CVE-2025-6970

CVE-2025-6970 Events Manager = 7.0.3 - 認証されていないSQLインジェクション via orderby パラメータ 説明 WordPress用プラグイン「Events Manager – Calendar, Bookings, Tickets, and...

dp_crypto

dpcrypto Base64ベースの暗号化オラクルエクスプロイト（CVE-2017-9248、Telerik UI for ASP.NET AJAX ダイアログハンドラ対象） exploit-db に掲載 2020年更新 - exploit-db上のバージョンは、こちらのGitHub上の最新バージョンと比較してかなり古くなっていますのでご注意ください。 https://www.exploit-db.com/exploits/43873/ 関連情報 もう一つのTelerik...

Sudomy

Sudomy Subdomain Enumeration & Analysis Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing advanced automated reconnaissance framework. This tool can also be used for OSINT Open-source intelligence activities. Features ! For recent time, Sudomy has these...

CVE-2026-33017-Exploit

CVE-2026-33017 - Langflow Unauthenticated RCE root@kitploit: / \ | | \ ^ / ||||| exec with no auth, no sandbox, no hope. Langflow chat.py - startflowbuild - buildgraphfromdata - Graph.frompayload - loading.py - eval.py createclass - validate.py prepareglobalscope - execcompiledcode - arbitrary co...

CVE-2021-3156-Heap-Based-Buffer-Overflow-in-Sudo-Baron-Samedit-

Qualys セキュリティアドバイザリ Baron Samedit: Sudo におけるヒープベースのバッファオーバーフロー CVE-2021-3156 ======================================================================== 目次 概要 分析 悪用 謝辞 タイムライン ======================================================================== 概要 私たちは Sudo にヒープベースのバッファオーバーフローを発見しました...

access_updated

Singular Access 基于btbd/access 的更新分支，使用 Zydis 进行动态模式查找，以兼容 Windows 10/11 一个内核态系统调用封装器，无需句柄即可执行特权进程操作。通过 xKdEnumerateDebuggingDevices 指针挂钩实现内核与用户态通信。 功能特性 ✅ 无硬编码偏移 - 所有内核函数/偏移均在运行时通过 Zydis 反汇编器动态发现 ✅ 版本无关 - 适用于 Windows 10 1607+ 和 Windows 11（最高 24H2） ✅ 无 SEH - 无结构化异常处理的安全操作 ✅ 无需句柄 - 无需创建真实句柄即可执行...

ARTIF

ARTIF ARTIF is a new advanced real time threat intelligence framework built that adds another abstraction layer on the top of MISP to identify threats and malicious web traffic on the basis of IP reputation and historical data. It also performs automatic enrichment and threat scoring by collectin...

pict

PICT - Post-Infection Collection Toolkit This set of scripts is designed to collect a variety of data from an endpoint thought to be infected, to facilitate the incident response process. This data should not be considered to be a full forensic data collection, but does capture a lot of useful...

NPM: Orval: Import-time RCE via query-parameter default -> zod module-level template literal

NPM: Orval: Import-time RCE via query-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Summary Orval's zod schema generation emits the query-parameter default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

EUVD-2026-62600

Orval: Import-time RCE via query-parameter default - zod module-level template literal...

GHSA-P4CG-3328-RVFG Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Summary Orval's zod schema generation emits the query-parameter default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

android-hardware-attestation-demo

Android 硬件认证绕过 — 演示 本仓库是 Quarkslab 文章 的配套代码，该文章介绍 Android 硬件密钥认证（hardware Key Attestation），本仓库用于对其进行说明。 这是一个小型的端到端概念验证（proof of concept），展示了一种简单的绕过方式：已 root 手机上的分析人员通过将认证中继 到第二台干净设备，从而绕过后端的硬件认证检查。整个过程没有任何伪造。由未经修改的设备生成、且绑定到后端自身 nonce 的真实认证链，会被转发以替代已 root 设备被拒绝的认证链。 适用范围与伦理。 这是面向安全研究的教育材料。它使用明文...

BIT-MYSQL-CLIENT-2026-55855 MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,...

log4j-detect

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability CVE-2021-44228 for a list of URL with multithreading The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228. To do so, it sends a G...

CVE-2025-60787

CVE-2025-60787 CVE-2025-60787 Poc - RCE - MotionEye = 0.43.1b4 Enlace original: https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter MotionEye RCE mediante omisión de validación del lado del cliente Resumen Durante las pruebas de seguridad de una instancia de MotionEye...

CVE-2022-30040

Tenda AX1803 v1.0.0.12890 サービス拒否脆弱性 概要 メーカーのウェブサイト情報: https://www.tenda.com.cn/profile/contact.html ファームウェアダウンロードアドレス: https://www.tenda.com.cn/download/default.html 脆弱性の説明 脆弱性は rootfs In / goform / setsystimecfg of / bin / tdhttpd in ubif file system にあります。攻撃者は http://ip/goform/SetSysTimeCfg...

GHSA-X5FP-WJ9C-MXMX qs array-limit bypass via bracket-key comma parsing

Summary qs v6.15.3 allows bracket-key input to bypass arrayLimit and throwOnLimitExceeded when comma: true. The input a=1,2,3,4 succeeds with arrayLimit: 3, while the equivalent plain-key input is rejected. Affected version tested: text qs v6.15.3 commit 18d085e919dae70c8f1b200ab99323058edab2c2...

qs array-limit bypass via bracket-key comma parsing

Summary qs v6.15.3 allows bracket-key input to bypass arrayLimit and throwOnLimitExceeded when comma: true. The input a=1,2,3,4 succeeds with arrayLimit: 3, while the equivalent plain-key input is rejected. Affected version tested: text qs v6.15.3 commit 18d085e919dae70c8f1b200ab99323058edab2c2...

BIT-MARIADB-MIN-2026-55855 MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,...