0l4bs

0l4bs Cross-site scripting labs for web application security enthusiasts List of Chall : Chall 1 | URL Chall 2 | Form Chall 3 | User-Agent Chall 4 | Referrer Chall 5 | Cookie Chall 6 | LocalStorage Chall 7 | Login Page Chall 8 | File Upload Chall 9 | Base64 Encoding Chall 10 | Removes Alert Chall...

linux-malware

linux-malware Vista de actualizaciones de los últimos 7 días de este repositorio ¿Envíos? Prensa/academia https://en.wikipedia.org/wiki/Linuxmalware 17 - Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection,...

Galaxy-Bugbounty-Checklist

Notas Intenta hacer la mejor lista de verificación de Bug Bounty. Todas las listas de verificación vienen con referencias. No dudes en contactarme a maximus0xday at gmail si tienes alguna pregunta. Lista de tareas: Account Takeover CSRF Bypass Http Request Smuggling OSINT OAuth...

CVE-2025-55182-poc

CVE-2025-55182 Vulnerabilidad del protocolo React Flight que permite el recorrido de la cadena de prototipos mediante referencias a fragmentos. Pruebas contra bullshit-react-project. Detección Esto está ligeramente desactualizado ya que el PoC real ha sido revelado. Vite RSC : bash ./vite-detect....

atomic-red-team

Atomic Red Team Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. Get started You can execute atomic tests directly from the command line, no installation required. S...

VulFi

VulFi v3.0 Introducción La herramienta VulFi Vulnerability Finder es un plugin para IDA Pro que puede usarse para ayudar durante la búsqueda de errores en binarios. Su objetivo principal es proporcionar una vista única con todas las referencias cruzadas a las funciones más interesantes como strcp...

jadx-magic-strings

Plugin de Cadenas Mágicas para JADX Un plugin para JADX que extrae información de constantes de cadena string. Características El plugin extrae y analiza constantes de cadena del código descompilado para encontrar: 1. Referencias a Archivos Fuente : Detecta referencias a archivos fuente de...

wesng

Windows Exploit Suggester - Next Generation WES-NG WES-NG is a tool based on the output of Windows' systeminfo utility which provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities. Every Windows OS between Windows XP and Windows 11, includin...

cve-2026-24688

CVE-2026-24688 - pypdf - Circular Reference DoS Vulnerability This repo includes proof of concept code for triggering CVE-2026-24688. Summary Critical Denial of Service vulnerability in pypdf's outline bookmark parsing logic. When processing a PDF with circular outline references, the parser ente...

vapi

vAPI vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios in the means of Exercises. Requirements PHP MySQL PostMan MITM Proxy Installation Docker docker-compose up -d Installation Manual Copying the Code cd git clone...

Cheatsheets

Cheatsheets Hojas de trucos de Pruebas de Penetración/Seguridad que he recopilado a lo largo de los años...

CVE-2026-105748

A flaw was found in Docling. This vulnerability allows an attacker to cause an information disclosure by providing a crafted document containing image references that point to local file paths or URIs Uniform Resource Identifiers. When the application processes and exports the document with...

CVE-2026-90236

A flaw was found in the Network File System Daemon NFSD of the Linux kernel. This vulnerability occurs due to an improper handling of export references when reaping open state IDs. An unreleased reference can pin an export, preventing the file system from being unmounted. This could allow a local...

Android-Forensics-References

Android Forensics References Last update: September 22th 2025 USERDATA Partition "/log" folder /log/wifi/iwc/iwcdump.txt Cellebrite CTF 2023 Recap: Answers on Sharon’s Android https://cellebrite.com/en/cellebrite-ctf-2023-recap-sharons-android/ /log/netstats /log/batterystats Cellebrite CTF 2021 ...

CVE-2026-91777

A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing o...

hacker-roadmap

Este repositorio es una visión general de lo que necesitas aprender sobre pruebas de penetración y una colección de herramientas, recursos y referencias para practicar hacking ético. La mayoría de las herramientas son compatibles con UNIX, gratuitas y de código abierto. Estado Este proyecto ha si...

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block

Summary /api/block/getRefIDs filters its results for reader roles through a helper that checks only the visibility tiers. The password tier is not checked, because the helper does not receive the request context and therefore cannot evaluate the publish auth cookie. A reader who has not entered a...

Denial Of Service

Apache Neethi is vulnerable to Denial of Service. The vulnerability is due to remote policy references being manually retrieved via the API without size limits, where the library reads data from remote policy references without imposing a maximum size and an attacker can supply a huge policy...

CentOS Linux 7 [TuxCare] Security Update: python3-pip (CENTOS7:CLSA-2026:1786355121)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1786355121 advisory. - A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libheif vulnerabilities (USN-8846-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8846-1 advisory. Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain compressed metadata. A remote...