Axiom-protocol

Axiom: Decentralized and Censorship-Resistant Communication Protocol 🚀 Live Deployment Details Network: Arbitrum One Mainnet L2 Chain ID: 42161 RPC Endpoint: https://arb1.arbitrum.io/rpc or any custom Alchemy/Infura endpoint Axiom Proxy Contract Address: 0xc11CFf8111e8b1F055eba095Efb679a38Abe6b63...

CVE-2023-34632

CVE-2023-34632 Reflected XSS in 1000projects Book Management System 1.0 CVE-2023-34632 Reflected Cross-Site Scripting XSS in 1000projects Book Management System 1.0 Description A Reflected Cross-Site Scripting XSS vulnerability was discovered in 1000projects Book Management System version 1.0. Th...

redsun-bluehammer-undefend-detection-pack

RedSun、BlueHammer、UnDefend、およびCrossFamily検出パック 重要:...

-CVE-2023-33177-

Xibo CMS CVE-2023-33177 脆弱性テスター CVE-2023-33177 の自動セキュリティテストツール - Xibo CMS の Zip Slip パストラバーサル脆弱性によりリモートコード実行 RCE が可能になります。 ⚠️ 免責事項 このツールは教育および許可されたテスト目的のみに使用してください。 自分が所有している、または明示的なテスト許可を得ているシステムでのみ使用してください。 無許可のテストは違法であり、非倫理的です。 📋 説明 Xibo CMS バージョン 1.8.0-2.3.16 および 3.0.0-3.3.4...

BlockGuard

🛡️ BlockGuard — Process-Based File Access Security Agent BlockGuard is a Windows Data Loss Prevention DLP agent that intercepts and controls file access at the process level. It ensures that only authorized processes — identified by executable path, cryptographic hash, Authenticode signature, and...

gibson

Gibson Network monitoring tool that maps process-to-network connections, identifies cloud providers, and generates firewall rules. Lightweight agent for collection, server for aggregation, parser for analysis. Screenshots Cross-machine overview — OS version comparison, shared IP detection,...

soc-investigation-lab

端到端安全运营中心（SOC）调查实验室 针对 Metasploitable2 执行完整的四阶段攻击链（侦察 → 利用 → 持久化 → 数据外泄），在每个阶段收集证据，并生成结构化的入侵时间线和 SOC 报告——同时演示攻击者与防御者思维。 目标 这是一个顶点项目。它展示了以下能力： 针对一个故意存在弱点的目标执行真实的杀伤链 在每个阶段使用多种遥测源收集取证证据 将来自不同系统的日志条目关联到统一的时间线 进行可见性差距分析 ——识别若缺少适当检测覆盖将会 遗漏 什么 以真实安全团队使用的格式生成 SOC 级别的入侵报告 所用的漏洞（CVE-2011-2523 — vsftpd 2.3....

tomcat85-check

tomcat85-check まだ Tomcat 8.5 を動かしていますか?このツールは、2025 年の CVE に実際にどれだけ該当するか を教えてくれます —— この問題は、公式ページ、NVD、スキャナーのどこに聞いても完全な答えは得られません。 依存関係ゼロの単一 jar、オフラインで動作し、ネットワーク接続もアップロードも一切行いません。 これが解決する問題 Tomcat 8.5 は 2024-03-31 に EOL となり、最終版は 8.5.1002024-03-19 リリースです。 その後も Apache は CVE レコードで「8.5...

spring-cvss-check

spring-cvss-check Spring / Tomcat 公式セキュリティアドバイザリ 15 件をカバー2026-08-20 に 7 件 · 2026-06-08 に 5 件 · 2025-09-15 に 1 件 · Tomcat 2026-08-25 に 2 件。 うち 8 件は、NVD を参照するスキャナがCRITICAL 9.1〜9.8 と報告する一方、ベンダー公式の評価は LOW / MEDIUM。 残り 7 件は両者の評価が完全に一致 —— 違いはただ一つ:ベンダーが自ら CVE レコードに CVSS スコアを提出したかどうか。 このツールは 4 つの問いに答えます:...

CVE-2026-31431

🚨 CVE-2026-31431: Copy Fail Linuxカーネルに存在する9年間の重大な脆弱性。数秒でroot権限を取得可能 📋 エグゼクティブサマリー 属性| 詳細 ---|--- CVE| CVE-2026-31431 ニックネーム| Copy Fail タイプ| ローカル権限昇格（LPE） CVSS| 7.8（High） 発見者| Theori（Xint Code） 公開日| 2026年4月29日 対象コンポーネント| Linuxカーネルのalgifaeadサブシステム ⚡ なぜこれほど危険なのか？ 🎯 速度 即時エクスプロイト：root取得まで1秒未満 わずか732バイ...

CVE-2022-37969PoC

목차 일반 소개 이 문서는 Windows 익스플로잇과 관련된 일반적인 사항을 명확히 하기 위해 작성되었습니다. CVE-2022-37969에 적용된 기본 개념을 설명합니다. 최종 결과물은 동작하는 PoC입니다. CVE의 모든 측면을 설명하지는 않지만, 재사용 가능한 코드 조각을 제공하고 많은 일반 익스플로잇에서 찾을 수 있는 메커니즘을 설명합니다. 대상 독자는 기초 리버스 엔지니어, 동작하는 개념 증명 소스 코드를 테스트하고 기본 Windows Internals를 이해하려는 익스플로잇 개발자입니다. 더 깊이 배우기 위한 참조점을...

CVE-2026-1492

CVE-2026-1492 User Registration & Membership = 5.1.2 - 通过会员注册实现未认证权限提升 🔴 漏洞概述 CVE-2026-1492 — 通过会员注册实现未认证权限提升 描述： 用于 WordPress 的 User Registration & Membership 插件在 5.1.2 及之前的所有版本中均存在未认证权限提升 漏洞。该漏洞源于 userregistrationmembershipregistermember AJAX 处理程序在会员注册过程中接受用户提供的role...

CVE-2025-13390

CVE-2025-13390 WP Directory Kit WordPress WP Directory Kit 플러그인은 1.4.4 이하 모든 버전에서wdkgenerateautologinlink 함수의 인증 알고리즘 구현 오류로 인해 인증 우회에 취약합니다. 이는 기능이 암호학적으로 취약한 토큰 생성 메커니즘을 사용하기 때문입니다. 이 결함으로 인해 인증되지 않은 공격자 가 예측 가능한 토큰을 이용해 자동 로그인 엔드포인트로 관리자 권한을 획득하고 전체 사이트를 장악 할 수 있습니다. CNA: Wordfence 기본 점수: 10.0...

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

In this article 1. Risk to enterprise environments 2. Attack chain overview 3. Mitigation and response recommendations 4. Learn more Microsoft Threat Intelligence has observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT or helpdesk...

CTT-HEARTBLEED-Temporal-Resonance-Memory-Leak-Exploit-Heartbleed-CVE-2014-0160

CTT-HEARTBLEED-Temporal-Resonance-Memory-Leak-Exploit-Heartbleed-CVE-2014-0160 Heartbleed CVE-2014-0160 was devastating because it leaked adjacent memory. CTT-Heartbleed goes further—it uses 33-layer temporal resonance to map, reconstruct, and extract specific memory regions across time, not just...

CTT-ProxyLogon-RCE-v1.0---Convergent-Time-Theory-Enhanced-Microsoft-Exchange-Exploit

CTT-ProxyLogon-RCE-v1.0---Convergent-Time-Theory-Enhanced-Microsoft-Exchange-Exploit An advanced exploit for Microsoft Exchange Server CVE-2021-26855, CVE-2021-27065 enhanced with Convergent Time Theory principles, achieving near-perfect theoretical rating through quantum temporal resonance and...

confluence-ognl-rce

CVE-2022-26134 - Atlassian Confluence OGNL RCE This script is a wrapper over an unauthenticated remote code execution via OGNL injection exploit primitive in Confluence Data Center and Server CVE-2022-26314. Vendor advisory Originally inspired by the PoC jbaines-r7/throughthewire. I added the...

CVE-2025-15260

CVE-2025-15260: Missing Authorization / Broken Access Control in Plugin - MyRewards – Loyalty Points and Rewards for WooCommerce Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. ...

GHSA-GCR2-9V8M-GQ45 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

Summary @dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of t...

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

Summary @dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of t...