CVE-2025-59390-

CVE-2025-59390- Der beigefügte POC ermöglicht es Ihnen, die Kerberos-Signatur in Apache Druid zu knacken sowie jeden Integer, der von ThreadLocalRandom erzeugt wurde. Sicherheitshinweis – Der Kerberos-Authenticator von Apache Druid verwendet ein schwaches Fallback-Geheimnis, wenn die Konfiguratio...

vault

Vault Nota bene : Prendiamo molto sul serio la sicurezza di Vault e la fiducia dei nostri utenti. Se ritieni di aver trovato un problema di sicurezza in Vault, segnalalo in modo responsabile contattandoci all'indirizzo [email protected]. Sito web: developer.hashicorp.com/vault Lista degli...

vault

Vault Please note : We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at [email protected]. Website: developer.hashicorp.com/vault Announcement list: Google Groups Discussion...

CVE-2024-47533

CVE-2024-47533 - Exploração de RCE por Bypass de Autenticação XMLRPC no Cobbler Execução Remota de Código Crítica via Bypass de Autenticação no Cobbler Implementação do PoC. Resumo Cobbler, um servidor de instalação Linux que permite a configuração rápida de ambientes de instalação em rede, possu...

redash-reset

redash-reset Questo utilizzerà una chiave REDASHSECRETKEY predefinita di c292a0a3aa32397cdb050e233733900f; ciò consente di reimpostare la password dell'ID utente, ma dovrai conoscere l'indirizzo email associato ad esso. Informazioni...

super-secret-finder

super-secret-finder Plugin Burp per il matching dei segreti...

chart-down

chart-down Scarica e analizza i chart Helm alla ricerca di segreti usando TruffleHog. Data l'URL di un repository Helm, chart-down recupera l'indice del repository, scarica ogni archivio chart, lo estrae ed esegue TruffleHog sul contenuto. Requisiti Go 1.19+ TruffleHog nel PATH brew install...

Flask-Unsign

Flask Unsign Kommandozeilen-Tool zum Abrufen und Dekodieren von Session-Cookies einer Flask-Anwendung sowie zum Ermitteln von Secret Keys per Brute-Force und Erstellen eigener Session-Cookies. Für die eigenständige Wortlisten-Komponente besuche bitte das Repository flask-unsign-wordlist...

CVE-2025-32965-xrpl-js-poc

CVE-2025-32965 — xrpl.js Supply Chain Attack PoC-Bericht Schwachstellenbeschreibung CVE Kodu: CVE-2025-32965 Schwachstellentyp: Supply Chain Attack CWE-506: Embedded Malicious Code Ziel: Versionen 4.2.1–4.2.4 und 2.14.2 der xrpl.js-Bibliothek Auswirkung: Die Seed-/Secret-Daten der Wallet des...

GiveMeSecrets

GiveMeSecrets गोपनीय जानकारी प्राप्त करने के लिए रेगुलर एक्सप्रेशन का उपयोग करें किसी दिए गए रिपॉजिटरी GitHub, pip या npm से। निर्भरताएँ इस स्क्रिप्ट को चलाने के लिए आपको केवल python 3.6 या उच्चतर स्थापित होना चाहिए। इसके अलावा सिस्टम पर git, pip और npm स्थापित होना अनिवार्य है। उपयोग कैसे करें...

Photon

Photon Crawler incredibilmente veloce progettato per OSINT. Photon Wiki • Come Usarlo • Compatibilità • Photon Library • Contributi • Roadmap Caratteristiche Principali Estrazione dei Dati Photon può estrarre i seguenti dati durante il crawling: URL in-scope e out-of-scope URL con parametri...

MagicMirror <= 2.35.0 - Server-Side Request Forgery

An unauthenticated Server-Side Request Forgery SSRF vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment...

OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

Tautulli <= 2.16.1 - Path Traversal

Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...

Langflow < 1.7.0 - Path Traversal

Langflow 1.7.1 contains a path traversal caused by insufficient filtering of foldername and filename parameters in downloadprofilepicture endpoint, letting attackers read secretkey across directories, exploit requires crafted request. id: CVE-2026-33497 info: name: Langflow 1.7.0 - Path Traversal...

JWT_Brute

JWTBrute Esempio eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoibmFuYSIsImFjdGlvbiI6InVwbG9hZCJ9.56wwCrB9tIgmUnYpLPxkO8GYj1soCjuuskTlbHGg8 root@kitploit: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 base64 decode "alg":"HS256","typ":"JWT" eyJ1c2VyIjoibmFuYSIsImFjdGlvbiI6InVwbG9hZCJ9 base64 decode...

codetotal

CodeTotal CodeTotal किसी भी स्निपेट , फ़ाइल या रिपॉजिटरी का विश्लेषण करता है ताकि संभावित सुरक्षा दोषों जैसे कोड में रहस्य , ओपन सोर्स कमजोरियाँ , कोड सुरक्षा , कमजोरी , असुरक्षित , और ओपन सोर्स लाइसेंसों से संबंधित संभावित का पता लगाया जा सके।...

CVE-2025-55449

CVE-2025-55449 - Vulnerabilidade de Execução Remota de Código RCE no AstrBot Visão Geral Este repositório contém uma prova de conceito de exploit para CVE-2025-55449 , uma vulnerabilidade crítica de Execução Remota de Código RCE no AstrBot. A vulnerabilidade permite que um atacante execute código...

DumpsterDiver

DumpsterDiver von @Rzepsky DumpsterDiver ist ein Werkzeug, das große Datenmengen nach fest codierten Geheimnissen wie Schlüsseln z.B. AWS Access Key, Azure Share Key oder SSH-Schlüssel oder Passwörtern durchsuchen kann. Zusätzlich ermöglicht es die Erstellung einfacher Suchregeln mit grundlegende...

gitleaks

Gitleaks ┌─○───┐ │ │╲ │ │ │ ○ │ │ ○ ░ │ └─░───┘ root@kitploit: !WARNING Gitleaks è completo di funzionalità. Non sto integrando nuove funzionalità in Gitleaks. Le versioni future conterranno solo patch di sicurezza. Sto spostando la mia attenzione su Betterleaks license:...