nmap

Nmap Nmap is released under a custom license, which is based on but not compatible with GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for...

Powertek Firmware <3.30.30 - Authorization Bypass

Powertek firmware multiple brands before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an...

gdog

Gdog A stealthy Python based Windows backdoor that uses Gmail as a command and control server This project was inspired by the gcathttps://github.com/byt3bl33d3r/gcat from byt3bl33d3r. Requirements Python 2.x PyCrypto module WMI module Enum34 module Netifaces module Features Encrypted...

androrat

androrat Android 远程管理工具 Androrat 是一款客户端/服务器应用程序，客户端使用 Java Android 开发，服务器使用 Java/Swing 开发。 Androrat 这个名字是 Android 和 RAT（远程访问工具）的混合体。 它由 4 人团队为一个大学项目开发，历时一个月完成。该应用的目标是远程控制 Android 系统并从中获取信息。 技术细节 Android 应用是客户端的角色，负责与接收所有连接的服务器通信。 Android 应用以服务（而非 Activity）的形式运行，并在开机时启动。因此用户无需与服务交互（尽管存在一个调试...

CVE-2026-94405

The Shahjada Download Manager WordPress plugin (versions up to 3.3.71 ) is vulnerable to an Authorization Bypass Through User-Controlled Key vulnerability. This flaw allows an attacker to retrieve embedded sensitive data from the system. The vulnerability is classified as a Sensitive Data Exposur...

kyocera-cve-2022-1026_SOAP1.1

Kyocera CVE-2022-1026 SOAP 1.1 仅限授权测试。 本项目仅供教育及防御性验证用途，适用于你拥有或已获得明确测试许可的环境。请勿针对你不拥有或管理的系统使用。 一个关于 CVE-2022-1026 的京瓷打印机暴露检测与数据检索概念验证，专注于 实现 SOAP 1.1 服务的旧款设备 。 漏洞概述 CVE-2022-1026 最初由 ac3lives 在 2021 年的一次渗透测试中发现。原始 PoC 仓库地址： https://github.com/ac3lives/kyocera-cve-2022-1026 2025 年 12...

CVE-2026-103345

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

EUVD-2026-89389

Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2025-31161

CVE-2025-31161 は、CrushFTP 管理ファイル転送 MFT ソフトウェアにおけるユーザー認証の処理方法を攻撃者が制御できるようにする、重大な深刻度の脆弱性です。 影響を受けるバージョン: 10.0.0 から 10.8.3、および 11.0.0 から 11.3.0 エクスプロイトの概要: 既知のユーザー名を使用した、リモートかつ認証されていない CrushFTP への HTTP リクエストにより、ユーザーになりすまして、管理者操作やデータ取得を含むアクションを代わりに実行できます。 この脆弱性は、CrushFTP バージョン 11.3.1 以降および 10.8.4...

PT-2026-97695

Name of the Vulnerable Software and Affected Versions OpenStack Swift versions prior to 2.38.2 Description The tempurl middleware fails to reject the X-Copy-From header during PUT requests. Because a TempURL signature only validates the method, expiry, and path, the system relies on a list of...

PT-2026-95129

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.52 Description Improper state validation in Skia allows a remote attacker to obtain cross-origin data through the use of a crafted HTML page. Skia is a 2D graphics library used for rendering...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: use the correct logic to get mma8452data. The original logic for getting mma8452data is incorrect. The dev points to the device belonging to iiodev. We cannot use this dev to find the correct i2cclient. The...

CVE-2026-62088 WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4...

CVE-2026-19051

Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448...

CVE-2026-85307 WordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08...

CVE-2026-85307 WordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08...

CVE-2026-85307

KP Agent Ready is a WordPress plugin developed by Kevin Pirnie. Versions prior to 1.2.08 are affected by an Insertion of Sensitive Information Into Sent Data vulnerability that allows an unauthenticated remote attacker to retrieve embedded sensitive data. The CVSS v3.1 score is 5.3 (Medium) with ...

DEBIAN-CVE-2026-76176

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

EUVD-2026-70371

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

CVE-2026-76176

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...