MalQR.github.io

MalQR Sobre MalQR é uma coleção de códigos QR e códigos de barras maliciosos que você pode usar para testar a segurança dos seus scanners. Ele oferece a capacidade de realizar tais testes com facilidade : você só precisa de um smartphone, tablet ou laptop com conexão à internet e acessar...

squarephish

SquarePhish SquarePhish é uma ferramenta de phishing avançada que utiliza uma técnica combinando o fluxo de autenticação de código do dispositivo OAuth e códigos QR. Consulte PhishInSuits para mais detalhes sobre o uso do fluxo de código do dispositivo OAuth para ataques de phishing. root@kitploi...

QRExfil

QRExfiltrate Esta ferramenta é um utilitário de linha de comando que permite converter qualquer ficheiro binário num GIF de códigos QR. Os dados podem então ser remontados visualmente, permitindo a exfiltração de dados em sistemas com isolamento de ar air gapped. Foi concebida como uma prova de...

QRLJacking

QRLJacking - A New Social Engineering Attack Vector Find documentation in our Wiki. What is QRLJacking? QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on the “Login with QR code” featur...

nec_aterm_tools

necatermtools इस रिपॉजिटरी में NEC Aterm राउटर पर shell तक पहुँच प्राप्त करने के लिए विकसित दो उपकरण शामिल हैं: 1. nec-aterm-firmware-config-extractor: फर्मवेयर इमेज से HWRANDOMKEY निकालता है। लॉग इन करने के लिए एक मान्य पासवर्ड उत्पन्न करने हेतु इस कुंजी की आवश्यकता होती है। 2. rakuraku-nec-shel...

wifi-password

wifi-password Obtenha rapidamente sua senha WiFi e, se necessário, gere um código QR do seu WiFi para permitir que telefones se conectem facilmente. Funciona no macOS , Linux e Windows Instalação Instalar usando pip root@kitploit: $ python3 -m pip install --user wifi-password Instalar usando git...

wifi-password

wifi-password Quickly fetch your WiFi password and if needed, generate a QR code of your WiFi to allow phones to easily connect. Works on macOS and Linux , Windows Installation Install using pip root@kitploit: $ python3 -m pip install --user wifi-password Install using git root@kitploit: $ git...

WordPress-Flex-QR-Code-Generator---CVE-2025-10041

CVE-2025-10041: Flex QR Code Generator प्लगइन में मनमाना फ़ाइल अपलोड भेद्यता विश्लेषण 一、भेद्यता अवलोकन प्लगइन नाम : Flex QR Code Generator प्रभावित संस्करण : ≤ 1.2.5 सभी संस्करण भेद्यता प्रकार : मनमाना फ़ाइल अपलोड → रिमोट कोड निष्पादन RCE शोषण की स्थिति : लॉगिन की आवश्यकता नहीं, अनधिकृत पहुंच मूल...

SharpCovertTube

SharpCovertTube SharpCovertTube è un programma creato per controllare sistemi Windows da remoto caricando video su YouTube. Il programma monitora un canale YouTube finché non viene caricato un video, decodifica il codice QR dalla miniatura del video caricato ed esegue un comando. I codici QR nei...

QuickResponseC2

Capacità - Utilizzo - Dimostrazione - Panoramica del flusso di lavoro - TODO QuickResponseC2 QuickResponseC2 è un framework di Comando e Controllo C2 furtivo che permette una comunicazione indiretta e nascosta tra la macchina dell'attaccante e quella della vittima tramite un server HTTP/S...

CVE-2022-24992

CVE-2022-24992 CVE-2022–24992 Questo post riguarda la CVE-2022–24992, la mia prima CVE, che si riferisce a una vulnerabilità nello script generatore di codici QR ampiamente utilizzato di QRCDR. maggiori informazioni Cordiali saluti, n0lsec...

CVE-2021-43530-UXSS-On-QRcode-Reader-

CVE-2021-43530-UXSS-On-QRcode-Reader- ثغرة Universal XSS كانت موجودة في Firefox for Android نتيجة لتعقيم غير صحيح عند معالجة عنوان URL ممسوح ضوئيًا من رمز QR. هذا العطل يؤثر فقط على Firefox for Android. أنظمة التشغيل الأخرى غير متأثرة.. هذه الثغرة تؤثر على Firefox 94...

CVE-2026-12587

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-12587 Embedded credentials in Virtuagym

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-12587

CVE-2026-12587 affects the Virtuagym application, where a static, hard-coded badge_number parameter is used as the HMAC private key for generating physical access QR codes. This value is exposed via the API endpoint /club/_id_club_/member/_id_member_/resamania_qr_info, and the cryptographic logic...

EUVD-2026-66418

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2025-12673

Flex QR Code Generator ' shell.php curl -X POST "https://victimsite.com/wp-admin/admin-ajax.php" \ -F "action=flexqrupdateqr" \ -F "qrId=1" \ -F "qrData="data":"https://example.com"" \ -F "[email protected]" Details Die Schwachstelle existiert in der Methode updateqrcode der Klasse...

evilqr

Evil QR Toolkit demonstrating another approach of a QRLJacking attack, allowing to perform remote account takeover, through sign-in QR code phishing. It consists of a browser extension used by the attacker to extract the sign-in QR code and a server application, which retrieves the sign-in QR cod...

CVE-2025-10041

CVE-2025-10041 Flex QR Code Generator = 1.2.5 - Nicht authentifizierter beliebiger Datei-Upload 🚨 Flex QR Code Generator ≤ 1.2.5 - Nicht authentifizierter beliebiger Datei-Upload 📝 Beschreibung Das Flex QR Code Generator -Plugin für WordPress ist anfällig für beliebige Datei-Uploads aufgrund...

CVE-2026-68501

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...