SharePointDumper

SharePointDumper SharePointDumper is a PowerShell-based extraction and auditing utility that enumerates SharePoint sites a user can access via Microsoft Graph and downloads files via SharePoint. It is designed for SOC / DLP testing, purple teaming, and non-sophisticated red-team assessments, and...

QRExfil

QRExfiltrate This tool is a command line utility that allows you to convert any binary file into a QRcode GIF. The data can then be reassembled visually allowing exfiltration of data in air gapped systems. It was designed as a proof of concept to demonstrate weaknesses in DLP software; that is, t...

egression

Description EGRESSION is a tool that provides an instant view of how easy it is to upload sensitive data from any given network. It starts with a sensitive file with these contents, which is stored locally in plaintext. This file is used to test the egress / DLP controls on the network by...

PacketWhisper

PacketWhisper PacketWhisper - Stealthily Transfer Data & Defeat Attribution Using DNS Queries & Text-Based Steganography, without the need for attacker-controlled Name Servers or domains; Evade DLP/MLS Devices; Defeat Data- & DNS Name Server Whitelisting Controls. Convert any file type e.g...

Cloakify

CloakifyFactory CloakifyFactory & the Cloakify Toolset - Data Exfiltration & Infiltration In Plain Sight; Evade DLP/MLS Devices; Social Engineering of Analysts; Defeat Data Whitelisting Controls; Evade AV Detection. Text-based steganography using lists. Convert any file type e.g. executables,...

BlockGuard

🛡️ BlockGuard — Process-Based File Access Security Agent BlockGuard is a Windows Data Loss Prevention DLP agent that intercepts and controls file access at the process level. It ensures that only authorized processes — identified by executable path, cryptographic hash, Authenticode signature, and...

CVE-2026-26331

Arbitrary Command Injection via --netrc-cmd in yt-dlp Severity: High CVSS 8.8 Affected Software: yt-dlp = 2023.06.21, Patched In: 2026.02.21 Advisory: GHSA-g3gw-q23r-pgqm CVE: CVE-2026-26331 Summary yt-dlp’s --netrc-cmd command-line option or netrccmd Python API parameter can be abused to achieve...

CVE-2023-0400

Trellix Data Loss Prevention DLP Bypass https://kcm.trellix.com/corporate/index?page=content&id=SB10394...

CVE-2026-115740

Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary UNC paths without validation. The server-side code attempts to open the specified file path, causi...

CVE-2026-115739

Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files...

CVE-2026-115740

Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary UNC paths without validation. The server-side code attempts to open the specified file path, causi...

EUVD-2026-117545

Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary UNC paths without validation. The server-side code attempts to open the specified file path, causi...

CVE-2026-115740

A Server-Side Request Forgery (SSRF) vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier. The flaw resides in the OpenEventEvidenceFile.do endpoint, where the Prefix parameter fails to validate arbitrary UNC paths. An attacker can provide a malicious UNC path, causing t...

CVE-2026-115738

SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries...

EUVD-2026-117542

Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files...

CVE-2026-115739

A hard-coded cryptographic key vulnerability exists in DLP on-prem extensions version 11.13.1 and earlier . This flaw allows a remote attacker to decrypt sensitive credentials and evidence files . The vulnerability is associated with CWE-321 and has a CVSS 4.0 base score of 6.0 (MEDIUM) . No spec...

CVE-2026-115739

Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files...

EUVD-2026-117530

SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries...

CVE-2026-115738

SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries...

CVE-2026-115738

A SQL injection vulnerability exists in DLP on-prem extensions version 11.13.1 and earlier . The flaw allows a remote authenticated attacker to inject SQL queries because the application fails to use sanitization or parameterized queries . The vulnerability is associated with CWE-89 and carries a...