dnstwist

ユーザーがドメイン名を入力しようとして、どのようなトラブルに巻き込まれ得るかを確認しましょう。 攻撃者があなたを攻撃するために利用できる類似ドメインを検出します。タイポスクワッティング、 フィッシング攻撃、詐欺、ブランド冒充を検出できます。標的型脅威インテリジェンスの 追加情報源として有用です。 DNSファジングは、組織を標的とする悪意のあるドメインを発見することを目的とした自動化ワークフローです。 このツールは、指定されたドメイン名に基づいて包括的な置換リストを生成し、 その置換のいずれかが使用されているかを検証します。...

opensquat

openSquat Core 📑 목차 openSquat이란 무엇인가? 소개된 곳 오픈코어 모델 주요 기능 빠른 시작 요구 사항 사용법 프리미엄 및 API 모드 설정 자동화 CLI 참조 기여하기 저자 라이선스 🎯 openSquat이란 무엇인가? openSquat은 브랜드나 도메인을 표적으로 하는 사이버 스쿼팅 위협을 식별하는 오픈 소스 인텔리전스OSINT 보안 도구입니다: 위협 유형| 설명 ---|--- 🎣 피싱| 브랜드를 사칭하는 사기 도메인 🔤 타이포스쿼팅| 일반적인 오타가 포함된 도메인 예: gooogle.com 🌐 IDN...

PhishingKitHunter

PhishingKitHunter 귀하의 브랜드/조직의 파일과 이미지를 사용하는 피싱 킷을 탐지합니다. PhishingKitHunter 또는 PKHunter는 귀하의 고객을 대상으로 하는 피싱 캠페인에서 귀하의 웹사이트 파일CSS, JS 등을 사용하는 피싱 킷 URL을 식별하기 위해 만들어진 도구입니다. 이 도구는 Python 3로 작성되었으며, 합법적인 웹사이트에서 특정 파일GET 요청을 가져오거나 피싱 세션 후 사용자를 리디렉션하는 리퍼러 URL 분석을 기반으로 합니다. 로그 파일에는 사용자가 어디에서 왔는지, 피싱 킷이 어...

freepbx-endpoint-sqli-rce

CVE-2025-57819 — FreePBX 엔드포인트 모듈 SQL 인젝션 → 원격 코드 실행 요약 FreePBX는 Asterisk PBX를 위한 오픈소스 웹 GUI로, 기업용 전화 환경에서 널리 배포됩니다. 엔드포인트 매니저 모듈은 /admin/ajax.php에서 AJAX 핸들러를 노출하며, 이 핸들러는 brand 매개변수를 받아 SQL 쿼리에 직접 삽입합니다살균 처리 없음. 인증되지 않은 원격 공격자는 임의의 SQL을 주입하고, cronjobs 테이블에 행을 삽입한 후, FreePBX cron 데몬이 웹 루트에 실행 가능한...

CamTRON

CamTRON - Escáner de Cámaras Una herramienta automatizada para detectar dispositivos de vigilancia cámaras en redes. Características Detección multimarca : Compatible con más de 30 marcas de cámaras, incluyendo Hikvision, Dahua, Axis, CCTV y más Escaneo de alto rendimiento : Escaneo concurrente c...

FreePBX-CVE-2025-57819

FreePBX CVE-2025-57819 — 認証なしSQLiからroot RCEへ 重要度: 重大 種別: 認証なしSQLインジェクション → リモートコード実行 影響を受けるソフトウェア: FreePBX endpointモジュール 検証環境: CentOS 7上のFreePBX、Apache 2.4、PHP 7.4、MariaDB 5.5 概要 FreePBXのendpointモジュールには、/admin/ajax.phpのbrandパラメータを介した認証なしSQLインジェクションの脆弱性が存在します。この脆弱性を悪用するのに認証情報は必要ありません。...

Exploit for SQL Injection in Sangoma Freepbx

CVE-2025-57819 — FreePBX 16 Endpoint Manager unauthenticated S...

puncia v0.36

PantheraP.uncia Official CLI utility for Subdomain Center & Exploit Observer Puncia is the official command-line client for two A.R.P. Syndicate intelligence APIs — point it at a domain, a brand, or a vulnerability ID and get structured JSON back in seconds, no browser required: 🕸️ Subdomain Cente...

CVE-2026-32257

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...

EUVD-2026-66632

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...

CVE-2026-32257 Winter: Stored XSS through Brand Settings custom styles

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...

CVE-2026-32257 Winter: Stored XSS through Brand Settings custom styles

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...

CVE-2026-32257

Winter CMS is an open-source content management system based on the Laravel PHP framework. Prior to 1.2.13 , custom CSS supplied through the Brand Settings Styles field by a user with the backend.manage_branding permission was compiled by the LESS CSS parser and rendered without sanitization on e...

CVE-2026-32257 Winter: Stored XSS through Brand Settings custom styles

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...

CVE-2026-32257: Improper Neutralization of Input During Web Page Generation

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...

CVE-2026-50142: Integer Overflow or Wraparound

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heifcontextreadfrommemory with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seqboxes.cc, Boxstsz::parse applies maxsequenceframes only to...

Malicious code in meualelo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fdf84c3f49f6d13b7ccbed745056f8bf03c4c7a2b814152962361ac07bd4191 The package's preinstall.js collects hostname, username, platform, cwd, and the full process.env, then POSTs the JSON payload over HTTPS with TLS...

MAL-2026-13777 Malicious code in upshift-finance (npm)

upshift-finance is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk "Upshift" is the DeFi product name used throughout the real SDK, e.g. app.upshift.finance. Its published 1.0.0 body is byte-identical to augustdigital-sdk and...

MAL-2026-13774 Malicious code in augustdigital-sdk (npm)

augustdigital-sdk is a malicious npm package — an unscoped brand-hijack of the legitimate, actively-maintained scoped package @augustdigital/sdk. Version 8.20.1 was copied verbatim from the genuine @augustdigital/[email protected] release published 2 hours earlier to masquerade as a legitimate mirror or...

Malicious code in dolyame-boxy-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce523b3385816616192d462b5ac251d22886682d021200c4bd76bd22b95003c On require of this package, index.js loads setup.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers hosts...