OutOfTune

OutOfTune Inspired by the original Pytune, OutOfTune registers a rogue device in Entra ID, enrolls it into Intune MDM, and checks the resulting compliance state. Only supports Windows devices as this was my main goal, might add additional ones in the future. Accompanying blog:...

Published-CVE

Published-CVE This repository contains descriptions and exploits for two security vulnerabilities: 1. CVE-2023-33580: Stored Cross-Site Scripting XSS in the Student Study Center Management System V1.0, allowing attackers to execute arbitrary JavaScript code. 2. CVE-2023-33584: SQL Injection SQLI ...

Certi-Bhai

Certi-Bhai: AD CS Exploitation Toolkit Certi-Bhai is a comprehensive collection of PowerShell exploitation tools for attacking Active Directory Certificate Services AD CS vulnerabilities. This toolkit implements various Escalation Scenarios ESCs that demonstrate critical security misconfiguration...

virt-firmware

Tools for ovmf / armvirt firmware volumes This is a small collection of tools for edk2 firmware images. They support decoding and printing the content of firmware volumes. Variable stores OVMFVARS.fd can be modified, for example to enroll secure boot certificates. virt-fw-dump Decodes and prints...

Certighost-CVE-2026-54121

Document Type: Detection Use Case Related CVE: CVE-2026-54121 Certighost Author: Youssef Benchater Detection Use Case: Certighost CVE-2026-54121 This document describes the Splunk detection built for CVE-2026-54121. It follows the standard detection use case format so it can sit in a detection...

CVE-2026-54121

👻 CVE-2026-54121 — CertiGhost Active Directory Certificate Services AD CS Privilege Escalation 👋 Overview CVE-2026-54121 "Certighost" is a high-severity privilege escalation vulnerability affecting Microsoft Active Directory Certificate Services AD CS. The vulnerability allows an authenticated...

CVE-2026-114438 Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. Thi...

CVE-2026-114438

The Keycloak identity and access management solution contains a flaw in the Update User Locale required action. If this action is ordered before the Configure OTP action within a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during login. This allows an at...

CVE-2026-113808

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-113810

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-113810

A Stored Cross-Site Scripting (XSS) vulnerability exists in the SNS enrollment Portal . An attacker can inject malicious scripts via the captive portal while requesting certificate creation for a user. The payload remains stored and can only be triggered when an administrator performs validation....

EUVD-2026-105257

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-113810 Stored XSS on SNS Enrollment Portal

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-113808 Stored XSS on SNS Enrollment Portal

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-113808

A Stored Cross-Site Scripting (XSS) vulnerability exists in the SNS enrollment Portal . An attacker can inject malicious scripts through the captive portal during a user creation request. The vulnerability is triggered specifically when an administrator performs validation of the request. No spec...

EUVD-2026-105253

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator...

Authentication Bypass

github.com/0xjacky/nginx-ui is vulnerable to an authentication bypass. The vulnerability is due to OTP enrollment and passkey registration endpoints failing to require secure session validation and current password verification, which allows an attacker with a stolen JWT to register a malicious...

CVE-2026-112329: Missing Authorization

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy savenewmessage handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting postid to valid post types. Authenticated attackers,...

CVE-2026-111923

Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential...

CVE-2026-111923 Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing

Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential...