CVE-2023-0156

CVE ID : CVE-2023-0156 Vulnerability Type : Directory Traversal Description : The All-In-One Security AIOS plugin for WordPress is vulnerable to directory traversal in versions up to, and including, 5.1.4. This allows authenticated attackers with administrator-level permissions to read the conten...

TFTPlunder

TFTPlunder: an exploit for CVE-2023-29930 This is an exploit script for a blind file read / write vulnerability in the Genesys formerly InIn TFTP provisioning server. Vulnerability info This vulnerability is due to unrestricted configuration options for the TFTP root path and file extensions. In...

CVE-2024-9162

CVE-2024-9162 All-in-One WP Migration and Backup SELECT optionname,optionvalue FROM wpoptions WHERE optionname='ai1wmsecretkey'; +------------------+--------------+ | optionname | optionvalue | +------------------+--------------+ | ai1wmsecretkey | PwrqqK3UHQJo | +------------------+-------------...

EUVD-2026-92095

A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipulation of the argument rating results in sql injection. The attack may be initiated remotely. The exploit has been released to the public a...

CVE-2026-105149

A security flaw exists in mooSocial versions up to 3.2.4 due to improper processing of the /stores/all-products file. An attacker can perform a remote SQL injection by manipulating the rating argument. Public exploit code is available for this vulnerability. The vendor has not responded to disclo...

yakit

Yakit - Plataforma de Pruebas de Seguridad de Aplicaciones Interactivas Ver el libro blanco • Documentación oficial • Reportar problemas • Ir al sitio web • Unirse a la comunidad • Arquitectura del proyecto :book: Selección de idioma: English • 中文 Introducción a Yakit La fusión de seguridad es un...

VHostScan

VHostScan Un escáner de hosts virtuales que puede usarse con herramientas de pivote, detectar escenarios de catch-all, alias y páginas predeterminadas dinámicas. Presentado por primera vez en SecTalks BNE en septiembre de 2017 presentación. Esta es una versión mejorada del VHostScan original...

Hack-Tool

Herramienta de hacking todo en uno para hackers🥇 Instalar Kali Linux en Windows 10 sin VirtualBox YOUTUBE o usar Docker Actualización disponible V1.1.0 🚀 Nuevas herramientas añadidas Ingeniería inversa Herramientas RAT Rastreo web Inyector de payload Actualización de herramientas Multitor...

all-my-collection-repos

All Resource Collection Projects: All open source security tools I collected: sec-tool-list: More than 21K. Both Markdown and Json format. Github Security Resource Collection Repos: 1000+ Github Repos about Security Resource Collection Reverse Engineering Resources For All Platforms: Windows:...

raspberrypi-setup

Configuración de Raspberry Pi Este Ansible playbook está diseñado para configurar rápidamente tu Raspberry Pi. Es compatible con todos los modelos. Se ha probado con éxito en múltiples modelos, incluyendo Pi Zero W, Pi Zero 2W y Pi 4B, entre otros. El playbook debería funcionar bien tanto en Debi...

CVE-2024-34470

CVE-2024-34470 PoC 및 대량 스캐너 개요 CVE-2024-34470에 대한 개념 증명PoC 및 대량 스캐너입니다. HSC Mailinspector의 경로 탐색Path Traversal 취약점으로, 버전 5.2.18까지의 모든 버전에 영향을 미칩니다. 사용 방법 PoC 실행 화면: 단일 대상 스캔 단일 대상 IP를 스캔하려면: python cve-2024-34470.py -u target 대량 대상 스캔 대량 대상을 한 번에 스캔하려면: python cve-2024-34470.py -f targets.txt 설치 ...

FinalRecon

Twitter - Telegram - thewhiteh4t의 블로그 FinalRecon은 파이썬으로 작성된 올인원 자동 웹 정찰 도구입니다. FinalRecon의 목표는 결과의 정확성 을 유지하면서 짧은 시간 안에 대상에 대한 개요 를 제공하는 것입니다. 여러 도구 를 차례로 실행하는 대신, 의존성을 작고 단순하게 유지하면서 유사한 결과를 제공할 수 있습니다. 사용 가능한 곳 소개된 곳 Python For OSINT Hakin9 April 2020...

paskto

Paskto - Passive Web Scanner Paskto will passively scan the web using the Common Crawl internet index either by downloading the indexes on request or parsing data from your local system. URLs are then processed through Nikto and known URL lists to identify interesting content. Hash signatures are...

sharesniffer

sharesniffer sharesniffer is a network analysis tool for finding open and closed file shares on your local network. It includes auto-network discovery and auto-mounting of any open cifs and nfs shares. How to use Example to find all hosts on any local network with open/closed nfs/smb shares: pyth...

git-all-secrets

git-all-secrets Acerca de git-all-secrets es una herramienta que puede: Clonar múltiples repositorios públicos/privados de GitHub de una organización y escanearlos, Clonar múltiples repositorios públicos/privados de GitHub de un usuario que pertenece a una organización y escanearlos, Clonar un so...

details-for-CVE-2022-46505

details-for-CVE-2022-46505 MatrixSSL session resume bug 1. Description of bug An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that can decrypt secret data. 2. Affected version MatrixSSL...

WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting

WordPress Select All Categories and Taxonomies plugin before 1.3.2 contains a cross-site scripting vulnerability. The settings page of the plugin does not properly sanitize the tab parameter before outputting it back. An attacker can inject arbitrary script in the browser of an unsuspecting user ...

All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path. This makes it possible for unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage...

All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87. id: CVE-2024-8852 info: name: All-in-One WP Migration 7.87 - Unauthenticated Information Disclosure...

All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery

WordPress All-in-One Video Gallery plugin through 2.6.0 is susceptible to arbitrary file download and server-side request forgery SSRF via the 'dl' parameter found in the /public/video.php file. An attacker can download sensitive files hosted on the affected server and forge requests to the serve...