CVE-2026-107466 Flatpak-builder: local file exfiltration via `file

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration CI system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers URIs within source download definitions, t...

CVE-2026-107466

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration CI system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers URIs within source download definitions, t...

Pwdlyser

Pwdlyser Nuevo repositorio para publicación pública Pwdlyser P assw ord -Analyser es una herramienta de análisis multifuncional creada para proporcionar a profesionales de la seguridad y organizaciones que buscan mejorar su postura de seguridad la capacidad de revisar y analizar fácilmente...

evil-ssdp

Overview This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable phishing page. This page can load a...

waldo

Waldo es una herramienta ligera y multihilo de fuerza bruta para directorios y subdominios implementada en Python. Se puede utilizar para localizar recursos web ocultos y subdominios no descubiertos del objetivo especificado. Características Principales Genera rápida y fácilmente una lista de tod...

apache-web-log-analysis-lab

Apache Web Log Analysis Lab Blue Team lab focused on analyzing Apache HTTP server logs to detect web scanning activity, directory enumeration, and path traversal attempts. Objective Install and expose an Apache web server in an isolated lab environment, simulate automated web scanning using...

zerologon

Zerologon Set of scripts, to test and exploit the zerologon vulnerability CVE-2020-1472 What is it? ZeroLogon is a vulnerability that allows us to exploit a cryptography flaw in Microsoft's Active Directory Netlogon Remote Protocol MS-NRPC, which allows users to log in to servers using NTLM...

Exploits_and_Advisories

Exploits y Avisos Repositorio que rastrea exploits, vulnerabilidades y avisos públicos que co-descubrí o co-redacté. CVEs CVE| ID| Objetivo| Descripción| Divulgación ---|---|---|---|--- CVE-2020-10881| ZDI-20-333| TP-Link Archer A7/C7| desbordamiento de pila DNS| Pwn2Own Tokyo 2019 CVE-2020-10882...

latma

Herramienta de análisis de movimiento lateral El analizador de movimiento lateral LATMA recopila registros de autenticación del dominio y entornos de Azure AD y busca posibles ataques de movimiento lateral y actividad sospechosa. El movimiento lateral puede ocurrir en el entorno de AD o entre la...

CVE-2026-86826

The BackWPup WordPress plugin, in versions before 5.7.7 , fails to properly restrict web access to the working directory utilized during backup restores. On webservers that do not honor .htaccess rules, such as NGINX , unauthenticated attackers can download full backup archives left behind by int...

CVE-2026-17609

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

CVE-2020-25068

CVE-2020-25068 Exploit en Python para Conacwin v3.7.1.2. Setelsa Conacwin v3.7.1.2 es vulnerable a una vulnerabilidad de inclusión de archivos locales. Esta vulnerabilidad permite a un atacante remoto no autenticado leer archivos internos en el servidor a través de una URI de Directory Traversal...

CVE-2026-49179-Active-Directory-WriteSPNScript-Command-Injection

CVE-2026-49179: Active Directory WriteSPNScript Command Injection Summary Field| Value ---|--- CVE ID| CVE-2026-49179 CVSS| 8.8 AV:N/AC:L/PR:L/UI:N CWE| CWE-77 Command Injection Affected Component| ntdsai.dll — WriteSPNScript function Affected Systems| Windows Server 2016, 2019, 2022, 2025...

CVE-2024-23334-PoC

CVE‑2024‑23334 Path Traversal - PoC I created this script to automate the exploitation of CVE‑2024‑23334 on the Hack The Box Chemistry machine. This vulnerability affects aiohttp versions ≥ 1.0.5 and 3.9.2 when the application is configured to serve static files with followsymlinks=True, allowing...

CVE-2026-17609

The Super Forms WordPress plugin (versions up to and including 6.3.316 ) is vulnerable to unauthenticated arbitrary directory deletion . The flaw exists in the submit_form function due to insufficient validation of attacker-controlled JSON field declarations against the form schema. Specifically,...

EUVD-2026-94736

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

CVE-2026-17609 Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

CVE-2026-105816

A flaw was found in Vault. This vulnerability allows a privileged operator to achieve arbitrary code execution on the underlying host system. Vault does not consistently verify that stored plugin catalog entries reference binaries located within the designated plugin directory. In configurations...

fastfuz-chrome-ext

FastFuzz Chrome Extension Fuzzing rápido de sitios web con extensión de Chrome Captura de pantalla Instalación Añadir tus archivos personalizados Abre files.txt Pega el nombre de tu archivo o directorio línea por línea Feliz cacería TAREAS PENDIENTES Añadir hallazgos de tamaño de respuesta Añadir...

sudowp-dropzone-elementor

SudoWP DropZone for Elementor Contributors: SudoWP, WP Republic Original Authors: WEB-SHOP-HOSTING Tags: elementor, dropzone, upload, security-patch, fork, cve-2024-5153, honeypot Requires at least: 5.6 Tested up to: 6.7 Stable tag: 1.7.17 License: GPLv2 or later Security Notice This is a...