ZipExec

ZipExec ZipExec is a Proof-of-Concept POC tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected...

restic

はじめに restic は、高速で効率的かつ安全なバックアッププログラムです。Linux、macOS、Windows の主要 3 つのオペレーティングシステムと、FreeBSD、OpenBSD などのいくつかの小規模な OS に対応しています。 詳細な使い方やインストール手順については、ドキュメント を参照してください。 質問は Discourse フォーラム で受け付けています。 クイックスタート restic をインストールしたら、まずバックアップ用のリポジトリを作成します。 root@kitploit: $ restic init --repo /tmp/backup enter...

Malware

Malware macOS 악성코드 컬렉션 ⚠️ 이 페이지에는 라이브 악성코드 링크가 포함되어 있습니다! 이 사이트에서 악성코드를 다운로드함으로써, 부적절한 취급이나 자가 감염으로 인해 발생하는 모든 손해에 대한 청구 권리를 포기합니다. 📡 샘플을 실행하면 공격자 제어 인프라예: 명령 및 제어C2 서버에 연결될 수 있습니다. 🔐 샘플은 비밀번호로 보호되어 있습니다. 모든 샘플의 비밀번호는 infect3d 입니다. 📚 Mac 악성코드에 대해 더 자세히 배우고 싶으신가요? 무료 "The Art of Mac Malware" 책을 확인해...

Evasive_Malware_Book_Samples

"Evasive Malware" 책에서 발췌한 샘플들 제 책, Evasive Malware: A Field Guide to Detecting, Analyzing, and Defeating Advanced Threats https://nostarch.com/evasive-malware에서 참조된 샘플들입니다. 법적 고지 이 저장소는 함께 제공되는 출판물Evasive Malware: A Field Guide to Detecting, Analyzing, and Defeating Advanced Threats과 관련하여 교육 및 연구...

CVE-2026-90550

WWBN AVideo (through commit c3edcc27) is affected by a missing authorization vulnerability in the PlayerSkins mediaSession.json.php endpoint. The endpoint fails to verify user authorization before returning video metadata, allowing unauthenticated attackers to supply a video ID parameter and retr...

EUVD-2026-76867

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner...

CVE-2026-90549

WWBN AVideo , a PHP-based video platform, is vulnerable to missing authorization on the videosAndroid.json.php endpoint in versions through commit c3edcc274c389816d434acadac07ee78eaf330c1. Unauthenticated attackers can send a simple GET request to the endpoint and retrieve metadata of password-pr...

CVE-2026-90547

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains an authorization flaw in the Bookmark plugin 's getBookmarks.json.php endpoint. The endpoint fails to validate user permissions, allowing unauthenticated attackers to query it with a video ID parameter and retrieve cha...

CVE-2026-90545

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1 ) fails to validate video access permissions in the commentAddNew.json.php endpoint. This missing authorization check allows authenticated users to post comments on videos that are password-protected or group-restricted, effecti...

EUVD-2026-76864

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the like.json.php endpoint, allowing logged-in users to record likes on password-protected and group-restricted videos. Attackers can submit like requests for videos they cannot watch...

EUVD-2026-76863

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests with a valid...

CVE-2026-90540

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a missing authorization flaw in the playListAddVideo.json.php endpoint. The endpoint fails to validate watch permissions when adding videos to playlists, allowing authenticated attackers to add password-protected video...

EUVD-2026-76858

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting the...

CVE-2002-0347

CVE-2002-0347 Directory traversal vulnerability in Cobalt RAQ 4 allows remote attackers to read password-protected files, and possibly files outside the web root, via a .. dot dot in an HTTP request. Packetstorm publication at https://packetstormsecurity.com/files/25837/Colbalt-RAQ-v4.txt.html...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

WordPress 3D FlipBook <= 1.16.17 - Information Disclosure

WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions = 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3dsendpostsin, fb3dsendpostpages, fb3dsendpostsinpages, fb3dsendpostsinfirstpage, and fb3dsendpostfirstpage handlers are...

wwwolf-php-webshell

wwwolf의 PHP 웹 셸 다른 웹 셸을 사용할 때 다음과 같은 문제를 자주 겪었습니다: 일부 대상에서 실행 중인 구형 PHP 버전과 호환되지 않는 새로운 PHP 구문 기능을 사용합니다. 원격 URL에 대해 잘못된 가정을 하여 서버가 예상하거나 예상하지 못한 PHP 코드 주입이나 GET 매개변수를 망가뜨립니다. 종종 표준 출력 내용만 표시하고 stderr는 버립니다. 출력 표시에서 특수 문자예: 를 제대로 처리하지 못합니다. 파일 업로드를 허용하지 않거나 대상 설정에서 지원되지 않거나 차단된 방법만 제공합니다. 대상이 UNI...

CVE-2026-88876

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources without password validation. Attackers can request t...

CVE-2026-88876

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw in plugin/PlayerSkins/seo.php. The getSources() function is invoked without validating the configured password, allowing an unauthenticated attacker to request the seo.php endpoint with a video ...

CVE-2022-46484

CVE-2022-46484 Data Illusion Survey Software Solutions NGSurvey v2.4.28 및 이하 버전의 비밀번호로 보호된 설문조사에서 정보 공개 취약점으로 인해, 공격자가 설문조사에 접근할 비밀번호를 확인하고 설문조사를 임의로 제출할 수 있습니다...