3601 matches found
macphish
macphish Office for Mac Macro Payload Generator Attack vectors There are 4 attack vectors available: beacon creds meterpreter meterpreter-grant For the 'creds' method, macphish can generate the Applescript script directly, in case you need to run it from a shell. beacon On execution, this payload...
kube-alien
Kube-alien This tool launches attack on k8s cluster from within. That means you already need to have an access with permission to deploy pods in a cluster to run it. After running the kube-alien pod it tries to takeover cluster's nodes by adding your public key to node's /root/.ssh/authorizedkeys...
web-check
Web-Check あらゆるウェブサイトに対する包括的なオンデマンドOSINT 🌐web-check.xyz ご支援いただいています: Terminal Trove ターミナル関連のすべてを集めた $HOME | Warp 複数のAIエージェントによるコーディング向けに開発 ---|--- 目次 概要 スクリーンショット ライブデモ ミラー 機能 使用方法 デプロイ オプション1: Netlify オプション2: Vercel オプション3: Docker オプション4: ソース 設定オプション 開発者セットアップ コミュニティ コントリビューション バグ サポート ライセンス 概要...
waf-checker
웹 애플리케이션 방화벽WAF이 일반적인 공격 벡터로부터 얼마나 잘 보호하는지 테스트할 수 있는 강력한 웹 애플리케이션입니다. → waf-checker.com ← 기능 보안 테스트 19개 이상의 공격 카테고리 기본 제공: SQL Injection, XSS, Path Traversal, Command Injection, SSRF, NoSQL Injection, LFI, LDAP Injection, XXE, SSTI, CRLF 등 9개의 고급 우회 카테고리 : 인코딩 변형, 프로토콜 스머글링, 프레임워크 특화 페이로드 포함 344개...
graphql-threat-matrix
GraphQL 위협 매트릭스 graphql-threat-matrix가 필요한 이유? graphql-threat-matrix는 버그 바운티 헌터, 보안 연구원 및 해커들이 여러 GraphQL 구현에서 취약점을 발견하는 데 도움을 주기 위해 제작되었습니다. GraphQL 구현이 GraphQL 사양을 해석하고 준수하는 방식의 차이는 보안 허점과 독특한 공격 벡터로 이어질 수 있습니다. 다양한 구현에서 보안 위험을 유발하는 요소를 분석하고 비교함으로써 GraphQL 생태계는 더 안전한 배포 결정을 내릴 수 있을 뿐만 아니라 모든 구현...
CVE-2018-7600.
IGLOO Corp, Won Chi Hyun Drupal RCE 分析レポート Drupal RCE CVE-2018-7600 スクリプトに自分のアドレスを忘れずに入力してください！ 説明: Drupal 7.x および 8.x の複数のサブシステムにリモートコード実行の脆弱性が存在します。これにより、攻撃者は Drupal サイト上の複数の攻撃ベクトルを悪用する可能性があり、サイトが完全に侵害される可能性があります。 解決策: Drupal 7 または 8 コアの最新バージョンにアップグレードしてください。 7.x を実行している場合は、Drupal 7.58...
CVE-2021-29156
제대로 된 CVE-2021-29156 이 개념 증명PoC은 공개된 다른 PoC가 깨져 있기 때문에 구현되었습니다 ✨ 설치 root@kitploit: go install github.com/5amu/CVE-2021-29156@latest 참고 자료 https://nvd.nist.gov/vuln/detail/CVE-2021-29156 https://portswigger.net/research/hidden-oauth-attack-vectors...
CVE-2018-7600
CVE-2018-7600 的 POC Drupal RCE CVE-2018-7600 别忘了在脚本中填入你的地址！ 描述： Drupal 7.x 和 8.x 的多个子系统中存在一个远程代码执行漏洞。这可能允许攻击者利用多个攻击向量对 Drupal 站点发起攻击，从而导致站点被完全入侵。 解决方案： 升级到最新版本的 Drupal 7 或 8 核心。 如果你正在运行 7.x，请升级到 Drupal 7.58。（如果无法立即更新，你可以尝试应用此补丁来修复漏洞，直到你能够完全更新为止。） 如果你正在运行 8.5.x，请升级到 Drupal...
Windows-RCE-exploits
ファイルレス攻撃に対するベンダーテスト用の私の他のGitHubリポジトリ - https://github.com/smgorelik/VendorSimTestScripts Windows-RCE-exploits エクスプロイトサンプルデータベースは、WINDOWS 向けのRCE （リモートコード実行）エクスプロイトおよび概念実証（Proof-of-Concepts）のリポジトリです。サンプルは、レッドチームおよびブルーチームの教育目的でアップロードされています。...
CVE-2026-67316
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...
CVE-2026-7232
The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'parameter name' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
EUVD-2026-46610
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to...
CVE-2026-8476 Disk Cache Deserialization Remote Code Execution Vulnerability
IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads function to deserialize cached objects from disk without validation, integrity verification, or...
Hackers Use Fake Claude Code Guide and AI PDFs to Spread AsyncRAT Malware
Hackers are using fake Claude Code guide and AI PDFs to spread AsyncRAT malware via Windows attack using PowerShell and Defender exclusions...
Important: postgresql
Issue Overview: Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets, PQfn..., resultisint=0, ... stores...
Exploit for CVE-2019-5513
VMware Horizon /broker/xml Vulnerability Scanner !Security...
PT-2026-42695
Name of the Vulnerable Software and Affected Versions Plonky3 versions prior to 0.4.3 Plonky3 versions prior to 0.5.3 Description An attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This...
Malicious code in ethers-wallet-packages (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beda1480a40189cc8177ace4e3d6fd9773ad81f4cbe5a6c07e3004427846dc8d The package impersonates the legitimate @ethersproject/wallet source files are otherwise verbatim copies, including the internal version string...
Toward Securing AI Agents like Operating Systems
Autonomous agents based on large language models LLMs are rapidly emerging as a general-purpose technology, with recent systems such as OpenClaw extending their capabilities through broad tool use, third-party skills, and deeper integration into user environments. At the same time, these agentic...
