CVE-2026-101012

A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be). The flaw is located within an unknown function in the makeresult.php file, where manipulation of the makeid argument allows for remote execution. Public exp...

BITB

BITB Plantillas de navegador para el ataque Browser In The Browser BITB. Más información: https://mrd0x.com/browser-in-the-browser-phishing-attack/ Uso Cada carpeta tiene un archivo index.html que tiene 4 variables que deben modificarse: XX-TITLE-XX - El título que se muestra en la página ej...

Adaptive_Greedy_Local_Search

Adaptive Greedy Local Search AGLS Semantic-Preserving Prompt Hijacking: A Black-Box Adversarial Attack on Auto-Prompt Optimization ICME 2026 Abstract: Large Language Models LLMs are increasingly equipped with automatic prompt-optimization modules that rewrite the user’s input and explicitly prese...

ditto

Ditto es una pequeña herramienta que acepta un nombre de dominio como entrada y genera todas sus variantes para un ataque homográfico como salida, verificando cuáles están disponibles y cuáles ya están registrados. Dominios PoC https://tᴡitter.com/ https://clᴏudflare.com Usando con Docker La imag...

webdiscover

root@kitploit: / / /\ \ | | / \ / / / \ ' \ / /\ / / |/ / \ \ / / \ '| \ /\ / / | | / ///| \ \ | \ V / / | / / |./ /,' ||/\/ / || El propósito de este script es automatizar el proceso de enumeración web y buscar exploits y vulnerabilidades para tu superficie de ataque objetivo...

bkcrack

bkcrack Descifra el cifrado legacy de ZIP con el ataque de texto plano conocido de Biham y Kocher. Descripción general Un archivo ZIP puede contener muchas entradas cuyo contenido puede estar comprimido y/o cifrado. En particular, las entradas pueden cifrarse con un algoritmo de cifrado simétrico...

EUVD-2026-88127

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The shipped...

automatic-api-attack-tool

Automatic API Attack Tool Imperva's customizable API attack tool takes an API specification as an input, and generates and runs attacks that are based on it as an output. The tool is able to parse an API specification and create fuzzing attack scenarios based on what is defined in the API...

CVE-2026-91206

Apache Roller version 6.1.5 is vulnerable to reflected cross-site scripting (XSS) due to improper neutralization of input during web page generation. The flaw exists specifically in the optional LdapCommentAuthenticator , which writes request parameter values into its HTML form without proper esc...

EUVD-2026-88124

A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function getdomainstatus of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the...

CVE-2026-101011

A SQL injection vulnerability exists in aaPanel BaoTa up to version 11.8.0 . The flaw is located within the Domain Handler component, specifically in the get_domain_status function of the file /www/server/panel/mod/project/domain/domainMod.py. An attacker can trigger the vulnerability by manipula...

CVE-2026-101011 aaPanel BaoTa Domain domainMod.py get_domain_status sql injection

A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function getdomainstatus of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the...

poisontap

PoisonTap - siphons cookies, exposes internal router & installs web backdoor on locked computers Created by @SamyKamkar || https://samy.pl When PoisonTap Raspberry Pi Zero & Node.js is plugged into a locked/password protected computer, it: emulates an Ethernet device over USB or Thunderbolt...

macphish

macphish Office for Mac Macro Payload Generator Attack vectors There are 4 attack vectors available: beacon creds meterpreter meterpreter-grant For the 'creds' method, macphish can generate the Applescript script directly, in case you need to run it from a shell. beacon On execution, this payload...

Microsoft365_devicePhish

Microsoft365devicePhish Abusando del flujo de autorización OAuth de Microsoft 365 para ataques de phishing Este es un script simple de prueba de concepto que permite a un atacante realizar un ataque de phishing contra el flujo de autorización OAuth de Microsoft 365. Usando esto, uno puede...

CVE-2026-101008

A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function mergesplitfile of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument splitfilepath results in command injection. The attack is possible to be...

CVE-2026-101009

A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bttask.unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to os command injection. The attack...

CVE-2026-101007

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

CVE-2026-101005

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

metlo

Metlo API Security Secure Your API. Metlo is an open-source API security platform Metlo is an open source API security tool you can setup in 15 minutes that inventories your endpoints, detects bad actors and blocks malicious traffic in real time. Detect API attacks in real time. Automatically blo...