GDir-Thief

GDir-Thief 红队工具，用于通过 Google 的 People API，从你有权访问的目标组织的 Google People Directory 中窃取数据。 使用方法 创建新的 Google Cloud Platform GCP 项目 获取连接到 API 所需的 Google API 访问令牌的步骤： 1. 创建一个临时 Gmail/Google 账户 2. 登录该账户 3. 导航到 Google Cloud Console 4. 在“Google Cloud Platform”旁边，点击 向下箭头。将出现一个显示当前项目的对话框。 5. 点击 新建项目。将出现新建项目屏幕。...

Geogramint

Geogramint - Telegram 的 OSINT 地理定位工具 终结：2024年9月6日 Telegram 创始人兼首席执行官 Pavel Durov 宣布停止使用“附近的人”功能。该功能已有一周无法使用。 此功能的移除意味着 Geogramint 及其他使用该 API 的 OSINT 工具不再可用。自即日起，此 GitHub 仓库将被归档。 Geogramint 的流行始于这篇 Projet FOX 文章，其中展示了该工具的实际能力。它还在 2023 年法国里尔国际网络安全论坛 FIC 上展出，进而促成了这篇 Projet FOX 文章。 Geogramint...

CVE-2019-15053

CVE-2019-15053 FAB-2019-00156 Vulnerabilidad descubierta por mí CVE-2019-15053 Aviso: advisory.txt Información Básica root@kitploit: Advisory ID..........: FAB-2019-00156 Product..............: HTML Include and replace macro Manufacturer.........: The Plugin People Affected Versions..: 1.4.2 and...

CVE-2026-94152

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-94152 Omega Solution FBP Fulfillment by People User Profile API user authorization

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-94152

Omega Solution FBP Fulfillment by People 2025 contains an authorization bypass in the User Profile API (file /user/). The vulnerability is triggered by manipulating the ID argument , allowing a low-privileged remote user to access unauthorized user profiles. The impact is a low confidentiality lo...

EUVD-2026-83866

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

Snowflake Hacker Pleads Guilty Over Breaches Affecting at Least 100 Million People

Connor Riley Moucka pleaded guilty in Seattle federal court on Wednesday to computer fraud, wire fraud, aggravated identity theft and a related conspiracy over the 2024 breaches of Snowflake customer accounts. The intrusions reached at least 165 organizations and exposed records belonging to at...

LifeOS 7.28.3

LifeOS is a Life Operating System. It knows your goals, the people who matter to you, and where you are right now, and it works to move you toward where you want to be. The engine underneath is a verifiable loop: turn any request into testable criteria, then climb until they pass. This is the fir...

CVE-2026-61985

Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through = 1.3.7...

POC_cve_2026_35273

POCcve202635273 Universal Unauthenticated RCE via PeopleSof...

ShinyHunters Leak 40GB of University of Nottingham Student Data

ShinyHunters hackers leak 40GB of University of Nottingham personal and financial data, allegedly impacting 450,000 students and staff records...

Amnesty International Warns That World Cup Fans Face Potential Human Rights Violations

The organization claims that the FIFA tournament could have impacts on the rights of local people and visiting soccer fans in all three host countries...

CVE-2026-10289 code-projects Hotel and Tourism Reservation System tour.php cross site scripting

A security flaw has been discovered in code-projects Hotel and Tourism Reservation System 1.0. Impacted is an unknown function of the file /ht/tour.php. Performing a manipulation of the argument name /email /people /number results in cross site scripting. The attack can be initiated remotely. The...

The art of being ungovernable

Welcome to this week's edition of the Threat Source newsletter. " It takes very little to govern good people. Very little. And bad people can't be governed at all. Or if they could, I never heard of it." ― Cormac McCarthy, No Country for Old Men Most of my career has been built on dichotomy:...

CVE-2026-42185

CVE-2026-42185 - People (La Suite): Prior to version 1.25.0, an authenticated user with Administrator on a mail domain could send a crafted invitation to elevate any user to Owner, yielding full domain ownership without the target’s acceptance. This is a privilege-escalation in the invitation flo...

People 安全漏洞

People is an open-source user and team permission management application developed by La Suite numérique. Versions of People prior to 1.25.0 contained a security vulnerability. This vulnerability allowed users with the role of email domain administrators to elevate any existing user to the owner...

CVE-2026-42185: Improper Privilege Management

People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user including users with no current domain access to the...

‘We Were Not Ready for This’: Lebanon's Emergency System Is Hanging by a Thread

In Lebanon, nearly 1 in 5 people has been displaced by Israeli attacks, leaving the government to manage a modern crisis without modern digital infrastructure...

CISO Spotlight: Dimitris Georgiou on Building Security that Serves People First

Dimitris Georgiou has been a self-professed computer geek since the early 80s. At university, he studied the convergence of educational technology with computer science as part of his psychology MA – finding, to his disbelief, that systems were perilously insecure. Since then, he’s always worked ...