ADTrapper

ADTrapper - Active Directory Security Analysis Platform Professional Active Directory Security Analysis and Threat Detection Platform Transform Windows authentication logs into actionable security insights with advanced threat detection and interactive visualizations Overview ADTrapper is a...

tplink-smartplug

TP-Link WiFi SmartPlug Client and Wireshark Dissector For the full story, see Reverse Engineering the TP-Link HS110 tplinksmartplug.py A python client for the proprietary TP-Link Smart Home protocol to control TP-Link HS100, HS110 and KP115 WiFi Smart Plugs. The SmartHome protocol runs on TCP por...

tiktok-scraper

TikTok Scraper & Downloader Сбор и загрузка полезной информации из TikTok. Логин и пароль не требуются Это не официальная поддержка API и т.д. Это просто парсер, использующий веб-API TikTok для сбора медиа и связанной метаинформации. Содержание Возможности Планы Участие Установка Использование В...

accfly

How secure is your "security" camera? Executive summary In the beginning of 2020, at my former workplace, I had a chance to take part in an internal pwn2own style event. There were several targets available, but I was interested the most in Accfly Wireless Security camera. Unfortunately I had not...

Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()

Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the execglobals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication. id: CVE-2026-0770 info: name: Langflow...

Vtiger CRM v7.2.0 - Directory Listing

Vtiger CRM v7.2.0 contains a directory traversal vulnerability caused by improper access controls in /libraries and /layout directories, letting attackers display hidden files and list directories, exploit requires no authentication. id: CVE-2020-19363 info: name: Vtiger CRM v7.2.0 - Directory...

flipper-mcp

flipper-mcp Rust-сервер MCP Model Context Protocol, работающий непосредственно на WiFi Dev Board v1 ESP32-S2 устройства Flipper Zero, позволяющий AI-агентам управлять Flipper Zero по сети. Что это? Этот проект размещает MCP-сервер на самом Flipper. Любой MCP-совместимый AI-клиент Claude Desktop,...

twint

TWINT - Twitter Intelligence Tool Pas d'authentification. Pas d'API. Pas de limites. Twint est un outil avancé de scraping Twitter écrit en Python qui permet de scraper les Tweets des profils Twitter sans utiliser l'API de Twitter. Twint utilise les opérateurs de recherche de Twitter pour vous...

EUVD-2009-5122

Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service authentication handler. When a specially crafted HTTP request is sent with an oversized Authorization header, the application fails to properly validate the input length before...

CVE-2026-22812-exploit

Инструмент эксплуатации CVE-2026-22812 Полнофункциональный набор инструментов для эксплуатации CVE-2026-22812 — неаутентифицированное удалённое выполнение кода в OpenCode 🎯 Обзор Инструмент эксплуатации CVE-2026-22812 — это комплексная платформа для эксплуатации уязвимости неаутентифицированного...

CVE-2026-25130-Cybersecurity-AI-CAI-Framework-0.5.10

CVE-2026-25130 – PoC внедрения аргументов / OS-инъекции в Cybersecurity AI CAI Framework Автор: Mohammed Idrees Banyamer Страна: Иордания GitHub: https://github.com/yourusername Instagram: @banyamersecurity Обзор Этот репозиторий содержит Proof of Concept PoC, демонстрирующий уязвимость внедрения...

CVE-2026-23744-POC

CVE-2026-23744 — Неаутентифицированное удалённое выполнение кода в MCP-сервере Эксплойт Proof-of-Concept отd3vn0mi Обзор CVE-2026-23744 — это уязвимость неаутентифицированного удалённого выполнения кода RCE в MCP-совместимых серверах, доступных на порту 6274. Конечная точка /api/mcp/connect...

CVE-2026-12940-Langflow-Unauth-RCE

CVE-2026-12940 — Langflow OSS ≤ 1.10.1 Unauthenticated RCE MCP stdio env-var injection Unauthenticated remote code execution in Langflow OSS through 1.10.1. The environment-variable blocklist that guards MCP stdio server configuration DANGEROUSENVVARS omits SHELLOPTS, BASHOPTS and PS4. Because th...

CVE-2025-47812

CVE-2025-47812 — Wing FTP Server Unauthenticated RCE ██╗ ██╗██╗███╗ ██╗ ██████╗ ███████╗████████╗██████╗ ██║ ██║██║████╗ ██║██╔════╝ ██╔════╝╚══██╔══╝██╔══██╗ ██║ █╗ ██║██║██╔██╗ ██║██║ ███╗ █████╗ ██║ ██████╔╝ ██║███╗██║██║██║╚██╗██║██║ ██║ ██╔══╝ ██║ ██╔═══╝ ╚███╔███╔╝██║██║ ╚████║╚██████╔╝ ██║...

SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...

Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

Reflected XSS via a forged cursor pagination token Failure mode Special:Ask accepts a cursor query parameter for keyset pagination added in 7.0.0. The token is decoded by CursorEncoder, which is an unsigned base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the...

CVE-2026-71568 BMCtest exposes Ironic without authentication and TLS during the test

In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity...

The vulnerability of the OUD Core component of the Oracle Unified Directory application, which facilitates simplified deployment of the Oracle Fusion Middleware software. This vulnerability allows a malicious individual to gain full control over the application.

The vulnerability of the OUD Core component of the Oracle Unified Directory application, a simplified deployment solution for the Oracle Fusion Middleware software platform, is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow an attacker ...

CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...

Astra Linux – Vulnerability in libspf2

Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing o...