EUVD-2026-92047

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125 LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125

LaraDashboard versions prior to 1.4.8 are vulnerable to a path traversal vulnerability within the /api/translations/{lang} endpoint. This flaw allows unauthenticated attackers to read sensitive JSON files, such as composer.json, by manipulating the {lang} route segment. Specifically, on Windows h...

Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat...

CVE-2026-105122

OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwksuri. Attackers can trigger unauthenticated fetches through client-authentication and ID-token...

udpx

Fast and lightweight, UDPX is a single-packet UDP scanner written in Go that supports the discovery of over 45 services with the ability to add custom ones. It is easy to use and portable, and can be run on Linux, Mac OS, and Windows. Unlike internet-wide scanners like zgrab2 and zmap, UDPX is...

mapcidr

A utility program to perform multiple operations for a given subnet/CIDR range. Features • Install • Usage • Library • Join Discord mapCIDR is developed to ease load distribution for mass scanning operations; it can be used both as a library and as an independent CLI tool. Features CIDR expansion...

ssh-auditor

SSH Auditor Features ssh-auditor will automatically: Re-check all known hosts as new credentials are added. It will only check the new credentials. Queue a full credential scan on any new host discovered. Queue a full credential scan on any known host whose ssh version or key fingerprint changes...

ssh-auditor

SSH Auditor Fonctionnalités ssh-auditor effectuera automatiquement : Revérifier tous les hôtes connus lorsque de nouveaux identifiants sont ajoutés. Il ne vérifiera que les nouveaux identifiants. Mettre en file d'attente un scan complet des identifiants sur tout nouvel hôte découvert. Mettre en...

zabbix-threat-control

Zabbix Threat Control ztc Transformez le Zabbix que vous exécutez déjà en console de gestion des vulnérabilités. ztc lit l'inventaire logiciel de chaque hôte via le zabbix-agent2 standard aucun agent supplémentaire à déployer, l'audite auprès de Vulners, et renvoie dans Zabbix des résultats notés...

morpheus

Morpheus - automated ettercap TCP/IP Hijacking tool Version release: v2.2 - STABLE Author: pedro ubuntu r00t-3xp10it Codename: oneiroi phobetor The mithologic dream greek god Distros Supported: Linux Ubuntu, Kali, Debian, BackBox, Parrot OS Suspicious-Shell-Activity© SSA RedTeam develop @2018 LEG...

tengu

Tengu — Serveur MCP de Pentesting "Dans la mythologie japonaise, le Tengu est un esprit féroce de la montagne — maître stratège, guerrier et formateur de samouraïs. En cybersécurité, il vous guide à travers chaque phase de la chasse." Du repérage au rapport — pentesting assisté par IA en une...

zerobox

SDK Python de Zerobox SDK Python pour zerobox. Permet de mettre en sandbox n'importe quelle commande avec des contrôles sur les fichiers, le réseau et les identifiants. pip install zerobox L'installation de la wheel dépose la CLI zerobox dans le bin/ de votre environnement et expose un SDK Python...

CVE-2026-45504

CVE-2026-45504 Lecture de fichier Exchange CVE-2026-45504 Exchange File Read Blog de recherche python3 CVE-2026-45504.py --attacker-ip 192.168.2.238 --attacker-port 9020 --creds [email protected] --password Hawktrace1 --target https://mail.exchange.local --target-file...

second-order

Second Order Scans web applications for second-order subdomain takeover by crawling the app, and collecting URLs and other data that match certain rules, or respond in a certain way. Installation From binary Download a prebuilt binary from the releases page and unzip it. From source Go version 1....

CVE-2019-7214

Exploitation de Shell Inversé Windows PowerShell sur TCP Ce script Python cible un service vulnérable exécuté sur une machine Windows distante. Il envoie une charge utile .NET sérialisée qui déclenche un shell inversé basé sur PowerShell vers la machine de l'attaquant. CVE-2019-7214 Exécution de...

singularity

Singularity of Origin Recent updates: NEW 2025-11-25 : Chrome release 142 added Local Network Access LNA, which prevents DNS rebinding attack techniques implemented in Singularity. Singularity of Origin's LNA-from-Non-Secure-Contexts branch implements support for Trial for Local Network Access fr...

mzap

mzap mzap est un CLI Crystal pour le scan multi-cibles ZAP. Il distribue les cibles sur un ou plusieurs hôtes ZAP API, supporte un mode d'attente optionnel et peut exporter des rapports. Fonctionnalités Commandes de scan : spider, ajaxspider, clientspider ZAP 2.16+, ascan, pscan Import de...

mzap

mzap mzap is a Crystal CLI for multi-target ZAP scanning. It dispatches targets across one or more ZAP API hosts, supports optional wait mode, and can export reports. Features Scan commands: spider, ajaxspider, clientspider ZAP 2.16+, ascan, pscan API definition import for openapi, soap, graphql,...