Exploit-Dev-Sandbox

Exploit-Dev Sandbox Task 6 — Offensive Security Capstone...

CVE-2026-75802

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...

CVE-2026-75802

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...

CVE-2026-75802 Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...

Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

Threat actors associated with Aurora aka Aur0ra ransomware have been observed using SpaceX's artificial intelligence AI-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit Security. The two independent analyses are based on exposed...

Awesome-Android-Reverse-Engineering

Awesome Android Reverse Engineering Курируемый список материалов, ресурсов и инструментов по реверс-инжинирингу Android. Как пользоваться Awesome-Android-Reverse-Engineering — это замечательный список для людей, которые занимаются разбором Android-приложений, систем или компонентов. Просто нажмит...

Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance

Claude Code reads files, runs shell commands, invokes MCP tools, and acts through the credentials available on a developer’s machine. Anthropic’s new Compliance API endpoints give security teams their clearest view yet into that activity. They also expose a larger problem: activity logs alone...

CVE-2022-31297

CVE-2022-31297 Haraj Script 3.7 - Отражённый XSS Название эксплойта: Haraj Script 3.7 - Отражённый XSS Дата: 2022-06-13 CVE: CVE-2022-31297 Автор эксплойта: Abdulaziz Saad @b4zb0z Сайт разработчика: https://angtech.org/ Ссылка на ПО: https://angtech.org/product/view/3...

CVE-2025-53770

CVE-2025-53770 SharePoint Описание Десериализация ненадёжных данных в локальном Microsoft SharePoint Server позволяет злоумышленнику удалённо выполнить код и скомпрометировать систему. Microsoft известно об активной эксплуатации, и компания готовит комплексное обновление. Убедитесь, что меры...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

CVE-2020-17519

CVE-2020-17519 Версия на языке Cheetah CVE-2020-17519, поддерживает массовое сканирование. Скопируйте ip.txt в папку /script/漏洞探测/Apache/, откройте Wker主程序...

CVE-2023-1671-POC

Dork fofa title="Sophos Web Appliance" || app="Sophos-Web-Appliance" && title!="Sophos Web Appliance：错误请求" ZoomEye title:"Sophos Web Appliance"-title:"Sophos Web Appliance: Forbidden"-title:"Sophos Web Appliance: Bad Request" Shodan title:"Sophos Web Appliance" 사용법 root@kitploit: python...

CVE-2026-9833

CVE-2026-9833 CVE ID: CVE-2026-9833 취약점 유형: 크로스 사이트 스크립팅XSS – 반사형 XSS CWE: CWE-79 – 웹 페이지 생성 중 입력의 부적절한 중화'크로스 사이트 스크립팅' 심각도: 높음 CISA ADP CVSS v3.1: 7.1 개요 CVE-2026-9833은 2.2.0 버전 이전의 Tag Groups – Advanced Way to Display Your Taxonomy Terms WordPress 플러그인에 영향을 미칩니다. 이 취약점은 플러그인의 AJAX 매개변수 중 하나가 제...

CVE-2024-4956

CVE-2024-4956 POC - CVE-2024–4956 - Nexus Repository Manager 3 Неавторизованный обход пути Потенциально позволяет злоумышленнику читать определенную информацию на шлюзах безопасности Check Point после подключения к Интернету и включения Remote Access VPN или Mobile Access Software Blades. Доступн...

CVE-2026-47842

A flaw was found in Spring Security. Applications configured to use AesBytesEncryptor with a two-argument constructor or a null Initialization Vector IV generator in Cipher Block Chaining CBC mode will encrypt data using a predictable, all-zero IV. This deterministic encryption allows an attacker...

Detection-script-for-cve-2021-23358

Скрипт обнаружения для cve-2021-23358 Скрипт обнаружения для CVE-2021-23358. Я создал скрипт обнаружения для CVE-2021-23358, который обнаруживает уязвимую версию node underscore, независимо от того, установлен ли он как инструмент с открытым исходным кодом или просто используются библиотеки. Этот...

NetSet

NetSet Утилита и автоматизатор операционной безопасности. Версия 1.1.0 NetSet предназначен для автоматизации ряда операций, которые помогут пользователю защитить свой сетевой трафик. Он также предоставляет простой способ получения прокси и запуска утилит через Tor. Все утилиты, устанавливаемые и...

CVE-2023-36845-6-

CVE-2023-36845-6 CVE-2023-36845 and CVE-2023-36846 Juniper Junos OS J-Web RCE Только для образовательных целей. root@kitploit: echo "----------------Welcome-to-cve-2023-36845-6-script-by-1veresk----------+"; echo "+----------------------------------------------------------------------+"; echo...

CVE-2023-0297_Pre-auth_RCE_in_pyLoad

CVE-2023-0297: pyLoad에서 인증 전 RCE pyLoad에서 인증 전 RCE를 발견한 이야기 TL;DR 0.5.0b3.dev31 이전 버전의 pyLoad에서 js2py의 기능을 악용하여 인증 전 RCE로 이어지는 코드 인젝션 취약점이 존재합니다. 보고서는 여기에서, 익스플로잇 코드는 여기에서 확인할 수 있습니다. 세부 사항 pyLoad는 Python으로 작성된 오픈소스 다운로드 매니저이며 웹 인터페이스로 관리할 수 있습니다. GitHub 저장소는 2023년 1월 9일 기준 약 2.8k 스타를 보유하고 있습니다...

Oracle-WebLogic-CVE-2022-21371

Oracle-WebLogic-CVE-2022-21371 Oracle WebLogic Server 로컬 파일 포함: CVE-2022-21371 영향 받는 버전: Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 및 14.1.1.0.0 설명: Oracle Fusion Middleware의 Oracle WebLogic Server 제품Web Container 구성 요소은 로컬 파일 포함 취약점에 영향을 받습니다. 쉽게 악용될 수 있는 이 취약점은 HTTP 네트워크 접근 권한이 있는 인증되지 않은 공격자가...