agentZ

AgentZ Plateforme d'IA agentique Zero Trust Créez, exécutez et gérez des agents IA. Sécurisé par conception. Chaque agent s'exécute dans un sandbox en refus par défaut et ne reçoit jamais d'identifiant. Chaque action d'agent est traçable. AgentZ est une plateforme multi-tenant pour exécuter des...

Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

On August 19th, 2026, during internal research, I discovered an Authentication Bypass vulnerability in WPMU DEV Dashboard, a WordPress plugin with an estimated 350,000 active installations. This vulnerability makes it possible for unauthenticated attackers to gain administrator access when Hub...

dnssearch

dnssearch Diese Software ist ein Tool zur Subdomain-Enumeration. Zweck dnssearch nimmt eine Eingabedomain Parameter -domain und eine Wortliste Parameter -wordlist entgegen. Anschließend führt es gleichzeitige DNS-Anfragen durch, wobei die Zeilen der Wortliste als Subdomains verwendet werden, um...

ctftool

CTFTOOL Just want to test the SYSTEM exploit? Click here. An Interactive CTF Exploration Tool This is ctftool, an interactive command line tool to experiment with CTF, a little-known protocol used on Windows to implement Text Services. This might be useful for studying Windows internals, debuggin...

Security-101

🌐 Supporto multilingue Supportato tramite GitHub Action Automatizzato e sempre aggiornato...

gitleaks

Gitleaks ┌─○───┐ │ │╲ │ │ │ ○ │ │ ○ ░ │ └─░───┘ root@kitploit: !WARNING Gitleaks è completo di funzionalità. Non sto integrando nuove funzionalità in Gitleaks. Le versioni future conterranno solo patch di sicurezza. Sto spostando la mia attenzione su Betterleaks license:...

gitleaks

Gitleaks root@kitploit: ┌─○───┐ │ │╲ │ │ │ ○ │ │ ○ ░ │ └─░───┘ !WARNING Gitleaks is feature complete. I'm not merging new features into Gitleaks. Future releases will be security patches only. I'm shifting my focus to Betterleaks...

CVE-2026-37149

CVE-2026-37149 SQL-Injection in GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 Übersicht CVE-ID: CVE-2026-37149 Schwachstellentyp: SQL-Injection CWE-89 Schweregrad: Hoch Entdecker: Dhyey Patel Beschreibung GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0...

CVE-2023-2744

Exploit-Titel: WP Plugins WP ERP = 1.12.2 - SQL Injection Datum: 15-10-2023 Exploit-Autor: Arvandy Software-Link: https://wordpress.org/plugins/erp/ Anbieter-Homepage: https://wperp.com/ Version: 1.12.2 Getestet auf: Windows, Linux CVE: CVE-2023-2744 Produktbeschreibung WP ERP ist das erste...

CVE-2024-54819

CVE-2024-54819 Weitere Details unter: https://www.partywave.site about CVE-2024-54819 POST-Anfrage zum Login Der Angreifer muss angemeldet sein root@kitploit: POST /librarian/index.php/authentication HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:128.0 Gecko/20100101...

Minimalistic-offensive-security-tools

Minimalistische TCP- und UDP-Portscanner port-scan-tcp.ps1 | port-scan-udp.ps1 Einfache und dennoch leistungsstarke TCP- und UDP-Portscanner: Erkennung von offenen, geschlossenen und gefilterten Ports sowohl TCP als auch UDP Möglichkeit, einen einzelnen Host, einen Netzwerkbereich oder eine Liste...

xencrypt

Xencrypt PowerShell crypter v 1.0 Authors Xentropy @SamuelAnttila SecForce @SECFORCELTD If you want to read about the design behind this tool and how to make your own crypter, there's an article I wrote about it here: Write a crypter in any language Note Don't be a script kiddie, I made this GPLv...

CVE-2024-33210

CVE-2024-33210 In Flatpress 1.3 wurde eine Cross-Site-Scripting-Schwachstelle XSS identifiziert. Diese Schwachstelle ermöglicht es einem Angreifer, bösartige Skripte in Webseiten einzuschleusen, die von anderen Benutzern angezeigt werden. Vulnerability Type: Cross Site Scripting XSS Vendor of...

CVE-2024-31835

CVE-2024-31835 Vulnerabilità di Cross Site Scripting in flatpress CMS Flatpress v1.3 che consente a un attaccante remoto di eseguire codice arbitrario tramite un payload appositamente creato nel parametro del nome del file. Componente interessato: Campo di caricamento file del pannello di...

domi-owned

Domi-Owned Summary Domi-Owned is a tool used for compromising IBM/Lotus Domino servers. Tested on IBM/Lotus Domino 8.5.2, 8.5.3, 9.0.0, and 9.0.1 running on Windows and Linux. Requirements Domi-Owned uses Python 3, which can be install through your distribution's package manager apt, yum, etc...

CVE-2026-81819

Affected versions of Flowintel expose the /myassignment/user API endpoint to any authenticated API user. The endpoint accepts a userid parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a...

CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

CVE-2026-81720

opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...

CVE-2026-81679

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a...

CVE-2026-81091

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the...