etherblob-explorer

EtherBlob Explorer Search and extract blob files on the Ethereum network using Etherscan.io API. Introduction EtherBlob Explorer is a tool intended for researchers, analysts, CTF players or anyone curious enough wanting to search for different kinds of files or any meaningful human-supplied data ...

etherblob-explorer

EtherBlob Explorer Ethereumネットワーク上でブロブファイルを検索・抽出するためのツールで、Etherscan.io APIを使用します。 はじめに EtherBlob...

PressVector

🧨 PressVector — WordPress CVE-2026-63030 / CVE-2026-60137 Exploitation Framework ⚡ Advanced Pre-Auth RCE & Blind SQLi Exploitation Framework for WordPress Core 📌 Overview PressVector is a comprehensive, fully automated exploitation framework targeting CVE-2026-63030 and CVE-2026-60137 — two...

Spring4Shell-CTF

Spring4Shell CVE-2022-22965 脆弱性環境構築と CTF 問題設計 プロジェクト概要 本プロジェクトは、2 トラック方式のセキュリティ研究実装を含みます： 1. 従来の Vulhub 環境構築 ：オープンソースの Vulhub 脆弱性データベースを利用して、旧バージョンの Spring フレームワークのオブジェクトバインディング欠陥を迅速に再現します。 2. 全新カスタム環境開発 ：チームメンバーが手書きで Java ソースコードを作成し、自主的に「学生期末プロジェクト成果発表システム」を脆弱性ターゲットとして構築し、標準的なネットワーク侵入テストの流れと組み合わ...

dynmx

dynmx Prototype dynmx spoken dynamics is a signature-based detection approach for behavioural malware features based on Windows API call sequences. In a simplified way, you can think of dynmx as a sort of YARA for API call traces so called function logs originating from malware sandboxes. Hence,...

CVE-2022-0185

CVE-2022-0185 Linux カーネル権限昇格エスケープ toc 脆弱性概要 脆弱性ID: CVE-2022-0185 脆弱性スコア: 脆弱性製品: Linux カーネル - fsconfig syscall 影響範囲: Linux カーネル 5.1-rc1 5.16.2 利用条件: Linux ローカル; CAPSYSADMIN cap権限を保有unshare で直接取得できるため、事実上無制限 利用効果: ローカル権限昇格; コンテナエスケープ ソースコード取得: git clone git://kernel.ubuntu.com/ubuntu/ubuntu-focal.g...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ テスト中 このPoCは活発にテストおよび改良中です。機能はリリースごとに変更される可能性があります。 CVE-2026-3180 WordPress Contest Gallery — 認証不要のブラインドSQLインジェクション CVE-2026-3180の概念実証評価ツール 作者: Sudeepa Wanigarathna · 発見: cardosource !IMPORTANT 認可された使用のみ。...

CVE-2025-39247

CVE-2025-39247 Objetivo: HikCentral Professional HCMP, servidor central VMS CVE: CVE-2025-39247 — Vulnerabilidad de Control de Acceso CVSS 3.1: 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Afectado: V2.3.1 – V2.6.2 y V3.0.0 Corregido: V2.6.3 / V3.0.1 / Fix-Pack CVE-2025-39247 Divulgado: 2025-08-28 Fec...

awspwn

AWSPwn - AWS attack-path automation Enumerate an account's IA...

mysqli

MySQLi.py - Time-Based Blind SQL Injection for MySQL MySQLi.py is a personal practice project, inspired by Exploit-DB exploit 46635, used during the SimpleCTF room on TryHackMe. What caught my attention in the original exploit was its ability to extract credentials and even crack the password has...

dirsearch

DirSearch This software is a Go implementation of the original dirsearch tool written by Mauro Soria. DirSearch is the very first tool I write in Go, mostly to play and experiment with Go's concurrency model, channels, and so forth : Purpose DirSearch takes an input URL -url parameter and a...

CVE-2025-2304

CVE-2025-2304 - Camaleon CMS 2.9.0 - Privilege Escalation Exploit Overview This Python script exploits a critical mass assignment vulnerability in Camaleon CMS version 2.9.0, allowing any registered user to escalate their privileges to administrator. Vulnerability Details CVE : CVE-2025-2304 - Ma...

CVE-2026-63030

CVE-2026-63030 — WordPress wp2shell Exploit Unauthenticated detection and exploitation tool for the WordPress core batch-confusion vulnerability CVE-2026-63030 / CVE-2026-60137, which leads to SQL injection and remote code execution RCE through the REST API batch endpoint. ⚠️ For authorized...

CVE-2026-82727 AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...

EEF-CVE-2026-82727 AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

Summary Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash\phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When...

CVE-2026-82727 AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...

CVE-2026-82727

ash_phoenix (by ash-project) has a sensitive information disclosure in AshPhoenix.Form.Auto 's union sub-form handling. When the submitted _union_type parameter does not match a configured type, the raised error message embeds the full raw parameter map via inspect(params, pretty: true). Because ...

EUVD-2026-68334

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...

CVE-2026-82727 AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...

dns-rebind-toolkit

DNS Rebind 工具包 演示 | 安全公告 | 包含的载荷 | 常见问题 免责声明：本软件仅用于教育目的。本软件不得用于非法活动。作者对其使用不承担任何责任。别当混蛋。 DNS Rebind 工具包是一个前端 JavaScript 框架，用于针对局域网（LAN）上的脆弱主机和服务开发 DNS 重绑定 漏洞利用。它可用于攻击 Google Home、Roku、Sonos WiFi 音箱、WiFi 路由器、“智能”恒温器及其他物联网设备。使用此工具包，远程攻击者可以绕过路由器的防火墙，直接与受害者家庭网络上的设备交互，窃取隐私信息，在某些情况下甚至可以控制脆弱的设备本身。...