CVE-2022-1175

CVE-2022-1175 Gitlab Stored XSS, puede configurarse en un issue de un proyecto, ya sea propio o de otro usuario. Permite ataques como crear y robar un Personal Access Token PAT de cualquiera que visite el issue. Los PAT pueden proporcionar acceso completo a la API de Gitlab como ese usuario,...

CVE-2021-28235

Este repositorio no tiene un README...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

CVE-2020-10977

GitLab v12.4.0-12.8.1 RCE Basado enteramente en https://github.com/dotPY-hax/gitlabRCE, que no me funcionó y lo de parsear HTML me parecía engorroso, así que lo reescribí en js. Uso Inicia un manejador de reverse shell de la forma habitual y luego ejecuta este script con: TARGETURI="https://targe...

winDED

winDED Exploit personalizado para CVE-2023-38831 usando python. Introducción: WinRAR es un software de archivado que permite a los usuarios crear archivos comprimidos y versiones comprimidas de archivos y carpetas para que puedan transportarlos fácilmente o almacenarlos con un tamaño reducido...

chromepass

Chromepass - Hacking Chrome Saved Passwords and Cookies View Demo · Report Bug · Request Feature Table of Contents About the Project AV Detection Getting started Prerequisites Installation Usage Email Errors, Bugs and Feature Requests Learn More License Demo About The project Chromepass is a...

CVE-2026-98171

In the Linux kernel, the following vulnerability has been resolved: s...

geacon

Geacon Using Go to implement CobaltStrike's Beacon This project is for learning protocol analysis and reverse engineering only, if someone's rights have been violated, please contact me to remove the project, and the last DO NOT USE IT ILLEGALLY How to play 1. Setup the teamserver and start a htt...

CVE-2015-3636

Este repositorio no tiene un README...

Elite

Obsoleto Temporalmente El proyecto padre Covenant ya no requiere una aplicación de cliente. Elite ha quedado temporalmente obsoleto. Utilice en su lugar la interfaz web incluida con el proyecto Covenant. Es posible que Elite se actualice eventualmente para ponerse al día con el proyecto Covenant...

EUVD-2026-92978

Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed...

CVE-2026-25302 Improper Verification of Cryptographic Signature in Boot

Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed...

CVE-2026-25302

A cryptographic issue exists during the processing of non-ELF partitions , where authentication and signature checks are bypassed. This allows unsigned or corrupted images to be mounted and processed. The vulnerability is associated with Qualcomm hardware/software as indicated by the CVSS source....

WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion

The Grow by Tradedoubler WordPress plugin through version 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files. id: CVE-2024-6460 info:...

Mage AI - Insecure Default Authentication Setup

A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default initialization of resource. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability i...

Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover

The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to chan...

eyoucms v.1.6.5 - Cross-Site Scripting

Cross Site Scripting XSS vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. id: CVE-2024-22927 info: name: eyoucms v.1.6.5 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross Site Scripting XSS...

Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection

The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 Free and = 2.27.4 Premium due to insufficient escaping on the user supplied parameter and lack of sufficient...

ipTIME A2004 - Unauthorized Access

An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication. id: CVE-2024-54763 info: name: ipTIME A2004 - Unauthorized Access author: ritikchaddha severity: medium description: | An access control...