EVABS

EVABS（极度脆弱的Android实验室） 一款开源的Android应用，故意设计存在漏洞，作为Android应用安全初学者的学习平台。旨在以故事化、互动式的模式，引导零基础或几乎零基础的初学者了解一些常见且真实世界中基于Android应用的主要漏洞。EVABS采用逐级难度递进的方式，每个关卡玩家将学习一个新概念。本项目仍在开发中，目标是纳入尽可能多的关卡。 如需完整详情和解决方案，请访问博客系列。 安装 从发布页面下载最新的应用文件。 安装到Android设备（建议root）或模拟器中。 （更多信息请访问此博客） 屏幕截图： 要求...

WebGoat.NET

Webgoat.NET Código fuente: https://github.com/jerryhoff/WebGoat.NET Descargar zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master Esta aplicación web es una plataforma de aprendizaje que intenta enseñar sobre fallos comunes de seguridad web. Contiene fallos de seguridad genéricos que...

HaccTheHub

HaccTheHub 开源自托管网络安全学习平台 关于项目 HaccTheHub 是一个提供网络安全的开源项目 HaccTheHub 系统由三部分组成： Docker：包含所有创建学习环境的箱子（boxes）。 后端：控制 Docker，负责启动/销毁系统中的单个箱子，并管理将它们连接成统一系统的网络。 前端：用户通过 Web 浏览器与系统交互的图形界面。 构建工具 Flask-RESTX Next.js 开始上手 要让 HaccTheHub 运行起来，你需要进行以下设置： 先决条件 Docker（请参考 Docker 文档 进行设置） Python 3（下载）或直接通过包管理器安装...

WebGoat.NET

Webgoat.NET Código fuente: https://github.com/jerryhoff/WebGoat.NET Descargar zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master Esta aplicación web es una plataforma de aprendizaje que intenta enseñar sobre vulnerabilidades de seguridad web comunes. Contiene fallos de seguridad genéric...

Cappriciosec-University

📚 Cappriciosec University – La primera plataforma de e-learning para hackers de la India Cappriciosec University es la primera plataforma de e-learning de la India para hackers, principiantes en ciberseguridad y cazadores de bug bounty. Nos centramos en hacking ético, pruebas de penetración,...

CVE-2026-63230

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...

PT-2026-65705

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

CVE-2026-65463

CVE-2026-65463 affects the WordPress Masteriyo LMS plugin, versioned up to 2.3.1, with an Insecure Direct Object References (IDOR) vulnerability in Subscriber scope. The entry provides a CVSS 3.1 base score of 5.4 (Medium) with network attack vector, low attack complexity, and requires low privil...

PYSEC-2026-1644 MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with...

The vulnerability of the REST API interface of the H2O machine learning platform allows a perpetrator to execute arbitrary code.

The vulnerability of the REST API interface of the H2O machine learning platform is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the H2O machine learning platform, related to deficiencies in the deserialization mechanism, allows attackers to bypass security restrictions, disclose sensitive information, and execute arbitrary code.

The vulnerability of the H2O machine learning platform is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to circumvent security restrictions, disclose sensitive information, and execute arbitrary code...

CVE-2021-47907

Rocket LMS 1.1 contains a persistent cross-site scripting vulnerability in the support ticket module that allows authenticated users to inject malicious script code through the title parameter. Attackers can submit support tickets with embedded HTML/JavaScript payloads that execute in the browser...

CoreExploit-Final

CoreExploit 🔐 Ethical Penetration Testing Learning Platfor...

📄 GUnet OpenEclass E-learning Remote Code Execution

GUnet OpenEclass E-learning versions prior to 4.2 suffer from a remote code execution vulnerability. Exploit Title: GUnet OpenEclass E-learning platform """ def banner: printf'''YELLOW ┏━╸╻ ╻┏━╸ ┏━┓┏━┓┏━┓┏━┓ ┏━┓┏━┓┏━┓╻ ╻╺┓ ┃ ┃┏┛┣╸ ╺━╸┏━┛┃┃┃┏━┛┣━┓╺━╸┏━┛┏━┛┏━┛┗━┫ ┃ ┗━╸┗┛ ┗━╸ ┗━╸┗━┛┗━╸┗━┛ ┗━╸┗━╸┗━╸...

CVE-2026-31939

Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $REQUEST'test' is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerabilit...

CVE-2026-33708

Chamilo LMS is a learning management system. Prior to 1.11.38, the getuserinfofromusername REST API endpoint returns personal information email, first name, last name, user ID, active status of any user to any authenticated user, including students. There is no authorization check. This...

CVE-2026-33879

Federated Learning and Interoperability Platform FLIP is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTCHA, enabling brute-force and...

CVE-2026-33879

Federated Learning and Interoperability Platform FLIP is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTCHA, enabling brute-force and...

CVE-2026-33879 FLIP doesn't have rate limiting or brute-force protection on login

Federated Learning and Interoperability Platform FLIP is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTCHA, enabling brute-force and...

CVE-2026-33879

CVE-2026-33879 affects the Federated Learning and Interoperability Platform (FLIP). Technical details across sources show that FLIP versions prior to 0.1.1 expose the login page without rate limiting or CAPTCHA, enabling brute-force and credential-stuffing attacks. This affects external users and...