CVE-2026-105302

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-13607

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-105306

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

CVE-2026-78371

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

CVE-2026-105306 Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

CVE-2026-105306

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

CVE-2026-105302 Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105302

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

URLextractor

URLextractor Recopilación de información y reconocimiento de sitios web Uso: ./extractor http://www.hackthissite.org/ Consejos: Colorex: añade colores a la salida pip install colorex y úsalo como ./extractor http://www.hackthissite.org/ | colorex -g "INFO" -r "ALERT" Tldextract: es usado por la...

pentesting-multitool

Pentesting-Multitool Introducción El proyecto Pentesting-Multitool surge de la necesidad de reunir algunas herramientas de pentesting en una sola. Se desarrollará usando Python3, agregando algunas librerías externas como DNSPython, pythonwhois o scapy. Las funciones principales del script son...

steganographer

Steganography in Python This script will hide files inside images and save the modified image to disk The maximum size of file which can be hidden inside an image depends on the dimension of the image. maxfilesize = heightofimage widthofimage 6 / 8 bytes '100k words.txt' is hidden in...

Eaton-Intelligent-Power-Manager-Local-File-Inclusion

Eaton-Intelligent-Power-Manager-Local-File-Inclusion Inclusión de archivo local en Eaton Intelligent Power Manager v1.6 permite a un atacante incluir un archivo, lo que puede provocar divulgación de información sensible, denegación de servicio y ejecución de código. CVE-2018-12031 Para explotar l...

CVE-2023-28432

CVE-2023-28432 MiniO verify interface sensitive information disclosure vulnerability CVE-2023-28432 Chinese name: MinIO verify 接口敏感信息泄露漏洞（CVE-2023-28432） Description : MinIO is an open source object storage service that is compatible with the Amazon S3 API and can be used in private or public...

CVE-2024-39719

Ollama File Existence Disclosure Vulnerability CVE-2024-39719 Analysis 中文 Vulnerability Overview CVE-2024-39719 is a file existence disclosure vulnerability affecting Ollama versions 0.3.14 and earlier. This vulnerability allows attackers to detect the existence of specific files on the server...

CVE-2021-41822

CVE-2021-41822 uno de agua Vulnerabilidad de acceso no autorizado y denegación de servicio en impresoras Canon El atacante no necesita una cuenta ni contraseña para acceder a la página de la impresora y obtener información sobre los archivos impresos. Además, la impresora puede apagarse de forma...

CVE-2022-24483

CVE-2022-24483 POC For CVE-2022-24483 An Information disclosure bug in the "nt!PfpPrivSourceEnum" function. Reliability: High...

ldapdomaindump

LDAPDomainDump Active Directory information dumper via LDAP Introduction In an Active Directory domain, a lot of interesting information can be retrieved via LDAP by any authenticated user or machine. This makes LDAP an interesting protocol for gathering information in the recon phase of a pentes...

ldapdomaindump

LDAPDomainDump Volcador de información de Active Directory a través de LDAP Introducción En un dominio de Active Directory, cualquier usuario autenticado o máquina puede recuperar mucha información interesante a través de LDAP. Esto convierte a LDAP en un protocolo interesante para recopilar...

cpufetch

Herramienta simple pero elegante para obtener información de la CPU cpufetch es una herramienta de línea de comandos escrita en C que muestra la información de la CPU de forma limpia y hermosa Índice de contenidos 1. Soporte 2. Instalación 2.1 Instalación desde un paquete 2.2 Compilación desde el...

Microsoft-Edge-Information-Disclosure

Microsoft-Edge-Information-Disclosure CVE-2024-30056 Microsoft Edge Chromium-based Vulnerabilidad de Divulgación de Información Esta es una vulnerabilidad en Microsoft Edge Chromium-based. El atacante pudo engañar al usuario para que revelara información sensible sin su conocimiento. Poc: PoC...