abusech

abusech ThreatFox è una piattaforma aperta di condivisione di threat intelligence, che consente a chiunque di condividere indicatori di compromissione IOC. Questo repository fornisce uno strumento da riga di comando CLI per interagire con l'API di ThreatFox. Installazione ed esecuzione Brew...

Antecursor

Antecursor Das Antecursor-Projekt ist ein Open-Source- und Open-Hardware-Projekt, das von Infosec-Studenten mit dem Ziel entwickelt wurde, ein autonomes und modulares System für die netzwerkbasierte Informationssammlung und -ausnutzung zu entwickeln. Zielgruppe Antecursor soll sowohl dem Blue Tea...

strix

Strix The open-source AI pentesting tool. Autonomous AI hackers that find and fix your app’s vulnerabilities. !TIP New! Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure code before it reaches...

Rocket.Chat

La soluzione open source sicura definitiva per le comunicazioni di squadra Rocket.Chat è una piattaforma di comunicazione open source, sicura e completamente personalizzabile, sviluppata in TypeScript per organizzazioni con elevati standard di protezione dei dati. Siamo la soluzione definitiva pe...

marshalsec

Java Unmarshaller Security - Превращение ваших данных в выполнение кода Если вы попали сюда из-за Log4Shell/CVE-2021-44228, возможно, вам стоит прочитать о векторах эксплуатации и затронутых версиях Java runtime: https://mbechler.github.io/2021/12/10/PSALog4ShellJNDIInjection/ Статья Прошло более...

CVE-2026-82274

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

CVE-2026-55834

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirecturi query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when...

blind-ssrf-chains

Einführung Was ist Server Side Request Forgery SSRF? Server Side Request Forgery tritt auf, wenn du einen Server dazu bringen kannst, in deinem Namen beliebige Anfragen auszuführen. Da die Anfragen vom Server gestellt werden, ist es möglicherweise möglich, auf interne Ressourcen zuzugreifen, je...

training-application-security

Treinamento Gratuito de Codificação Segura e Segurança de Aplicações — Exercícios SCORM de Código Aberto 40 exercícios gratuitos de codificação segura em código aberto que ensinam segurança de aplicações web da forma como os desenvolvedores aprendem — explorando vulnerabilidades reais como injeçã...

RedTeam_toolkit

RedTeam Toolkit ملاحظة: يجب استخدام هذا المشروع فقط في الأنشطة القانونية. Red Team Toolkit هي تطبيق ويب هجومي مفتوح المصدر مبني على Django يحتوي على أدوات هجومية مفيدة تستخدم في اختبار الاختراق Red Teaming معًا لمساعدة متخصصي الأمن في تحديد الثغرات. تم دمج مشاريع الأمن السيبراني مفتوحة المصدر...

linux-malware

linux-malware 7-Tage-Ansicht der Aktualisierungen aus diesem Repository Einreichungen? Presse/Wissenschaft https://en.wikipedia.org/wiki/Linuxmalware 17 – Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection,...

diaphora

δiaphora Installation Install with the Hex-Rays plugin manager: root@kitploit: hcli plugin install https://github.com/joxeankoret/diaphora/archive/refs/tags/3.4.2.zip Manual install instructions are below. Diaphora διαφορά, Greek for 'difference' version 3.4 is the most advanced program diffing...

malwoverview

Malwoverview !Alt...

fscan

Fscan 中文 Comprehensive intranet scanning tool for automated vulnerability assessment. Version : 2.2.0 Features Scanning Host Discovery - ICMP/Ping alive detection, B/C segment statistics for large networks Port Scanning - TCP connect scan, 133 built-in ports, port groups web/db/service/all...

CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization

CVE-2026-34486 Fail-Open-Bypass des EncryptInterceptor im Apache-Tomcat-Tribes-Clustering führt zu nicht authentifiziertem RCE über Java-Deserialisierung. Betroffen: 11.0.19+, 10.1.53+, 9.0.116+. Behoben in: 11.0.21, 10.1.54, 9.0.117. Gefunden und gemeldet von Bartlomiej Dmitruk striga.ai. Writeu...

CVE-2026-70376

CVE-2026-70376 — CSRF a livello di sito in Pluck CMS → RCE Controllo Referer fail-open + assenza di token CSRF + upload a doppia estensione Una singola visita di una pagina da parte di un admin elimina contenuti, inietta pagine e rilascia una webshell...

NPM: 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

NPM: 9router: Unauthenticated /v1 proxy access via Host-header spoofing → open AI relay + SSRF vulnerability discovered by ? in WordPress Npm 9router versions 0.5.2...

CVE-2026-70481

CVE-2026-70481 Open WebUI, interessato nelle versioni dalla 0.5.0 alla 0.10.2, corretto nella 0.11.0. Gravità moderata, CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-284 e CWE-862. In backend/openwebui/routers/channels.py i gestori di aggiornamento ed eliminazione dei messaggi si...

CVE-2026-64531

CVE-2026-64531 — OVSwrap PoC di escalation dei privilegi locali utente normale → root nel modulo Open vSwitch del kernel Linux. Sfrutta il wrap-around intero del campo nlalen a 16 bit per passare da utente normale a root. Sintesi della vulnerabilità Quando il flusso di action nidificate generato ...

Exploits

Exploit POC di exploit per mondo reale e CTF. Mondo Reale CVE| Descrizione breve| Exploit ---|---|--- CVE-2017-5343| SQL Injection in Wordpress| POC CVE-2018-8880| Esfiltrazione di informazioni di rete non autenticata per Lutron Quantum Bacnet v2| POC CVE-2018-11629| Credenziali predefinite e non...