yeti

Plataforma Yeti Yeti tiene como objetivo cerrar la brecha entre los profesionales de CTI y DFIR al proporcionar una plataforma de inteligencia forense y un pipeline para equipos de DFIR. Nació de la frustración de tener que responder a la pregunta "¿dónde he visto este artefacto antes?" o "¿cómo...

pgAdmin < 6.17 - Unauthenticated Remote Code Execution

pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication. id: CVE-2022-4223 info: name: pgAdmin 6.17 - Unauthenticated Remote Code Execution...

tiktok-scraper

TikTok Scraper & Downloader Scrape and download useful information from TikTok. No login or password are required This is not an official API support and etc. This is just a scraper that is using TikTok Web API to scrape media and related meta information. Content Features To Do Contribution...

ligolo-ng

Ligolo-ng : Tunelización como una VPN Una herramienta de tunelización avanzada pero simple que utiliza interfaces TUN. 📑 Documentación de Ligolo-ng Configuración/Inicio rápido !TIP Ligolo-ng 0.8 añadió muchas características nuevas, incluyendo: 🌐 API y una hermosa interfaz web gracias a L'ami du...

tiktok-scraper

TikTok Scraper & Downloader Scrape and download useful information from TikTok. No login or password are required. This is not an official API support and etc. This is just a scraper that is using TikTok Web API to scrape media. Features Scrape video posts from username, hashtag or trends Downloa...

ExternalC2

ExternalC2 Una librería para integrar canales de comunicación con el servidor External C2 de Cobalt Strike Esta librería proporciona una implementación de la especificación External C2 de Cobalt Strike, incluyendo un canal web básico y un canal websocket. La base de código ha sido documentada y...

leonidas

Leonidas This is the repository containing Leonidas, a framework for executing attacker actions in the cloud. It provides a YAML-based format for defining cloud attacker tactics, techniques and procedures TTPs and their associated detection properties. These definitions can then be compiled into:...

Magento-CVE-2016-4010

Análisis y explotación de la vulnerabilidad de ejecución remota de código no autenticada en Magento CVE-2016-4010 0x00 Prefacio El 17 de mayo, el investigador de seguridad Netanel Rubin publicó una vulnerabilidad de ejecución remota de código no autenticada en Magento CVE-2016-4010. Esta...

exist

EXIST EXternal Information aggregation System against cyber Threat ⚠️ This repository is unmaintained / archived. Security issues will not be fixed. EXIST is a web application for aggregating and analyzing CTI cyber threat intelligence. EXIST is written by the following software. Python 3 Django...

tiandy-research

tiandy-research Este repositorio contiene los resultados de mi investigación de agosto de 2020 sobre el firmware de IPC/NVR de Tiandy estos dispositivos también se venden como OMNY. Esta "investigación" no fue exhaustiva, pero encontré múltiples métodos para recuperar la contraseña del...

CVE-2026-1457

CVE-2026-1457: TP-Link VIGI C385 Authenticated Remote Code Execution Overview CVE-2026-1457 is an authenticated buffer overflow vulnerability in the web API of TP-Link VIGI C385 V1. This vulnerability allows authenticated attackers to perform remote code execution RCE. CVSS v4.0 Score: 8.5 High...

CVE-2026-26418

CVE-2026-26418 Missing Authentication and Authorization in Web API Vulnerability Summary A missing authentication and authorization vulnerability was identified in the Web API layer of Tata Consultancy Services TCS – Cognix Recon Client v3.0. Certain exposed API endpoints did not enforce proper...

API-attack-detection-with-AI

Detección de ataques SQL/XSS en API Web con inteligencia artificial / machine learning Este proyecto tiene como objetivo detectar inyecciones SQL y XSS en consultas/parámetros de API utilizando machine learning. Presentación del proyecto Este proyecto tiene como objetivo detectar inyecciones SQL ...

CVE-2026-74972

Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

EUVD-2026-54997

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

CVE-2026-16257

The CVE-2026-16257 entry concerns the Arvow AI SEO Writer WordPress plugin (pre-1.5.4). The NVD/CVE descriptions indicate an access control flaw in a REST endpoint that can be reached without authentication due to type juggling when the plugin is not configured. This allows unauthenticated users ...

CVE-2026-19352 mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery

A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...

CVE-2026-19113

Removed by vendor...

CVE-2026-6020 ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handleaction method passing user-supplied input directly to calluserfunc without an allowlist o...

CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...