LabS4U2Self

Laboratorio S4U2Self Abuse Questo laboratorio ha lo scopo di fornire un ambiente sicuro per testare l'exploit S4U2Self abuse Distribuzione Il progetto distribuirà : 1 DC con un singolo domain admin hpotter 1 MSSQL con una password sa debole La distribuzione viene eseguita tramite terraform e...

t14m4t

t14m4t t14m4t è uno strumento automatizzato di attacco brute‑force, wrapper di THC‑Hydra e Nmap Security Scanner. t14m4t esegue la scansione di un target definito dall'utente o di un documento contenente target alla ricerca di porte aperte di servizi supportati da t14m4t , e successivamente avvia...

iPwn

iPwn Un framework pensato per lo sfruttamento di dispositivi iOS. RICORDA: L'IPHONE CHE STAI TENTANDO DI ACCEDERE CON QUESTO STRUMENTO DEVE ESSERE JAILBROKEN Stato - ❌ Questo progetto è ancora in fase di sviluppo. Sto aggiungendo ulteriori estensioni e opzioni per il post-exploitation per...

cve-2025-9933

🔒 Credenziali per il pannello di amministrazione Username: admin Password: Test@123 Username: [email protected] Password: Test@123 Oppure registra un nuovo utente. Descrizione È stata trovata una vulnerabilità in PHPGurukul Beauty Parlour Management System 1.1. Interessata da questo problema...

opac-fast-automation

CVE-2025-65862 — Dokumentation, Analyse und Automatisierungstool Nur zu Forschungszwecken ⚠️ Ethische und rechtliche Warnung Das gesamte Material in diesem Repository wird nur bereitgestellt für: Sicherheitsforschung, Lernen, Schwachstellenanalyse, und Tests in Umgebungen, die einem gehören oder...

EUVD-2026-53123

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing...

CVE-2026-49004

CVE-2026-49004 describes misconfiguration and command injection in the built-in PostgreSQL service on the mobile device (ZTE NX799J/Red Magic 11 Air). The service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGR...

CVE-2026-49004 PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing...

PYSEC-2026-681 Unrestricted Upload of File with Dangerous Type in motionEye

motionEye = 0.42.1 and motioneEyeOS = 20200606 allow a remote attacker to upload a configuration backup file containing a malicious python pickle file. This is possible when an installation is accessible over the Internet and uses no or poor authentication credentials. The GitHub repositories for...

The Gentlemen are knocking: сustom backdoors and evolving tactics

Introduction This year saw the emergence of The Gentlemen, a prominent example of a group operating under the ransomware-as-a-service RaaS model. Although our initial assessment suggested the group first appeared in mid-2025, it actually started ramping up its activities at the beginning of 2026...

⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More

It’s Monday again. This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and mobile malware asking for way too much control. The annoying part is how little of this feels new. Weak credentials,...

Systems-and-Cyber-Security-Coursework

CSI6SCS2526 — Systems and Cyber Security Coursework Gr...

CVE-2026-8076

Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication. The system supports the use of PIN-based credentials, maintaining compatibility with POS software integrations deployed since 2012. This coul...

Separating Secrets from Placeholders: A Hybrid CNN-CodeBERT Framework for Three-Class Credential Leakage Detection

Credential leakage in public source code repositories poses a critical security threat, with over 23.8 million secrets exposed in 2024 alone. Existing detection tools suffer from high false-positive rates because rigid pattern matching and binary classification schemes fail to distinguish genuine...

CVE-2026-35089

Slican telephone exchanges expose admin credentials because the secure key is generated predictably from exchange properties without authentication. CVE-2026-35089 (and CVE-2026-35087) describe an unauthenticated path to deduce the secure key and gain admin access. Remediations (per affected entr...

CVE-2026-35089 Use of Weak Credentials in Slican telephone exchanges

In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authentication. An unauthenticated attacker can deduce the secure key and obtain admin credentials. This issue was fixed in versions below: - IPx...

CVE-2026-35089 Use of Weak Credentials in Slican telephone exchanges

In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authentication. An unauthenticated attacker can deduce the secure key and obtain admin credentials. This issue was fixed in versions below: - IPx...

CVE-2025-13477 OTP Bypass in Digital Operation Services' WifiBurada

Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiBurada allows Authentication Bypass. This issue affects WifiBurada: through 21052026. NOTE: The vendor was contacted early about this...

Digital Operation Services WiFiBurada 安全漏洞

Digital Operation Services WiFiBurada is an application developed by Digital Operation Services. Versions of Digital Operation Services WiFiBurada dated before May 20, 2026, have security vulnerabilities. These vulnerabilities stem from the exposure of private personal information to unauthorized...

CVE-2026-8077 Weak credentials vulnerability in the CashDro 3 web administration panel

Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26. The backend lacks authorization controls, leaving security entirely to the frontend. By modifying the binary string in the ‘Permissions’ field of the JSON response, an attacker could escala...