CVE-2026-78255 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media

The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored...

EUVD-2026-64746

The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored...

CVE-2026-78255 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media

The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored...

CVE-2026-78255

The HTTP media server embedded in affected DJI drone models exposes stored photos and videos through the /v2 endpoint without authenticating the requesting client . Because filenames follow a predictable pattern , an attacker who joins the drone's internal network can enumerate valid filenames an...

sdwan-harvester

SD-WAN Harvester 🌐 Framework de Censo da Internet SD-WAN Aviso Legal Este projeto não é mais mantido. Ele é estável e você ainda pode usá-lo para varredura SD-WAN, mas atualmente a maneira mais preferível e precisa de verificar diferentes coisas na internet não apenas soluções SD-WAN é usar nosso...

cc.py

cc.py Extraindo URLs de um alvo específico com base nos resultados de "commoncrawl.org". Atualizado para v.0.3 | Novidades: Processamento 65% mais rápido Especifique um ano via -y/--year, ex.: -y 2018 Especifique um arquivo de saída via -o/--out, ex.: -o whatever.txt Rastreie todas as páginas de ...

appshark

Document Index 1.overview 2.startup 3.how to write rules 4.how to find compliance problems use appshark 5.a path traversal game 6.argument 7.engine config 8.result 9.faq AppShark Appshark is a static taint analysis platform to scan vulnerabilities in an Android app. Prerequisites Appshark require...

pcfg_cracker

PCFG = Probabilistic Context Free Grammar PCFG = Pretty Cool Fuzzy Guesser In short: A collection of tools to perform research into how humans generate passwords. These can be used to crack password hashes, but also create synthetic passwords honeywords, or help develop better password strength...

AddUser-SAMR

AddUser-SAMR Erstellen Sie lokale Administratoren über die SAMR-API, die auf einer niedrigeren Ebene als net.exe, PowerShells New-LocalUser oder die NetUserAdd-API arbeitet. Es erfordert Administratorrechte, und falls der Benutzer bereits existiert, wird er zur Gruppe hinzugefügt, das Passwort wi...

vsftpd-2.3.4---Backdoor-Command-Execution

vsftpd-2.3.4---Backdoor-Command-Execution vsftpd 2.3.4 CVE-2011-2523 eine kritische Schwachstelle, die zu einer Root-Shell führt. In diesem Repository erstelle ich einen PoC, der zeigt, wie man sie Schritt für Schritt ausnutzt – manuell und automatisiert Python – zu Bildungszwecken. Worum geht es...

sast-rules

Semgrep Regeln Dies ist das zentrale Semgrep-Regel-Repository, das die Semgrep-Regeln für den GitLab semgrep analyzer hostet. Das Repository ist wie folgt strukturiert: root@kitploit: . ├── mappings │ ├── findsecbugs.yml │ ├── eslint.yml │ └── ... ├── rules │ ├── lpgl │ │ ├── java │ │ │ ├──...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

FarsightAD

FarsightAD Inhaltsverzeichnis FarsightAD Inhaltsverzeichnis Beschreibung Voraussetzungen Grundlegende Nutzung AD-Hunting-Cmdlets Demo Erkennung vollständig / teilweise verborgener Objekte Danksagungen Dank Autor Lizenz Beschreibung FarsightAD ist ein PowerShell-Skript, das dazu dient, eventuelle...

katana

कटाना 2016 से 2019 के बीच जारी Qualcomm उपकरणों के लिए एक BootROM शोषण।. शोषण का संक्षिप्त विवरण MSM8998 Nazgul SoC के साथ, कमांड 0x13 SAHARARESETSTATEMACHINEID जोड़ा गया था। यह कमांड bootsaharaentry में कॉल करता है, जो Sahara को पुनःआरंभ करने वाला है। दोष यह है कि इसमें प्रत्येक कॉल स्टैक पॉइंटर...

git-dumper

git-dumper A tool to dump a git repository from a website. Install This can be installed easily with pip: root@kitploit: pip install git-dumper Usage root@kitploit: usage: git-dumper options URL DIR Dump a git repository from a website. positional arguments: URL url DIR output directory optional...

r4ven

If you find this GitHub repo useful, please consider giving it a star! ⭐️ ▶️ Watch Video - How To Use! This project is a security research and awareness tool designed to demonstrate how modern web browsers may expose location data, camera access, IP address, and device information when users...

codecrypt

Codecrypt أداة التشفير ما بعد الكمومي. Codecrypt غير مُصانٍ حالياً، على الرغم من أنني ما زلت أستخدمه بنجاح. إذا كنت مهتماً بتطويره/صيانته، تواصل معي. حول هذا برنامج يونكس مشابه لـ GnuPG للتشفير والتوقيع يستخدم فقط خوارزميات مقاومة للحواسيب الكمومية: نظام تشفير McEliece متغير QC-MDPC المضغوط للتشف...

Owasp-top-10-k8s-2025

OWASP Kubernetes Top 10 2025, praktisch Ein Capture-the-Flag , aufbauend auf dem OWASP Kubernetes Top 10 — 2025. Du wurdest angeheuert, um NimbusMart zu red-teamen, ein fiktives E-Commerce-Unternehmen, dessen Cluster schneller wuchs als seine Sicherheit. Zehn Herausforderungen, eine pro...

Z-Jail

Z-Jail حاجز حماية متعدد الطبقات لتنفيذ الأكواد الأصلية على لينكس. سبع طبقات دفاع مستقلة — لا تبعيات خارجية، ملف ثنائي PIE بحجم 73 KiB. root@kitploit: ┌──────────────────────────────────────────────────────┐ │ Z-Jail │ ├──────────────────────────────────────────────────────┤ │ Truthimatics PV...

A week in security (August 17 – August 23)

Last week on Malwarebytes Labs: Zombie Card: An expired Visa credit card can be used for purchases Medical records, SSNs, and bank details exposed in CareCloud data breach ChatGPT for Teens tackles risky chats and homework shortcuts Twitch wants your content for Amazon AI training. Here’s how to...