419 matches found
GyoiThon
GyoiThon : Next generation penetration test tool Japanese page is here. Presentation January 25th,2018:JANOG41 March 23th,2018:Black Hat ASIA 2018 Arsenal August 12th,2018:DEFCON26 DemoLabs October 24th,2018:OWS in CSS2018 November 3rd,2018:AV TOKYO 2018 HIVE December 22-23th,2018:SECCON YOROZU...
Langflow - Broken Access Control
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories...
wp2shell-lab
wp2shell lab & detector + pre-auth RCE PoC A self-contained lab, non-destructive detector , and full pre-auth RCE proof-of-concept for wp2shell β the pre-authentication vulnerability chain in WordPress core:...
CVE-2026-49049
CVE-2026-49049 β Helix3 Joomla Plugin JoomShaper Unauthenticated AJAX Handler β Read-Only Vulnerability Scanner Overview CVE-2026-49049 affects the Helix3 template framework for Joomla versions 1.0 through 3.1.0. The onAjaxHelix3 handler, reachable via Joomla's comajax dispatcher, performs no...
CVE-2026-22557-Path-Traversal-Ubiquti-UniFi
CVE-2026-22557 Path Traversal Ubiquti UniFi Network Application This repository contains a Go-based proof-of-concept scanner for CVE-2026-22557 targeting the UniFi Network Application. The tool performs a controlled and non-destructive scan against a set of common endpoints and traversal payloads...
CVE-2018-6389
CVE-2018-6389 Exploit CVE-2018-6389 Checker β a small, nonβdestructive Python tool that checks for indicators of the CVEβ2018β6389 WordPress vulnerability by issuing three controlled load-scripts.php requests and analysing response size, timing and JS token patterns. β οΈ Disclaimer Use this tool...
CVE-2019-0708-Check
360 RDP vulnerability non-destructive scanner: https://cert.360.cn/warning/detail?id=1caed77a5620fc7da993fea91c237ed5 GitHub project: https://github.com/hualy13/CVE-2019-0708-Check...
CVE-2026-94105 NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller
NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to...
CVE-2026-94105
NivoCart through 2.4.0 contains a destructive configuration write vulnerability in its admin password reset controller (reset.php). An unauthenticated attacker can send a GET request with a missing or incorrect code parameter , which rewrites the config_password setting to 0, effectively disablin...
CVE-2026-94105 NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller
NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to...
CVE-2026-54446
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, network-reachable HTTP transport requests to /mcp that omit x-netlicensing-api-key, Authorization: Bearer, and the apikey...
CVE-2026-54446 NetLicensing MCP Server: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, network-reachable HTTP transport requests to /mcp that omit x-netlicensing-api-key, Authorization: Bearer, and the apikey...
CYBERDUDEBIVASH-Modular-DS-CVE-2026-23550-Detector
CYBERDUDEBIVASH Modular DS CVE-2026-23550 Detector Overview This is an authorized CYBERDUDEBIVASH ECOSYSTEM tool for detecting CVE-2026-23550 in WordPress Modular DS plugin. It non-destructively checks for vulnerable versions = 2.5.1 by parsing the plugin's readme.txt. Ideal for cybersecurity...
Mass-Scanner-CVE-2026-2631
β‘ CVE-2026-2631 Async Mass Checker Private async mass-checker for internal WordPress validation π¨ Warning This tool performs a destructive validation. It sends a POST request to the target endpoint and may changeshopsecret on vulnerable targets. Use it only on systems you own or are explicitly...
CVE-2026-31431-exploit
CVE-2026-31431 WARNING These Linux LPE exploit implementations are runtime-destructive. They overwrite the live page-cache view of privileged targets such as: su PAM configuration files any file passed into patch mode This is usually not a normal persistent on-disk edit, but it does change runtim...
CVE-2026-42569
π¨ CVE-2026-42569 - phpVMS Unauth Database Wipe Unauthenticated Database Wipe / Destructive Import in phpVMS π Overview CVE-2026-42569 is a critical vulnerability in phpVMS Virtual Airline Management System that allows unauthenticated attackers to access legacy import endpoints. These endpoints we...
Astra Linux β Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fixed a potential kernel bug due to the lack of a writeback flag during waiting. Destructive writes to a block device on which nilfs2 is mounted can cause a kernel bug in the folio/page writeback start routine or writebac...
CVE-2026-86747
Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unacceptedassets/sentreminder ReportsController::sentAssetAcceptanceReminder and DELETE /reports/unacceptedassets/acceptanceId/delete...
EUVD-2026-74924
Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unacceptedassets/sentreminder ReportsController::sentAssetAcceptanceReminder and DELETE /reports/unacceptedassets/acceptanceId/delete...
CVE-2026-76072
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...