The vulnerability of the TrueConf Server software, related to deficiencies in the authentication process, allows a perpetrator to obtain a token with administrator privileges.

The vulnerability of the TrueConf Server software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain an administrator-level token...

DumpBrowserSecrets

DumpBrowserSecrets Extracts browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from modern Chromium-based and Gecko-based browsers Chrome, Microsoft Edge, Firefox, Opera, Opera GX, and Vivaldi. Quick Links Maldev...

macphish

macphish Generador de Payloads de Macros para Office en Mac Vectores de ataque Hay 4 vectores de ataque disponibles: beacon creds meterpreter meterpreter-grant Para el método 'creds', macphish puede generar el script de Applescript directamente, en caso de que necesites ejecutarlo desde un shell...

CVE-2026-67598

CVE-2026-67598 Emlog Pro — Disabled TLS Certificate Validation in the AI Assistant Network-adjacent MITM → LLM-provider API-key theft & AI-response injection...

Adamantium-Thief

🔓 Adamantium-Thief Obtén de los navegadores basados en chromium : contraseñas, tarjetas de crédito, historial, cookies, marcadores, autocompletado. ¡Chrome 80 está soportado! ¿Necesitas un descifrador de contraseñas de firefox? 🌿 Ejemplos: 🔑 Obtener contraseñas de los navegadores: root@kitploit:...

CVE-2026-3096

CVE-2026-3096 affects multiple WSO2 products whose web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page , enabling a reverse tabnabbing attack. An attacker can manipulate the trusted applicati...

CVE-2026-3096 Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...

EUVD-2026-75731

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...

CVE-2026-89011

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

CVE-2026-89011

isomorphic-git before 1.42.0 is affected by a prototype pollution vulnerability in the getRemoteInfo function. A malicious Git server can advertise crafted ref names containing __proto__ path segments during ref negotiation (e.g., __proto__/corsProxy), polluting Object.prototype to reroute all su...

CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

ntlm_theft

ntlmtheft Una herramienta para generar múltiples tipos de archivos de robo de hash NTLMv2. ntlmtheft es una herramienta Python3 de código abierto que genera 21 tipos diferentes de documentos de robo de hash. Se pueden utilizar para phishing cuando el objetivo permite el tráfico SMB fuera de su re...

nah

expensive mistakes stop here a guard that blocks catastrophic agent actions nahguard.ai • what it blocks • how it decides • install • extend • threat model claude code · codex · cursor · pi · + 11 more nah is a guard that sits in your coding agent's hook path and reads tool calls before they run...

CVE-2026-88033

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

VindicateTool

Vindicate -brightgreen Un kit de detección de suplantación LLMNR/NBNS/mDNS para administradores de redes ¿Qué es Vindicate? Vindicate es una herramienta que detecta la suplantación de servicios de nombres, utilizada a menudo por atacantes de redes informáticas para robar credenciales por ejemplo,...

CVE-2023-44813

CVE-2023-44813 A reflected cross-site scripting XSS vulnerability in the mode parameter on Invite Friend function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: mode Exploit - Proof of Concept POC...

Solr-GRAB

Solr-GRAB Roba consultas de instancias de Apache Solr con o sin nombre de usuario y contraseña. DESCARGO DE RESPONSABILIDAD : Este proyecto debe usarse solo para pruebas autorizadas y fines educativos. Descarga root@kitploit: git clone https://github.com/GnosticPlayers/Solr-GRAB Uso Puedes buscar...

CVE-2025-51859

CVE-2025-51859 Vulnerability description Chaindesk, a web application for constructing AI Agents, is vulnerable to Stored Cross-Site Scripting XSS in its agent chat component. An attacker can achieve arbitrary client-side script execution by crafting an AI agent whose system prompt instructs the...

uxss-poc

Universal Cross Site Scripting PoC This is a PoC for CVE-2015-0072 for sequentialy get the targeted websites cookies. Disclaimer This Proof of Concept is for educational purpose only. Please do not use it against any system without prior permission. You are responsible for yourself for what you d...

WPTimeCapsulePOC

Backup and Staging by WP Time Capsule 1.21.16 - Authentication Bypass Proof Of Concept An authentication bypass was recently discovered https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/ on WP Time Capsule 1.21.16 . This PoC prove how the issue works and how it can be...