PMapper

Principal Mapper Principal Mapper PMapper es un script y una biblioteca para identificar riesgos en la configuración de AWS Identity and Access Management IAM para una cuenta de AWS o una organización de AWS. Modela los diferentes usuarios y roles de IAM en una cuenta como un grafo dirigido, lo q...

CVE-2024-0044

CVE-2024-0044- CVE-2024-0044: a "run-as any app" high-severity vulnerability affecting Android versions 12 and 13 CVE-2024-0044 Exploit Script This Bash script demonstrates how to exploit CVE-2024-0044. For educational and testing purposes only. Prerequisites ADB Android Debug Bridge installed an...

CVE-2022-41876

CVE-2022-41876 - eZ Platform user information disclosure A vulnerability emerged in eZ Platform letting an unauthenticated user access every contributor password's hash. This PoC enumerates every possible GraphQL path leading to a 'User' object, and then requests these paths to retrieve users'...

o365-attack-toolkit

¿Qué es o365-attack-toolkit o365-attack-toolkit permite a los operadores realizar ataques de phishing oauth. Decidimos pasar del antiguo modelo de definiciones estáticas a ser completamente "interactivos" con la cuenta en tiempo real. Algunos de los cambios Búsqueda interactiva de correos...

ffs

FFS - S Sistema de Archivos Esta es una herramienta CLI para buscar archivos como grep que no usa el kernel del sistema operativo para leer archivos, sino que lee tus discos directamente. Es prácticamente inútil, pero increíblemente genial. esto es solo 1.5k líneas de código C que: requiere sudo...

CVE-2026-46376

CVE-2026-46376 — FreePBX Unauthenticated UCP Access via Hard-Coded Credentials A critical vulnerability in FreePBX's User Management userman module allows unauthenticated attackers to access the User Control Panel UCP using hard-coded credentials that are embedded during the UCP generic template...

confluence-cve-2023-22515

confluence-cve-2023-22515 Confluence Broken Access Control : CVE-2023-22515...

smart-contract-vulnerabilities

Smart Contract Vulnerabilities A collection of smart contract vulnerabilities along with prevention methods. See /references for LLM-optimized references. Access Control Authorization Through tx.origin Insufficient Access Control Delegatecall to Untrusted Callee Signature Malleability Missing...

CVE-2024-31719----AMI-Aptio-5-Vulnerability

AMI-Aptio--NvLock-Vulnerability Information CVE ID: CVE-2024-31719 Link Vulnerability Type: Incorrect Access Control Vendoer of Product: American Megatrends International, LLC. Product: AMI Aptio - 5 Atack Type: Local Attack Vector The attacker can easily bypass the NvLock module's access...

CVE-2023-31595

CVE-2023-31595 La cámara IC Realtime ICIP-P2012T es vulnerable a un Control de Acceso Incorrecto a través de un puerto abierto Cámara PTZ Dome IP IC Realtime ICIP-P2012, versión de software: 2.420 Un puerto expuesto 9989 responde con una captura instantánea en el momento de la solicitud; mediante...

CVE-2020-13405

CVE-2020-13405 Base Score: 7.5 HIGH🟥 MicroWeber is an open-source Content Management System CMS written in PHP. It allows web administrators to easily build a website by dragging and dropping components where they want them to be. It is a popular choice among those looking to start a website that...

MCP-Inspector-CVE-2025-49596

MCP Inspector CVE-2025-49596 Vulnerability Checker Este script comprueba si un servidor MCP Inspector es vulnerable a CVE-2025-49596, un problema de seguridad donde el endpoint /sse responde a solicitudes no autenticadas falta de token de autenticación. Cómo Funciona El script envía una solicitud...

pfsense-security-research

Authenticated Arbitrary File Read in pfSense 2.8.0 via Diagnostics Web Interface CVE ID: CVE-2025-53392 Date: 2025-06-27 Author: Seth Kraft Vendor Homepage: https://www.netgate.com/ Vendor Changelog: https://docs.netgate.com/pfsense/en/latest/releases/ Software Link:...

keycloak

Open Source Identity and Access Management Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users. Keycloak provides user federation, strong authentication, user management, fine-grained authorization, and more. Help...

CVE-2022-22077

✅ CVE-2022-22077 exploitation framework RTCore64.sys: This document provides a comprehensive overview of the CVE-2022-22077 exploitation framework, a sophisticated BYOVD Bring Your Own Vulnerable Driver attack toolkit that targets the RTCore64.sys driver vulnerability. This framework demonstrates...

NTP_Trojan

NTPTrojan About Reverse ntp remote access trojan in python, for penetration testers. For more information about roadmap and inspiration see: http://lockboxx.blogspot.com/2015/04/python-ntp-trojan.html References Server is heavily derived from: https://github.com/limifly/ntpserver...

lxd-group-privesc-report

LXD Root Local Privilege Escalation to root via default lxd group membership and the lxd-installer package on Ubuntu. Demo runs on AWS EC2 Ubuntu Server 26.04 The bug is that Ubuntu Server 26.04's default install silently grants the primary user membership in the lxd group, a group that by LXD's...

android-c-sharp-rat-server

Android C R.A.T Server This is a pulgin built for the C R.A.T Server with the plugin system. 1. To install this plugin place the AndroidExtension.dll file from AndroidExtension/bin/Debug to /TutServer/bin/Debug/scripts 2. Then start the server and select the Plugins tab. 3. Select...

CVE-2022-47529

CVE-2022-47529 RSA NetWitness Platform EDR Agent / Incorrect Access Control - Code Execution During a security audit of the EDR agent I discovered a novel vector to tamper with the service with only standard user rights by targeting an insecure Win32 memory event object. Hijacking the service...

Vitejs-exploit

Vite Exploit CVE-2025-31125 Description: Exploits path traversal in Vite Development Server's @fs endpoint CVE-2025-31125 to access sensitive files like /etc/passwd and /etc/hosts via crafted URLs. Created by Muhammad Waseem. Usage: python viteexploit.py -u http://target.com python viteexploit.py...