PT-2026-85221

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract...

Android-PIN-Bruteforce

🔓📱 Android-PIN-Bruteforce Разблокируйте Android-телефон или устройство с помощью брутфорса PIN-кода экрана блокировки. Превратите ваш телефон Kali Nethunter в инструмент для брутфорса PIN-кодов Android-устройств! 📱 Как это работает Для подключения заблокированного телефона к устройству Nethunter...

OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

Summary OpenChoreo Workflow Plane templates were vulnerable to OS command injection because some developer-controlled workflow parameters were interpolated directly into shell program text executed through sh -c. An authenticated user with permission to configure and trigger an affected workflow...

GHSA-2MW5-23GM-PCCQ OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

Summary OpenChoreo Workflow Plane templates were vulnerable to OS command injection because some developer-controlled workflow parameters were interpolated directly into shell program text executed through sh -c. An authenticated user with permission to configure and trigger an affected workflow...

diario-commandline-tools

diario-commandline-client これは何ですか？ 前提条件 インストール プロジェクトのセットアップ 使用方法 これは何ですか？ 一括 diario API 消費を容易にするために作成されたユーティリティリポジトリです。現在、以下の機能が完全に実装されています。 ファイル（PDF または Microsoft Office ドキュメント）のアップロード ファイルの完全なディレクトリのアップロード 単一ハッシュのクエリ ハッシュのリストのクエリ（単一ファイルから） DIARIO アカウントを取得するには [email protected] にメールを送信してくだ...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...

GHSA-52GF-6RPQ-FGMX OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...

inquisitor

Inquisitor Notice This project is only partially complete and I have yet to implement many of the features described in the following blog post I made: https://penafieljlm.com/2017/07/14/inquisitor/. Inquisitor is a simple tool for gathering information on companies and organizations through the...

inquisitor

Inquisitor Уведомление Этот проект завершён лишь частично, и многие функции, описанные в следующей статье моего блога, ещё предстоит реализовать: https://penafieljlm.com/2017/07/14/inquisitor/. Inquisitor — это простой инструмент для сбора информации о компаниях и организациях с использованием...

antispy

AntiSpy English | 简体中文 A powerful anti rootkit toolkit AntiSpy is a free but powerful anti virus and rootkits toolkit. It offers you the ability with the highest privileges that can detect,analyze and restore various kernel modifications and hooks. With its assistance,you can easily spot and...

filtron

Filtron Reverse HTTP proxy to filter requests by different rules. Can be used between production webserver and the application server to prevent abuse of the application backend. The original purpose of this program was to defend searx, but it can be used to guard any web application. Installatio...

noPac

Описание Эксплуатация CVE-2021-42278 и CVE-2021-42287 для выдачи себя за DA от обычного пользователя домена. Изменено с sam-the-admin. Использование root@kitploit: SAM THE ADMIN CVE-2021-42278 + CVE-2021-42287 chain positional arguments: domain/username:password Account used to authenticate to DC...

wordpress-cve-2024-10924-pentest

WordPress CVE-2024-10924 침투 테스트 보고서 Really Simple SSL 플러그인의 2FA 우회 취약점 📋 목차 요약 보고서 대상 정보 방법론 일정 정찰 단계 취약점 분석 공격 흐름 익스플로잇 영향 평가 조치 사용 도구 참고 자료 부록 🎯 요약 보고서 대상: https://skior.co 취약점: CVE-2024-10924 - Really Simple SSL 플러그인의 2FA 우회 심각도: 심각 CVSS 점수: 9.8 상태: 성공적으로 익스플로잇됨 발견 날짜: 2025-06-25 보고서 버전: 2.1 이...

CVE-2019-9053

Fixed it bcz of https://tryhackme.com/room/easyctf : enjoy 수정되었습니다. https://tryhackme.com/room/easyctf 덕분입니다 : 즐기세요. Critical Issues Fixed 주요 수정 사항 1. Python 2 to Python 3 Compatibility 2. Python 2에서 Python 3 호환성 Old: print "string" New: print"string" Changed all print statements to print functio...

spraygen

Spraygen Генератор списков паролей для password spraying — с готовыми настройками Версия 1.7 Генерирует перестановки месяцев, времён года, годов, спортивных команд NFL, NBA, MLB, NHL, спортивных результатов, «Password» и даже итерационных keyspace заданного размера. Все перестановки создаются с...

wesng

Windows Exploit Suggester - Next Generation WES-NG WES-NG is a tool based on the output of Windows' systeminfo utility which provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities. Every Windows OS between Windows XP and Windows 11, includin...

CVE-2023-24055_PoC

CVE-2023-24055 PoC KeePass 2.5x 議論・分析中... https://sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b/ https://sourceforge.net/p/keepass/feature-requests/2773/ KeePass 設定ファイルへの書き込みアクセス権を持つ攻撃者は、そのファイルを改ざんし、悪意のあるトリガーを注入できます。例えば、エクスポート用トリガーを追加して平文パスワードを取得するなどです。...

ghostlock — Updated!

GhostLock — Linux kernel rtmutex/futex stack-UAF tracking site Source for the GhostLock patch-status tracker: a single-page site recording which distributions have shipped a fix for the rtmutex/futex stack use-after-free in the Linux kernel. Tracking concluded 2026-08-06 : every tracked kernel...

aDLL

aDLL - 동적 링크 라이브러리의 모험 aDLL은 DLL 하이재킹 취약점을 자동으로 발견하는 데 중점을 둔 바이너리 분석 도구입니다. 이 도구는 메모리에 로드된 바이너리 이미지를 분석하여 로드 시점에 로드된 DLL을 검색하고, Microsoft Detours 라이브러리를 사용하여 LoadLibrary/LoadLibraryEx 함수 호출을 가로채서 런타임에 로드된 DLL을 분석합니다. 목적은 실행 파일이 DLL을 검색하는 폴더에서 찾을 수 없는 DLL 목록을 얻는 것입니다. 시작하기 aDLL을 사용하려면 Binaries 폴더에...