CVE-2026-52821

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/project and /en/admin/project/create/customer require only the generic createactivity or createproject capability and do not verify edit access to the supplied Project or Customer...

CVE-2026-52826

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/id/rate/rate, /en/admin/customer/id/rate/rate, and /en/admin/activity/id/rate/rate independently resolve the authorized parent identifier and the attacker-selected child rate identifier...

CVE-2026-52823

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/id/stop and GET /api/timesheets/id/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense...

CVE-2026-52819

Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint accepts user and users target identifiers from a caller with viewothertimesheet but does not apply accessuser or verify that a ROLETEAMLEAD requester leads a team containing each target user...

CVE-2026-52820

Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/id and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQueryBuilderForFormType places that identifier in an unconditiona...

bluez

BlueZ - Pila de protocolos Bluetooth para Linux Copyright C 2000-2001 Qualcomm Incorporated Copyright C 2002-2003 Maxim Krasnyansky [email protected] Copyright C 2002-2010 Marcel Holtmann [email protected] Compilación e instalación Para compilar las utilidades de Bluetooth necesitas los...

CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction

CVE-2024-1698 – Inyección SQL en el plugin NotificationX de WordPress Ciega basada en tiempo Inyección SQL ciega basada en tiempo sin autenticación → Extrae el nombre de usuario y el hash de la contraseña de administrador de WordPress. 🧠 Resumen de la vulnerabilidad Las versiones de NotificationX...

Nmap-API

Nmap API 使用 python3.10、Debian、python-Nmap 和 Flask 框架创建一个 Nmap API，可以快速在线进行扫描，并且易于部署。 这是我们大学 PCL 项目的一个实现，该项目仍在开发中并持续更新。 API 参考 获取所有项目 root@kitploit: GET /api/p1/authkey/target GET /api/p2/authkey/target GET /api/p3/authkey/target GET /api/p4/authkey/target GET /api/p5/authkey/target 参数| 类型| 描述...

nili

Nili Nili es una herramienta para escaneo de red, Hombre en el Medio, Ingeniería Inversa de Protocolos y Fuzzing. Requisitos previos Python - Lenguaje de programación Python Scapy - Programa interactivo de manipulación de paquetes Netzob - Ingeniería inversa, modelado y fuzzing de protocolos...

teletunnel

TeleTunnel v2 A Telegram-based remote access tool for Windows. Disclaimer: For authorized use on systems you own only ! Please 🙇 Features Remote administration via a Telegram bot. Secure control only accepts commands from your specified Telegram user ID. The bot have these features: root@kitploit...

santa

Santa Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors for executions & file access, and makes decisions based on the contents of a local database, a GUI agent that notifies the user in case of a block decision, a background service...

fabric8io__kubernetes-client_CVE-2021-4178_5-0-2

Kubernetes & OpenShift Java Client This client provides access to the full Kubernetes & OpenShift REST APIs via a fluent DSL. kubernetes-client: kubernetes-model-core: openshift-client: knative-client: !Maven Centralhttps://img.shields.io/m...

interrogation-game

Interrogation Un juego de interrogatorio detectivesco basado en voz. Eres un detective. Mistral es un sospechoso que miente. Tu trabajo es descubrir la mentira solo mediante preguntas. Cada caso se genera de forma procedural: un crimen de cuello blanco único, un sospechoso, una coartada y una...

Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers

Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data. The first is an automated effort aimed at internet-exposed Vite development servers that's designed to steal cloud credentials, configurations from Amazon Web...

haptyc

Haptyc 测试生成框架 Haptyc 是什么？ Haptyc 是一个 Python 库，旨在为 Turbo Intruder 添加载荷位置支持和狙击手/集束炸弹/攻城锤/草叉攻击类型。虽然 Haptyc 能够很好地实现这些目标，但它也提供了一种更简单的方式来表达常规测试序列。尽管该库是为 Turbo Intruder 设计的，但它并不强依赖 Turbo Intruder，可以在任何需要在 Python 环境中生成测试的地方使用。遗憾的是，由于 Haptyc 是为 jython 解释器构建的，目前仅支持 Python 2.7（不过未来的更新将解决这个问题）。 什么是 Haptyc 标签...

haptyc

Haptyc Test Generation Framework What's Haptyc? Haptyc is a python library which was built to add payload position support and Sniper/Clusterbomb/Batteringram/Pitchfork attack types into Turbo Intruder. While Haptyc accomplishes these goals fairly well it also introduces a simpler way to express...

AWS-Threat-Simulation-and-Detection

使用 Stratus Red Team 进行 AWS 威胁检测 本仓库记录了我使用 Stratus Red Team 进行云环境对手模拟的实践经历。 Stratus Red Team 是“云上的 Atomic Red Team”，能够以细粒度且自包含的方式模拟攻击技术。 我们在 AWS 账户中逐一执行 Stratus Red Team 仓库中涵盖的攻击。为了监控这些攻击，我们将使用 CloudTrail 和 CloudWatch 进行日志记录，并将这些日志导入 SumoLogic 进行进一步分析。 攻击| 描述| 链接 ---|---|---...

Slackor

Slackor 维护于 https://github.com/n00py/Slackor 一个使用Slack作为命令与控制通道的Golang植入程序。 本项目受 Gcat 和 Twittor 启发。 本工具作为概念验证发布。在创建任何Slack应用之前，请务必阅读并理解 Slack App Developer Policy。 设置 注意：服务器使用Python 3编写 要使其工作，您需要： 一个Slack工作区 使用以下权限注册一个应用： channels:read channels:history channels:write files:write:user files:read...

thief_raccoon

Thief Raccoon - Login Phishing Tool Thief Raccoon is a tool designed for educational purposes to demonstrate how phishing attacks can be conducted on various operating systems. This tool is intended to raise awareness about cybersecurity threats and help users understand the importance of securit...

RedHunt-OS

RedHunt Linux 发行版（虚拟机）v2 由 RedHunt Labs 提供的用于对手模拟与威胁狩猎的虚拟机 RedHunt OS 旨在通过集成攻击者的武器库和防御者的工具包，主动识别环境中的威胁，成为您所有威胁模拟和威胁狩猎需求的一站式解决方案。 了解更多关于我们的攻击面管理平台，请查看 NVADR。 基础系统： Lubuntu-18.04 x64 工具安装 攻击模拟： Caldera Atomic Red Team Nmap CrackMapExec Metasploit Responder Zap ADRecon 威胁狩猎： Kolide Fleet...