это мощный инструмент, который помогает расставлять приоритеты при установке исправлений уязвимостей, объединяя CVSS, EPSS, Известные эксплуатируемые уязвимости от CISA и общественные ресурсы VulnCheck NVD++, KEV. Он предоставляет ценную информацию о вероятности...

CVE-2025-8875-CVE-2025-8876

CVE-2025-8875 & CVE-2025-8876 이 탐지 방법은 어떻게 작동하나요? 버전 탐지 템플릿 - 2025.3.1.9 또는 이전 버전을 실행 중인 모든 시스템은 CVE-2025-8875 및 CVE-2025-8876에 취약한 것으로 간주됩니다. 이 스크립트를 어떻게 실행하나요? 1. 여기에서 Nuclei를 다운로드합니다. 2. 템플릿을 로컬 시스템에 복사합니다. 3. 다음 명령을 실행합니다: nuclei -u https://yourHost.com -t template.yaml 참고 자료...

SploitScan

SploitScan 📜 Описание SploitScan — это мощный и удобный инструмент, предназначенный для упрощения процесса поиска эксплойтов для известных уязвимостей и оценки вероятности их эксплуатации. Он предоставляет специалистам по кибербезопасности возможность быстро находить и применять известные и...

CVE-2026-60206-PoC-Exploit

CVE-2026-60206 - Oracle WebLogic SAML 인증 우회 익스플로잇 프레임워크-툴킷 Oracle WebLogic Server — SAML 인증 우회 → 관리자 권한 탈취 익스플로잇 프레임워크 및 대량 스캐너 승인된 보안 테스트 전용입니다. ⚖️ 법적 고지 및 책임 있는 사용 이 도구는 교육 및 승인된 침투 테스트 목적으로만 제공됩니다. 저자와 기여자는 이 소프트웨어의 오용 또는 피해에 대해 책임을 지지 않습니다. 사용자는 테스트 전에 대상 소유자로부터 명시적인 서면 허가를 받았는지 전적으로 책임집니다...

fleet-cve-scanner

fleet-cve-scanner Сканер CVE с открытым исходным кодом для флотов, управляемых через RMM. Один скрипт на чистом PowerShell 7, без агентов, без серверных компонентов, без лицензионных отчислений. Он отвечает на один вопрос для каждого программного обеспечения на каждом управляемом устройстве:...

Cisa-KEV-Threat-Intel-Orchestrator

CISA KEV Threat Intel Orchestrator Конвейер с нулевым касанием, который еженедельно автоматически превращает новые вооружённые CVE из каталога CISA Known Exploited Vulnerabilities KEV в готовые к эксплуатации Sigma-правила обнаружения. Проблема Ручное превращение новой записи KEV в работающее...

fad-checker

fad-checker AKA F ormidable A uditor's D ependency C hecker AKA F uckin' A utonomous D ependency C hecker fad-checker is a polyglot dependency auditor built for professional code audits. It scans 10 ecosystems + 9 CMS/Frameworks WordPress, Drupal, Symfony, Laravel… in one pass, with no build tool...

Oracle Business Intelligence/XML Publisher - XML External Entity Injection

Oracle Business Intelligence and XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 are vulnerable to an XML external entity injection attack. id: CVE-2019-2616 info: name: Oracle Business Intelligence/XML Publisher - XML External Entity Injection author: pdteam severity: high description: Oracle...

QNAP QTS and Photo Station 6.0.3 - Remote Command Execution

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions. id: CVE-2019-7192 info: name: QNAP QTS and Photo Station 6.0.3 - Remote Command Execution...

SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...

WordPress Social Warfare <3.5.3 - Cross-Site Scripting

WordPress Social Warfare plugin before 3.5.3 contains a cross-site scripting vulnerability via the wp-admin/admin-post.php?swpdebug=loadoptions swpurl parameter, affecting Social Warfare and Social Warfare Pro. id: CVE-2019-9978 info: name: WordPress Social Warfare 3.5.3 - Cross-Site Scripting...

SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass

SimpleHelp = 5.5.15 and 6.0 pre-release contain an authentication bypass caused by lack of cryptographic signature verification in OIDC tokens, letting remote unauthenticated attackers gain technician sessions, exploit requires OIDC authentication configured. id: CVE-2026-48558 info: name:...

Mingsoft MCMS v5.2.7 - SQL Injection

Mingsoft MCMS v5.2.7 contains an SQL injection vulnerability via /cms/content/list that allows unauthenticated attackers to execute arbitrary SQL commands on the affected database server. id: CVE-2022-26585 info: name: Mingsoft MCMS v5.2.7 - SQL Injection author: ritikchaddha severity: critical...

WP Hotel Booking < 1.10.4 - PHP Object Injection

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpresshotelbooking1 cookie in load in includes/class-wphb-sessions.php. id: CVE-2020-29047 info: name: WP Hotel Booking 1.10.4 - PHP Object...

GLPI <=10.0.2 - Remote Command Execution

GLPI through 10.0.2 is susceptible to remote command execution injection in /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module. id: CVE-2022-35914 info: name: GLPI =10.0.2 - Remote Command Execution author: For3stCo1d,allendemoura severity: critical description: | GLPI through 10.0...

PHPSHE 1.7 - SQL Injection

A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication. id: CVE-2019-9762 info: name: PHPSHE 1.7 - SQL Injection author: DhiyaneshDK severity: critical description: | A SQL Injection was...

UniFi OS - Authentication Bypass via Path Traversal (..%2f)

UniFi OS devices contain an improper access control vulnerability caused by insufficient authorization checks, letting network attackers make unauthorized system changes, exploit requires network access. id: CVE-2026-34908 info: name: UniFi OS - Authentication Bypass via Path Traversal ..%2f...