CVE-2025-25617

CVE-2025-25617 Unifiedtransform v2.0 is vulnerable to Incorrect Access Control, allowing teachers to create syllabus entries — a role intended only for administrators. Vendor: Unifiedtransform PoC Step 1: Log in to the application as a Teacher. Step 2: Browse to the following endpoint:...

CVE-2026-92213

a2ui-project a2ui (versions up to 0.10.6) is affected by an injection vulnerability in the Angular Renderer component. The vulnerable code is located in the function z.any within the file renderers/web_core/src/v0_9/schema/server-to-client.ts. By manipulating the primaryColor argument, a remote a...

CVE-2026-92213 a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/webcore/src/v09/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible t...

CVE-2026-51990

Sogou Input Method (Tencent), a widely installed Windows Chinese input method, is vulnerable to one-click remote code execution via its biz_helper.exe protocol handler (sgbiz: URI). A crafted URI triggers the handler, which passes unvalidated arguments to SGMyInput.exe, opening an embedded unsand...

EUVD-2026-80932

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

CVE-2026-79298

Howyar Technologies SysReturn (NetCopy feature) prior to v11.3.034 ships a vulnerable IA-32 UEFI boot path (BOOTia32.efi) that still carries the custom RxPE PE loader from the original CVE-2024-7344, loading unsigned payloads from cloak32.dat and bypassing Secure Boot verification. The x64 path w...

Microsoft Windows Cloud Files Mini Filter Driver CldiStreamPrepareRequestForMoreProcessing Type Confusion vulnerability

Summary A type confusion vulnerability exists in the CldiStreamPrepareRequestForMoreProcessing functionality of Windows Cloud Files Mini Filter Driver versions: 10.0.26100.8457 WinBuild.160101.0800 and 10.0.26100.8655 WinBuild.160101.0800. A specially crafted sequence of Cloud Filter API calls ca...

stegowiper

stegoWiper：一种强大且灵活的攻击工具，用于破坏隐写恶意软件 过去10年中，许多威胁组织都采用了隐写恶意软件或其他基于隐写术的技术来攻击全球各行各业和地区的组织。一些例子包括：APT15/Vixen Panda、APT23/Tropic Trooper、APT29/Cozy Bear、APT32/OceanLotus、APT34/OilRig、APT37/ScarCruft、APT38/Lazarus Group、Duqu Group、Turla、Vawtrack、Powload、Lokibot、Ursnif、IceID等。 我们的研究（参见...

BlackNET

BlackNET 😈 Free advanced and modern Windows botnet with a nice and secure PHP panel developed using VB.NET. About BlackNET 🤓 Free advanced and modern Windows botnet with a nice and secure PHP panel built using VB.NET. this botnet controller comes with a lot of features and the most secure panel f...

CVE-2020-24032

CVE-2020-24032 Suggested description tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metacharacters in a timezone. VulnerabilityType Other OS command injection Vendor of Product XoruX s.r.o. Affected Product Code Base LPAR2RRD and...

Network-Analysis-Tools

Pcap Capture File Analysis Toolv.1 root@kitploit: !CONTACT! | Email: [email protected] | | Github: github/azizaltuntas | | Twitter: @esccopyright | Features root@kitploit: 1-Top 10 Visited Sites 2-Emails 3-All Request Urls 4-User-Agents List 5-String Grep Mode 6-Connection details 7-Ports Us...

CVE-2024-44542

CVE-2024-44542 Description: todesk v1.1 was discovered to contain a SQL injection vulnerability via the title parameter at /todesk.com/news.html. Vulnerability Type: SQL Injection Vendor of Product: todesk Affected Product Version: todesk - v1.1 Affected Component: todesk.com, news.html Attack...

CVE-2025-46203

Description Unifiedtransform v2.0 is vulnerable to Incorrect Access Control. Any user students and teachers can access and modify student records via the /students/edit/id endpoints. This functionality intended exclusively for administrative use. Exploiting this vulnerability can lead to...

RFCrack

/ | | | / | | | | / \ ' - / \ / - | / \ V V / ' / \ || - /||// /| ///|. //, / / |/ | /| | | || | / | | '/ /| / / | || || , | \ root@kitploit: Welcome to RFCrack - A Software Defined Radio Attack Tool Developer: @Ficti0n - http://ConsoleCowboys.com CCLabs: http://cclabs.io Blog:...

GWTMap

Description GWTMap is a tool to help map the attack surface of Google Web Toolkit GWT based applications. The purpose of this tool is to facilitate the extraction of any service method endpoints buried within a modern GWT application's obfuscated client-side code, and attempt to generate example...

routopsy

routopsy Routopsy is a toolkit built to attack often overlooked networking protocols. Routopsy currently supports attacks against Dynamic Routing Protocols DRP and First-Hop Redundancy Protocols FHRP. Most of the attacks currently implemented make use of a weaponised 'virtual router' as opposed t...

routopsy

routopsy Routopsy 是一个专门用于攻击常被忽视的网络协议的工具包。目前，Routopsy 支持针对动态路由协议DRP和第一跳冗余协议FHRP的攻击。已实现的多数攻击利用了武器化的“虚拟路由器”，而非从头实现协议。该工具不仅限于虚拟路由器，还允许通过添加额外的容器或在 python3 中实现更多攻击。 有关使用方法的更多信息，请参阅维基百科 @ https://github.com/sensepost/routopsy/wiki...

CVE-2020-28415

CVE-2020-28415 Suggested description A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url different vector than CVE-2020-28414. Vulnerability Type Cross Site...

pwnspoof

pwnSpoof from Punk Security generates realistic spoofed log files for common web servers with customisable attack scenarios. Every log bundle is unique and completely customisable, making it perfect for generating CTF scenarios and for training serials. Can you find the attacker session and build...

CVE-2023-47459

CVE-2023-47459 Descripción Se descubrió una vulnerabilidad en Knovos Discovery v.22.67.0 que permite a un atacante remoto acceder a información confidencial utilizando los componentes: /DiscoveryReview/Service/CaseManagement.svc/GetProductSiteName,...