zdr

Retención Cero de Datos ZDR para Proveedores de LLM Última actualización: abril de 2026 Una guía práctica para mantener tus datos privados al usar APIs de LLM. Cubre endpoints de retención cero, auto-alojamiento, requisitos de cumplimiento y patrones de protección de datos para ingenieros en...

CVE-2026-0770

CVE-2026-0770: Langflow execglobals Unauthenticated Remote Code Execution PoC CVE-2026-0770 an unauthenticated Remote Code Execution RCE vulnerability affecting Langflow. The flaw stems from improper input validation within the handling of the execglobals parameter provided to the /validate...

DockerENT

DockerENT DockerENT 是一款活跃运 行时应用安全扫描工具 （RAST 工具）。它是一个基于 Python 编写的插件化框架。它带有 CLI 应用程序 和一个使用 StreamLit 编写的简洁 Web 界面 。 DockerENT 旨在检测生产部署中可能导致严重后果的薄弱安全配置错误。该应用程序与系统中的运行中容器连接，获取薄弱和有漏洞的运行时配置列表，并生成报告。 如果通过 Web 界面调用，它可以在 UI 本身中显示扫描和审计报告。 如何运行 TL;DR 急着测试它？从 PyPi 下载最新的 稳定版 ，然后运行 Web 应用，其他一切都很直观。 pip instal...

graphw00f

Credits to Nick Aleks for the logo! graphw00f - GraphQL Server Fingerprinting Table of Contents How does it work? Detections GraphQL Threat Matrix Prerequisites Installation Configuration Example Usage Fingerprinting GraphQL Detecting & Fingerprinting GraphQL Support & Issues Resources How does i...

cve-collector

CVE-Collector 用Python编写的简易最新CVE收集器 收集最新CVE（通用漏洞与暴露）信息有多种方法。 此代码旨在为创建CVE收集器时如何收集、包含哪些信息以及如何编码提供指导。 此处提供的代码仅是实现CVE收集器的众多方式之一。 它使用一种方法编写：爬取特定网站、解析HTML元素并检索数据。 该收集器使用 https://www.cvedetails.com 上的搜索查询来收集严重性评分为6或更高的漏洞信息。 功能特点 它创建一个简单的基于分隔符的文件作为数据库（无需数据库管理系统）。 当发现新的CVE时，它还会检索"漏洞详细信息"。 设置方法 1. 设置...

CVE-2022-45988

CVE-2022-45988 StarSoftComm HP CooCare An elevation of privilege vulnerability exists I have contacted with hp-security-alert They have fixed this bug. About StarSoftComm CooCare HP-PSRT-IR 4106 The vendor responded with the following information: Follow these steps to update: 1. Launch eService ...

CVE-2025-39247

CVE-2025-39247 Objetivo: HikCentral Professional HCMP, servidor central VMS CVE: CVE-2025-39247 — Vulnerabilidad de Control de Acceso CVSS 3.1: 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Afectado: V2.3.1 – V2.6.2 y V3.0.0 Corregido: V2.6.3 / V3.0.1 / Fix-Pack CVE-2025-39247 Divulgado: 2025-08-28 Fec...

DSSS

Damn Small SQLi Scanner Damn Small SQLi Scanner DSSS 是一个功能完整的 SQL 注入 漏洞扫描器（支持 GET 和 POST 参数），其代码行数不到 100 行。 可选设置方面，它支持 HTTP 代理以及 HTTP 头值 User-Agent、Referer 和 Cookie。 运行示例 root@kitploit: $ python3 dsss.py -h Damn Small SQLi Scanner DSSS 100 LoC Lines of Code v0.3a by: Miroslav Stampar @stamparm...

CVE-2026-89029

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2sgetselectmandantuser AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller ...

pbtk

pbtk - Reverse engineering Protobuf apps Protobuf is a serialization format developed by Google and used in an increasing number of Android, web, desktop and more applications. It consists of a language for declaring data structures , which is then compiled to code or another kind of structure...

PyMemoryEditor

PyMemoryEditor A pure-Python library built on ctypes that lets you inspect, modify and search the memory of any running process in a few lines of Python — Cheat Engine workflows on Windows, Linux and macOS! Read, write and scan the memory of any process — straight from Python. One unified API...

XSStrike

XSStrike Advanced XSS Detection Suite XSStrike Wiki • Usage • FAQ • For Developers • Compatibility • Gallery XSStrike is a Cross Site Scripting detection suite equipped with four hand written parsers, an intelligent payload generator, a powerful fuzzing engine and an incredibly fast crawler...

dorkbot

dorkbot Scan Google or other search results for vulnerabilities. dorkbot is a modular command-line tool for performing vulnerability scans against sets of webpages returned by Google search queries or other supported sources. It is broken up into two sets of modules: Indexers - modules that retur...

CVE-2023-49547

CVE-2023-49547 Customer Support System 1.0 - SQL Injection Login Bypass Description : Customer Support System is vulnerable 1.0 to SQL Injection. A SQL injection vulnerability in Customer Support System 1.0 enables remote, unauthenticated attackers to bypass the authentication process by exploiti...

macnoise

MacNoise MacNoise generates real macOS telemetry: network connections, file writes, process spawns, plist mutations, TCC probes, and more. Point it at a machine running your EDR, SIEM, or firewall stack and see what actually fires - not what the vendor datasheet claims will fire. For background o...

solarview-ics-vulnerability-analysis

SolarView ICS Vulnerability Analysis A cyber-physical threat analysis of the SolarView Compact / Mirai botnet incident, in which attackers exploited CVE-2022-29303 to compromise roughly 800 solar monitoring appliances at Japanese photovoltaic facilities. Course project for ECE 362 — Cyber-Physica...

CVE-2020-3153

CVE-2020-3153 POC code for CVE-2020-3153 - Cisco anyconnect path traversal vulnerability Read more about the vulnerability here: https://ssd-disclosure.com/ssd-advisory-cisco-anyconnect-privilege-elevation-through-path-traversal/ Steps to follow to get Windows shell on desktop with SYSTEM...

JS Help Desk <= 2.8.1 - SQL Injection

The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to SQL Injection via the 'email' and 'trackingid' parameters in all versions up to 2.8.2 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

PMB 7.4.6 - Cross-Site Scripting

PMB 7.4.6 contains a cross-site scripting vulnerability via the query parameter at /admin/convert/exportz3950new.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticatio...

PHPJabbers Service Booking Script 1.0 - Cross Site Scripting

A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely. id: CVE-2023-4113...