KyoceraCredsDump

KyoceraCredsDump - CVE-2022-1026 Based on the original exploit from Aaron Herndon, @ac3lives Rapid7 - https://www.rapid7.com/blog/post/2022/03/29/cve-2022-1026-kyocera-net-view-address-book-exposure/ credits to Aaron Herndon / https://twitter.com/ac3lives /...

DumpChromeSecrets

!IMPORTANT This project is no longer maintained. Please useDumpBrowserSecrets instead, which supports Chrome, Edge, Brave, Firefox, Opera, Opera GX, and Vivaldi. DumpChromeSecrets Extract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsi...

LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release

LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hu...

Cve-2026-27944-Tools-Exploit

🚀 CVE-2026-27944: Nginx UI Unauthenticated Backup Exploit 📌 Description 27944.py is an exploitation tool for CVE-2026-27944 that allows an attacker to download and decrypt Nginx UI backups without authentication. This vulnerability exists in Nginx UI versions 2.3.2 and allows access to: · User...

CVE-2019-9053-POC

CMS Made Simple ⚠️ Disclaimer: This script is for educational and authorized testing purposes only. Do not use it on systems you do not own or have explicit permission to test. The author and contributors are not responsible for any misuse or damage caused by this tool. 🎯 What is this? This is a...

CVE-2025-64446-Exploit

CVE-2025-64446-Exploit CVE-2025-64446 exploit on fortiweb waf whit this exploit you can crate user and password . hwo to runing ? python3 exploitforti.py targets.txt python3 exploitforti.py 192.168.1.1 python3 exploitforti.py 192.168.1.1:8443 python3 exploitforti.py https://192.168.1.1:8443 smape...

CVE-2023-26258-ArcServe

The TL; DR; If you are in the network you can scan for instances configured by default using ArcServeRadar.py. I tried to port it to C but couldn't, feel free to do it if you know how : c:\Users\vagrant\Desktoppython ArcServeRadar.py "Ethernet 2" 6969 192.168.56.20 -= ArcServe Finder - @TheXC3LL ...

solrradar

Mass Reconnaissance & Exploitation Framework for Apache Solr Velocity Template Injection → Remote Code Execution 📑 Table of Contents Vulnerability Overview Affected Versions Features Installation Usage Proof of Concept Technical Deep-Dive Detection Methodology Defense & Mitigation Disclaimer...

actions-secrets

SecureStack Secrets Analysis GitHub Action A GitHub Action that analyses your source code for secrets, credentials, API keys, server and database hostnames/URLS, and a lot more! When you add this to GitHub Actions we will analyze your source code to make sure there is no sensitive data in your...

CVE-2026-13768

CVE-2026-13768: Privileged IoT Hub Credential — Fleet Enumeration, Device RCE, and Home-Network Pivot Advisory Field| Value ---|--- CVE| CVE-2026-13768 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 10.0 Critical Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L Vector 4.0|...

Malicious code in data-pipeline-testmetest (npm)

data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun downloaded from GitHub...

Malicious code in test-brotli2-testmetest (npm)

test-brotli2-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

Malicious code in test-brotli-testmetest (npm)

test-brotli-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

Malicious code in pixel-map-testmetest (npm)

pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on npm install: their binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The package.json poses as an npm...

Malicious code in log-sink-testmetest (npm)

log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The payload is identical to...

CVE-2018-9995-DVR-Credentials-Extractor

Tool show DVR Credentiales Original Tool: https://github.com/ezelf/CVE-2018-9995dvrcredentials Exploit Title: "Gets DVR Credentials" CVE: CVE-2018-9995 CVSS Base Score v3: 7.3 / 10 CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Date: 09/04/2018 Exploit Author: Fernandez Ezequiel...

VULNERAVEL-CVE-2018-14847---CREDENCIAIS-EXTRAIDAS

Pentest Tools — /network Repository of scripts for auditing and penetration testing of networks. Use only on devices with formal authorization. CVE-2018-14847 — MikroTik Winbox Credential Extractor Description Exploits the unauthenticated file read vulnerability in the MikroTik RouterOS Winbox...

scan-shai-hulud

scan-shai-hulud A fast, zero-dependency Bash scanner to detect whether your machine is affected by the CVE-2026-45321 "Mini Shai-Hulud" supply chain attack. On May 11, 2026, over 170 npm packages and 2 PyPI packages across TanStack, Mistral AI, UiPath, OpenSearch, and Guardrails AI were...

shai-hulud-scan

shai-hulud-scan A Claude Code skill that scans machines for indicators of compromise IOCs from the Mini Shai-Hulud supply chain worm CVE-2026-45321, CVSS 9.6. What is Mini Shai-Hulud? A self-propagating supply chain worm that compromised 170+ npm/PyPI packages on May 11, 2026 - including...

CVE-2026-114221

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in use...