CVE-2023-32233-reproduction

CVE-2023-32233 — nftables 释放后使用：复现与根因分析 本仓库内容： 我对 CVE-2023-32233 的动手复现与研究。该漏洞是 Linux 内核 Netfilter nftables 子系统中的一个释放后使用（use-after-free），可导致本地权限提升，由 Patryk Sondej 和 Piotr Krysiuk 于 2023 年 5 月公开披露。 致谢： PoC（exploit.c）及原始分析文章出自 @Liuk3r。我在本仓库中的工作是：在自己的实验环境中（Ubuntu 23.04，内核...

HardeningKitty

HardeningKitty 这是来自 Michael Schneider 的 Windows Hardening 项目 的 HardeningKitty 稳定版本。 HardeningKitty 的稳定版本使用 scip AG 的代码签名证书进行签名。由于这是稳定版本，我们不在本仓库接受拉取请求，请将其发送至开发仓库。 HardeningKitty 支持对 Windows 系统进行加固。系统配置通过查找列表（finding list）进行检索和评估。此外，还可以根据预定义值对系统进行加固。 HardeningKitty 从注册表读取设置，并使用其他模块读取注册表之外的配置。...

Blue-Team-Notes

Blue Team Notes A collection of one-liners, small scripts, and some useful tips for blue team work. I've included screenshots where possible so you know what you're getting. Contact me If you see a mistake, or have an easier way to run a command then you're welcome to hit me up on Twitter or comm...

SentinelThread-Forensics

English | 日本語 Hayabusa-Rulesについて Windowsのイベントログから攻撃を検出するキュレーションされたSigmaルールをまとめているリポジトリです。 主にHayabusaの検知ルールや設定ファイル、Velociraptor内蔵のSigma検知などに使用されています。 上流のSigmaリポジトリよりもこのリポジトリを使う利点は、ほとんどのSigmaネイティブツールがパースできるはずのルールだけを含んでいることです。...

acp-framework-en

ACP — Agent Control Protocol Admission control for agent actions. Before any agent mutates system state, ACP answers four questions: Who is this agent? What are they authorized to do? Is this action policy-compliant? Can the outcome be traced to an accountable institution? Cryptographic identity ...

sparkplugFuzzer

Sparkplug B MQTT 安全模糊测试器 一个用于测试 Sparkplug B MQTT 协议实现的全面安全评估工具。该模糊测试器系统性地测试所有 9 种消息类型中的所有协议字段，发现网络上的活跃设备，并生成详细日志以供分析。 负责任使用 本工具会向目标代理发送畸形、注入及违反协议的 MQTT 消息。只能针对您拥有或已获得明确书面授权进行测试的系统运行。 Sparkplug B 代理通常位于 OT/ICS 环境中，意外的负载可能干扰物理过程 — 除非另有证明，否则假定每个目标都与生产环境相邻。 如果您使用此工具在 Sparkplug B...

CVE-2025-27136-XXE-LocalS3

CVE-2025-27136 XXE-LocalS3 CVE-2025-27136（Local-S3 中的 XXE）概念验证 └─$ python3 exploit.py http://$ip:8080 /etc/passwd + S3 service detected + Creating bucket: xxe-32d14993 + Server response: ac3aaf20-e59a-4705-9505-3ebb01db7fc1 + Retrieving file via ?location + Response: root❌0:0:root:/root:/bin/bash...

CVE-2026-36980-Kernel-BSOD-DoS-PoC

CVE-2026-36980-Kernel-BSOD-DoS-PoC 项目日期：2026年2月 / 发现pwdrvio.sys内核驱动中IOCTL处理程序存在缓冲区溢出漏洞。该漏洞允许本地非特权攻击者破坏内核池内存，触发即时系统崩溃（蓝屏死机）和拒绝服务。 2026-02-09 通知供应商 2026-03-05 供应商确认 2026-03-05 向MITRE申请CVE 2026-05-10 在90天协调披露期后公开披露 https://github.com/user-attachments/assets/b53fb5d1-b4d0-4bc6-ad6e-2a321a1d2101...

CVE-2026-89247

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection in plugin/AD_Server/VMAP.php, reachable without authentication when the AD_Server plugin is enabled. The timeOffset and idTag values from the base64- and JSON-decoded $_REQUEST['vmaps'] parameter ...

CVE-2026-89247 WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/ADServer/VMAP.php, which is reachable without authentication when the ADServer plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset a...

CVE-2026-89247 WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/ADServer/VMAP.php, which is reachable without authentication when the ADServer plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset a...

EUVD-2026-76059

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/ADServer/VMAP.php, which is reachable without authentication when the ADServer plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset a...

CVE-2026-89244 WWBN AVideo Reflected XSS via Gallery Category getBackURL

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

CVE-2026-89244

WWBN AVideo through commit c3edcc27 contains a reflected XSS in plugin/Gallery/view/Category.php when the SubCategories feature is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing an attacker to inject a script that executes in a visitor's browser...

CVE-2026-89244 WWBN AVideo Reflected XSS via Gallery Category getBackURL

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

EUVD-2026-76056

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

CVE-2026-89241

WWBN AVideo contains a reflected cross-site scripting (XSS) vulnerability in confirmLivePassword.php . The root cause is that the script copies the REQUEST_URI variable directly into a form action attribute without encoding. An attacker can craft a malicious URL containing a quote character to br...

CVE-2026-89241 WWBN AVideo Reflected XSS via confirmLivePassword.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUESTURI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of t...

EUVD-2026-76053

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUESTURI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of t...

CVE-2026-89241 WWBN AVideo Reflected XSS via confirmLivePassword.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUESTURI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of t...