HaccTheHub

HaccTheHub 开源自托管网络安全学习平台 关于项目 HaccTheHub 是一个提供网络安全的开源项目 HaccTheHub 系统由三部分组成： Docker：包含所有创建学习环境的箱子（boxes）。 后端：控制 Docker，负责启动/销毁系统中的单个箱子，并管理将它们连接成统一系统的网络。 前端：用户通过 Web 浏览器与系统交互的图形界面。 构建工具 Flask-RESTX Next.js 开始上手 要让 HaccTheHub 运行起来，你需要进行以下设置： 先决条件 Docker（请参考 Docker 文档 进行设置） Python 3（下载）或直接通过包管理器安装...

EVABS

EVABS（极度脆弱的Android实验室） 一款开源的Android应用，故意设计存在漏洞，作为Android应用安全初学者的学习平台。旨在以故事化、互动式的模式，引导零基础或几乎零基础的初学者了解一些常见且真实世界中基于Android应用的主要漏洞。EVABS采用逐级难度递进的方式，每个关卡玩家将学习一个新概念。本项目仍在开发中，目标是纳入尽可能多的关卡。 如需完整详情和解决方案，请访问博客系列。 安装 从发布页面下载最新的应用文件。 安装到Android设备（建议root）或模拟器中。 （更多信息请访问此博客） 屏幕截图： 要求...

WebGoat.NET

Webgoat.NET Source Code: https://github.com/jerryhoff/WebGoat.NET Download zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master This web application is a learning platform that attempts to teach about common web security flaws. It contains generic security flaws that apply to most web...

WebGoat.NET

Webgoat.NET 源代码：https://github.com/jerryhoff/WebGoat.NET 下载zip：https://github.com/jerryhoff/WebGoat.NET/zipball/master 该 Web 应用程序是一个学习平台，旨在教授常见的 Web 安全缺陷。它包含适用于大多数 Web 应用程序的通用安全缺陷，还包含专门针对 .NET 框架的课程。本应用中的练习旨在教授 Web 安全攻击以及开发者如何克服这些攻击。 警告：此 Web 应用程序包含大量安全漏洞，运行时将使您的计算机非常不安全！强烈建议在运行时完全断开计算机与所有网络的连接！...

Cappriciosec-University

📚 Cappriciosec University – La primera plataforma de e-learning para hackers de la India Cappriciosec University es la primera plataforma de e-learning de la India para hackers, principiantes en ciberseguridad y cazadores de bug bounty. Nos centramos en hacking ético, pruebas de penetración,...

CVE-2026-63230

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...

PT-2026-65705

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

CVE-2026-65463

CVE-2026-65463 affects the WordPress Masteriyo LMS plugin, versioned up to 2.3.1, with an Insecure Direct Object References (IDOR) vulnerability in Subscriber scope. The entry provides a CVSS 3.1 base score of 5.4 (Medium) with network attack vector, low attack complexity, and requires low privil...

PYSEC-2026-1644 MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with...

CVE-2021-47907

Rocket LMS 1.1 contains a persistent cross-site scripting vulnerability in the support ticket module that allows authenticated users to inject malicious script code through the title parameter. Attackers can submit support tickets with embedded HTML/JavaScript payloads that execute in the browser...

CoreExploit-Final

CoreExploit 🔐 Ethical Penetration Testing Learning Platfor...

📄 GUnet OpenEclass E-learning Remote Code Execution

GUnet OpenEclass E-learning versions prior to 4.2 suffer from a remote code execution vulnerability. Exploit Title: GUnet OpenEclass E-learning platform """ def banner: printf'''YELLOW ┏━╸╻ ╻┏━╸ ┏━┓┏━┓┏━┓┏━┓ ┏━┓┏━┓┏━┓╻ ╻╺┓ ┃ ┃┏┛┣╸ ╺━╸┏━┛┃┃┃┏━┛┣━┓╺━╸┏━┛┏━┛┏━┛┗━┫ ┃ ┗━╸┗┛ ┗━╸ ┗━╸┗━┛┗━╸┗━┛ ┗━╸┗━╸┗━╸...

CVE-2026-31939

Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $REQUEST'test' is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerabilit...

CVE-2026-33708

Chamilo LMS is a learning management system. Prior to 1.11.38, the getuserinfofromusername REST API endpoint returns personal information email, first name, last name, user ID, active status of any user to any authenticated user, including students. There is no authorization check. This...

CVE-2026-33879

Federated Learning and Interoperability Platform FLIP is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTCHA, enabling brute-force and...

CVE-2026-33879

Federated Learning and Interoperability Platform FLIP is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTCHA, enabling brute-force and...

CVE-2026-33879 FLIP doesn't have rate limiting or brute-force protection on login

Federated Learning and Interoperability Platform FLIP is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTCHA, enabling brute-force and...

CVE-2026-33879

CVE-2026-33879 affects the Federated Learning and Interoperability Platform (FLIP). Technical details across sources show that FLIP versions prior to 0.1.1 expose the login page without rate limiting or CAPTCHA, enabling brute-force and credential-stuffing attacks. This affects external users and...

PT-2026-28547

Name of the Vulnerable Software and Affected Versions Federated Learning and Interoperability Platform FLIP versions prior to 0.1.1 Description The Federated Learning and Interoperability Platform FLIP login page lacks rate limiting or CAPTCHA protection, which could allow brute-force and...

Federated Learning and Interoperability Platform 安全漏洞

Federated Learning and Interoperability Platform is an open-source medical imaging learning platform developed by the London AI Centre. Versions of the Federated Learning and Interoperability Platform FLIP prior to 0.1.1 contained security vulnerabilities. These vulnerabilities stemmed from the...