EUVD-2026-95406

TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media...

MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

Description With the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out...

uncover

Quickly discover exposed hosts on the internet using multiple search engines. Features • Installation • Usage • Configuration • Running Uncover • Join Discord uncover is a go wrapper using APIs of well known search engines to quickly discover exposed hosts on the internet. It is built with...

CVE-2020-0688-Scanner

CVE-2020-0688-Scanner CVE-2020-0688을 여러 호스트에서 비침습적 방식으로 확인하기 위한 빠른 C 도구입니다. 기능 입력 파일에서 호스트 스캔 수동적 확인: HTML 콘텐츠를 스크래핑하여 Exchange 버전 획득 출력 파일 생성 데모 사용 방법 사전 요구 사항 Windows .NET framework 4.5.2 다운로드 git clone https://github.com/onSec-fr/CVE-2020-0688-Scanner.git 실행 ./CVE-2020-0688-Scanner.exe...

trufflehog

TruffleHog Find leaked credentials. 🔎 Now Scanning ...and more To learn more about TruffleHog and its features and capabilities, visit our product page. 🌐 TruffleHog Enterprise Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint and more for...

CVE-2020-0688

CVE-2020-0688 に対して脆弱な Exchange サーバーを特定する CVE-2020-0688 は、静的キーの使用が原因で Microsoft Exchange に存在する重大な脆弱性です。悪用には メールユーザーレベルの 有効な資格情報が必要であり、大量悪用のリスクは低いものの、この脆弱性は SYSTEM レベルの RCE につながるため、標的型攻撃で非常に有用となる可能性があります。 詳細情報: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688...

CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 私たちは、テロ組織ハマスによって人質に取られたすべての市民の安全な帰還を要求します。すべての人質が解放され、無事に帰宅するまで、私たちは休むことはありません。あなたも彼らを家に連れ戻す手助けができます。https://stories.bringthemhomenow.net/ CVE-2024-34102 PoC 🚀 このリポジトリには、Magento における重大な XML...

envy

빠른 시작 • 설정 • 명령어 • 키 바인딩 • FAQ • 문서 API 키, 시크릿, 환경 변수를 관리하기 위한 안전한 암호화 볼트입니다. 터미널에서 작업하는 개발자를 위해 만들어졌습니다. Envy란? 저는 .env 파일을 관리하고 비밀번호 관리자, 포스트잇, Slack 스레드에 시크릿을 흩어놓는 데 지쳐서 Envy를 만들었습니다. 시크릿을 탐색할 수 있는 매끄러운 TUI와 자동화를 위한 CLI를 모두 제공하는 단일 바이너리입니다. 다음과 같은 기능을 제공합니다: 실제 암호화 — base64 난독화가 아닌 Argon2id를 사...

gpg_reaper

GPG Reaper TL;DR: Obtain/Steal/Restore GPG Private Keys from gpg-agent cache/memory This POC demonstrates method for obtaining GPG private keys from gpg-agent memory under Windows. Normally this should be possible only within 10 minutes time frame --default-cache-ttl value. Unfortunately...

agent-vault-proxy

Keys on the Wire 당신의 AI 에이전트는 API 키를 절대 보유하지 않습니다. 플레이스홀더를 보내고, 실제 비밀값은 전송 중에 교체됩니다. 자격 증명 탈취 도구Shai-Hulud 및 유사 도구와 프롬프트 인젝션 에이전트가 당신의 비밀을 유출하는 것을 차단합니다. 손상된 에이전트는 가져갈 것이 없습니다. 작동 방식 1. 에이전트가 플레이스홀더 를 포함한 요청을 보냅니다. 실제 키가 아닙니다. 2. Keys on the Wire가 전송 중에 볼트에서 실제 비밀값을 교체합니다. 3. 에이전트는 키를 절대 볼 수 없습니다...

hashcat

hashcat hashcat is the world's fastest and most advanced password recovery utility, supporting five unique modes of attack for over 300 highly-optimized hashing algorithms. hashcat currently supports CPUs, GPUs, and other hardware accelerators on Linux, Windows, and macOS, and has facilities to...

hostintel

hostintel This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. The output is in CSV...

fileintel

fileintel This is a tool used to collect various intelligence sources for a given file. Fileintel is written in a modular fashion so new intelligence sources can be easily added. Files are identified by file hash MD5, SHA1, SHA256. The output is in CSV format and sent to STDOUT so the data can be...

swap_digger

swapdigger swapdigger is a bash script used to automate Linux swap analysis for post-exploitation or forensics purpose. It automates swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, HTTP basic authentication, WiFi SSID and keys, etc. Download and run...

CVE-2026-41940

Watch Tower POCに基づき、 Websocketを介した直接シェルアクセスをサポートし、永続化のためにルートAPIキーを追加します。...

actions-secrets

SecureStack 密钥分析 GitHub Action 一个用于分析源代码中是否存在密钥、凭据、API 密钥、服务器和数据库主机名/URL 等更多内容的 GitHub Action！当你将此 Action 添加到 GitHub Actions 后，我们将分析你的源代码，确保你的提交中不包含敏感数据。请参阅下文了解我们扫描的特定凭据类型和文件。 name: Example SecureStack Secrets Analysis GitHub Action on: push jobs: security: runs-on: ubuntu-latest steps: - name:...

CVE-2026-14483_exploit

CVE-2026-14483 — Realtyna WPL / Organic IDX における認証なし任意ファイルアップロード → RCE 認証なしの任意ファイルアップロードにより、Realtyna WPL / Organic IDX WordPress プラグイン real-estate-listing-realtyna-wpl ≤ 5.2.0 で RCE に至ります。 このプラグインは、WordPress の公開 init フックに 「I/O サービス」 を登録しており、 サイトルートで ?wplview=io&wplformat=io を介して認証なしで 到達可能です。唯一の関門...

XPKeygen

XPKeygen Windows XP / Windows Server 2003 VLK キージェネレーターです。このツールを使用すると、 Raw Product Key に基づいて 有効な Windows XP キー を生成できます。このキーはランダムでかまいません。 Raw Product Key RPK は、9桁の XXX-YYYYYY の形式で提供され、Windows XP キーを生成するためにのみ必要です。 ダウンロード Releases タブに移動して、そこから最新バージョンをダウンロードしてください。 計画 このプロジェクトは終了していません —...

aes-finder

AES Finder Utility to find AES keys in running process memory. Works for 128, 192 and 256-bit keys. Usage Open aes-finder.sln solution in Visual Studio 2013 to compile source. Alternatively use gcc/clang: g++ -O3 -march=native -fomit-frame-pointer aes-finder.cpp -o aes-finder To search for keys i...

CVE-2023-34039

CVE-2023-34039 CVE-2023-34039 VMWare Aria Operations for Networks vRealize Network Insight 정적 SSH 키 RCE를 위한 POC 기술 분석 취약점에 대한 근본 원인 분석은 제 블로그에서 확인할 수 있습니다: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-34039/ 요약 VMWare Aria Operations for Networks vRealize Network Insig...