MASTG-Hacking-Playground

MASTG Hacking Playground Bienvenido al MASTG Hacking Playground, que forma parte del proyecto OWASP Mobile Application Security MAS. El MASTG Hacking Playground es una colección de aplicaciones móviles educativas para iOS y Android, que han sido creadas intencionadamente con vulnerabilidades para...

pygoat

PyGoat 故意存在漏洞的 Django Web 安全应用程序。 我们的路线图是构建一个基于 django 的故意存在漏洞的 Web 应用程序。漏洞可基于 OWASP Top Ten 目录 pygoat 安装 从源码安装 Docker 容器 安装视频 卸载 解决方案 面向开发者 安装 从源码安装 在本地机器上设置项目： 首先，使用 GitHub 网站或终端中的 git 克隆仓库 root@kitploit: git clone https://github.com/adeyosemanputra/pygoat.git 下载特定分支 git clone -b...

google-ctf

Google CTF Este repositorio contiene la mayoría de los desafíos utilizados en el Google CTF desde 2017, así como la mayor parte de la infraestructura que puede utilizarse para ejecutarlos. IMPORTANTE - El código de las carpetas 201x y 202x contiene vulnerabilidades de seguridad sin corregir. Está...

WebGoat.NET

Webgoat.NET Código fuente: https://github.com/jerryhoff/WebGoat.NET Descargar zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master Esta aplicación web es una plataforma de aprendizaje que intenta enseñar sobre fallos comunes de seguridad web. Contiene fallos de seguridad genéricos que...

WebGoat.NET

Webgoat.NET Código fuente: https://github.com/jerryhoff/WebGoat.NET Descargar zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master Esta aplicación web es una plataforma de aprendizaje que intenta enseñar sobre vulnerabilidades de seguridad web comunes. Contiene fallos de seguridad genéric...

rustproofing-linux

Rustproofing Linux Porting Linux Kernel Bugs to Rust This source code repository is a collection of examples accompanying the blog post at https://research.nccgroup.com/?p=18577. DO NOT USE these examples for anything but following the blog post. They intentionally contain vulnerabilities, and ev...

CVE-2026-0920

Exploit Research: CVE-2026-0920 - Backdoor en LA-Studio Element Kit Análisis técnico y Prueba de Concepto PoC para el backdoor crítico descubierto en LA-Studio Element Kit para Elementor versiones ≤ 1.5.6.3. Esta vulnerabilidad permite la creación de cuentas administrativas sin autenticación...

secbench-dvwa

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Applicati...

CVE-2026-73327

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the reported behavior is intentional. The update process is designed to write files to disk and is restricted to the highest-privilege users working with cryptographically verified Joomla archives...

Human Vulnerability Assessment in Cybersecurity: A Systematic Literature Review of Methods, Models, and Instruments

In cybersecurity, vulnerability assessment has typically focused on identifying and measuring vulnerabilities within digital assets and technical infrastructures. However, there is growing recognition that this approach alone is inadequate without a structured examination of the human factor, whi...

Vulnerable-Flask-Web-App-with-intentional-XSS-SQLi-flaws-

Vulnerable-Flask-Web-App-with-intentional-XSS-SQLi-flaws- A de...

CVE-2024-40457

No-IP Dynamic Update Client DUC v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior...

CVE-2019-1010283

Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss of Confidentiality. The component is: function dataonconnection in src/callback.c. The attack vector is: network connectivity. The fixed...

CVE-2024-51210

Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previously been pasted into the document. NOTE: in several similar products, this is the intentional behavior for anyone who knows the full...

CVE-2024-51210

The Firepad collaborative editor (versions through 1.5.11 ) is vulnerable to Sensitive Information Exposure due to improper access controls. A remote attacker with knowledge of a pad ID can retrieve the current text of a document along with all content previously pasted into it. While this behavi...

CVE-2024-30896

InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and...

CVE-2024-30896

In InfluxDB OSS versions 2.x through 2.7.11 , a business logic flaw allows users with a valid allAccess token to escalate privileges to the operator level. This occurs because allAccess tokens can list all authorizations within the same organization without type restrictions, specifically via the...

How to protect your small business from social engineering

When Alvin Staffin received an email from his boss, he didn't question it. In the email, Gary Bragg, then-president of Pennsylvania law firm O'Neill, Bragg & Staffin, asked Staffin to wire $580,000 to a Bank of China account. Staffin, who was VP and in charge of banking, sent the money through as...

SUSE CVE-2018-18839

An issue was discovered in Netdata 1.10.0. Full Path Disclosure FPD exists via api/v1/alarms. NOTE: the vendor says "is intentional...

SWC-109 Uninitialized Storage Pointer

Lines of code Vulnerability details Impact Uninitialized local storage variables can point to unexpected storage locations in the contract, which can lead to intentional or unintentional vulnerabilities. Proof of Concept OrderStatus storage orderStatus; Tools Used github Recommended Mitigation...