CVE-2026-19715

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

EUVD-2026-66876

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

Doozer

Doozer Doozer è uno strumento automatizzato ed estendibile per il cracking degli hash, utilizzato per automatizzare il parsing, il cracking e l'organizzazione degli hash delle password. Attualmente, Doozer supporta gli hash nt/lm, ntlmv1 e ntlmv2 da Responder o SAM, ma dispone di un'architettura...

hexalocker-analysis

HexaLocker-Ransomware-Analyse Dieses Repository enthält Ressourcen im Zusammenhang mit der Analyse von HexaLocker, die in diesem Blogbeitrag verfügbar ist: https://www.synacktiv.com/publications/lapsus-is-dead-long-live-hexalocker.html. eine YARA-Regel zur Erkennung weiterer HexaLocker-Samples...

PT-2026-82392

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

silph

SILPH: Coletor Furtivo de Senhas Locais em Memória SILPH é uma ferramenta de red team de código aberto projetada para despejar segredos LSA, hashes SAM e credenciais DCC2 inteiramente em memória, sem gravar nenhum arquivo em disco. Diferentemente do projeto upstream go-secdump , o SILPH é criado...

HashTag

이름: HashTag: 비밀번호 해시 분석 및 식별 버전: 0.41 날짜: 11/05/2013 저자: Smeege 연락처: [email protected] 설명: HashTag.py는 비밀번호 해시를 분석하고 식별하기 위해 작성된 파이썬 스크립트입니다. 세 가지 주요 인수가 있습니다: 단일 해시 유형 식별-sh, 파일에서 여러 해시 분석 및 식별-f, 하위 디렉터리를 탐색하여 해시가 포함된 파일을 찾아 분석/식별-d입니다. 많은 일반적인 해시 유형이 CPU 및 GPU 크래킹 도구 Hashcat에서 지원됩니다. 추가...

CVE-2024-24919

Check point:CVE-2024-24919 CVE ausführen root@kitploit: nuclei -list chick.txt -t CVE-2024-24919.yaml Ersetzen Sie durch die Ziel-IP-Adresse. Dieser Befehl versucht, auf die Datei /etc/shadow zuzugreifen, die Passwort-Hashes enthält. root@kitploit: curl --path-as-is -i -s -k -X POST \ -H 'Host:...

go-secdump

go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...

go-secdump

go-secdump Descrizione Il pacchetto go-secdump è uno strumento progettato per estrarre da remoto gli hash dal registro SAM, nonché i segreti LSA e gli hash memorizzati nella cache dell'hive SECURITY, senza alcun agente remoto e senza toccare il disco. Lo strumento si basa sulla libreria go-smb e ...

DPAT

Domain Password Audit Tool DPAT DPAT è uno strumento di sicurezza basato su Python che analizza gli hash delle password estratti dai controller di dominio Active Directory. Genera report HTML completi che mostrano statistiche sull'uso delle password, violazioni delle policy e approfondimenti sull...

CVE-2022-22972-

CVE-2022-22972-IOC-Liste IP-ADRESSEN • 23.36.163.250 • 64.32.6.143 • 217.175.49.100 HASHES • 6f17c8af555321cca16fe1695cc420eb9079fd187b8fa71d840f3cfd1f796117 • 040db8eacbd482c12ba03ab1a7c738be • 97ac734b671c815c43ea3287732046d2177e5bdad63e12315acc4902b8baa04d •...

penglab

Penglab Abuse of Google Colab for fun and profit. 🐧 What is it ? Penglab is a ready-to-install setup on Google Colab for cracking hashes with an incredible power, really useful for CTFs. See benchmarks below. It installs by default : Hashcat John Hydra SSH with ngrok And now, it can also : Launch...

CVE-2026-77127 Information Disclosure in extension "Modules" (modules)

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...

CVE-2026-77127

CVE-2026-77127 affects the TYPO3 extension "Modules" (modules) . The extension's backend AJAX endpoint for inline editing fails to restrict access to fields the current user is permitted to see or edit. An authenticated, low-privileged TYPO3 backend user can supply arbitrary table, field, and rec...

Palo Alto Expedition - SQL Injection

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expeditio...

terrier

Terrier Terrier is a Image and Container analysis tool that can be used to scan OCI images and Containers to identify and verify the presence of specific files according to their hashes. A detailed writeup of Terrier can be found on the Heroku blog,...

Astra Linux – Vulnerability in Firefox

Because Firefox did not implement the unsafe-hashes CSP directive, an attacker who was able to inject markup into a page otherwise protected by a Content Security Policy might have been able to inject executable scripts. This would be severely restricted by the specified Content Security Policy o...

Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in the ‘deref’ plugin of 389-ds-base, where it could use the ‘search’ permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes...