adapt

Summary ADAPT is a tool that performs Automated Dynamic Application Penetration Testing for web applications. It is designed to increase accuracy, speed, and confidence in penetration testing efforts. ADAPT automatically tests for multiple industry standard OWASP Top 10 vulnerabilities, and outpu...

code-wsl-rce

Proof of Concept per l'Esecuzione Remota di Codice in VS Code Remote WSL - CVE-2021-43907 Vedi il blog su https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-codes-remote-wsl-for-fun-and-negative-profit. Anche https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43907. Compilazione...

xencrypt

Xencrypt PowerShell crypter v 1.0 Authors Xentropy @SamuelAnttila SecForce @SECFORCELTD If you want to read about the design behind this tool and how to make your own crypter, there's an article I wrote about it here: Write a crypter in any language Note Don't be a script kiddie, I made this GPLv...

AdbNet

adb - Uno strumento di sfruttamento per dispositivi Android. Uno strumento che ti permette di cercare dispositivi Android vulnerabili in tutto il mondo e sfruttarli. Caratteristiche root@kitploit: Features: - Post-Exploitation modules to control and tinker with the device you are connected to. -...

CVE-2024-48652

CVE-2024-48652 Cross Site Scripting-Schwachstelle in camaleon-cms v.2.7.5 erlaubt es einem entfernten Angreifer, beliebigen Code über das Feld für den Namen der Inhaltsgruppe auszuführen. Schritte zur Reproduktion: 1. Öffnen Sie die URL: http://127.0.0.1/admin/dashboard 2. Melden Sie sich mit...

CVE-2024-33210

CVE-2024-33210 In Flatpress 1.3 wurde eine Cross-Site-Scripting-Schwachstelle XSS identifiziert. Diese Schwachstelle ermöglicht es einem Angreifer, bösartige Skripte in Webseiten einzuschleusen, die von anderen Benutzern angezeigt werden. Vulnerability Type: Cross Site Scripting XSS Vendor of...

GHSA-GMXC-R82Q-347R libreoffice-convert vulnerable to path traversal / arbitrary file write

Impact options.fileName is used to build a filesystem path path.jointempDir.name, fileName and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content t...

libreoffice-convert vulnerable to path traversal / arbitrary file write

Impact options.fileName is used to build a filesystem path path.jointempDir.name, fileName and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content t...

NPM: libreoffice-convert vulnerable to path traversal / arbitrary file write

NPM: libreoffice-convert vulnerable to path traversal / arbitrary file write vulnerability discovered by ? in WordPress Npm libreoffice-convert versions 1.8.2...

CVE-2026-75889 CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75889

Grafana Alloy's prometheus.operator.servicemonitors component is vulnerable to arbitrary local file disclosure via the bearerTokenFile field. A user with ServiceMonitor write access in a watched namespace can point this field at any file readable by the Alloy process; Alloy then sends the file's ...

EUVD-2026-67162

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

NimbusPWN-CVE-2022-29799-29800

🛡️ NimbusPWN-CVE-2022-29799-29800 – Testen lokaler Privilegienausweitungs-Sicherheitslücken 📖 Über dieses Werkzeug Diese Software hilft Sicherheitsforschern, zwei spezifische Schwachstellen zu untersuchen, die als CVE-2022-29799 und CVE-2022-29800 bekannt sind. Diese Fehler existieren in der...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

EUVD-2026-67161

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54732

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2 , the options.fileName value passed to path.join(tempDir.name, fileName) in index.js is never reduced to a base name. A filename containing ../ allows an attacker to escape the temporary d...

domi-owned

Domi-Owned Resumo Domi-Owned é uma ferramenta usada para comprometer servidores IBM/Lotus Domino. Testado em IBM/Lotus Domino 8.5.2, 8.5.3, 9.0.0 e 9.0.1 rodando em Windows e Linux. Requisitos Domi-Owned usa Python 3, que pode ser instalado através do gerenciador de pacotes da sua distribuição ap...

firmware-analysis-toolkit

Firmware Analysis Toolkit FAT é um kit de ferramentas construído para ajudar pesquisadores de segurança a analisar e identificar vulnerabilidades em firmware de dispositivos IoT e embarcados. Também é usado no treinamento "Offensive IoT Exploitation " conduzido pela Attify. Nota: Atualmente, é...

CVE-2026-81827

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...