evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

CVE-2024-28000

LiteSpeed Cache Privilege Escalation Exp CVE-2024-28000Scan.py Este script primero identificará la versión, determinará si es una versión vulnerable, luego intentará confirmar si existe el archivo de registro. Si existe, intentará enviar paquetes y luego solicitará nuevamente el archivo de regist...

Panoptic

Panoptic Panoptic is an open source penetration testing tool that automates the search and retrieval of common log and config files through path traversal vulnerabilities. Features Async concurrent scanning with configurable worker pool --concurrency Automatic discovery of common log and...

hontel

HonTel HonTel is a Honeypot for Telnet service. Basically, it is a Python v2.x application emulating the service inside the chroot environment. Originally it has been designed to be run inside the Ubuntu/Debian environment, though it could be easily adapted to run inside any Linux environment...

PhishingKitHunter

PhishingKitHunter Find phishing kits which use your brand/organization's files and image. PhishingKitHunter or PKHunter is a tool made for identifying phishing kits URLs used in phishing campains targeting your customers and using some of your own website files as CSS, JS, .... This tool - write ...

CVE-2026-22038

CVE-2026-22038 — AutoGPT Stagehand Blocks Registran Claves API en Texto Plano ID CVE: CVE-2026-22038 Producto: Plataforma AutoGPT integración Stagehand Versiones afectadas: Todas las versiones hasta autogpt-platform-beta-v0.6.45 inclusive Corregido en: autogpt-platform-beta-v0.6.46 Tipo de...

CVE-2023-47529

CVE-2023-47529 Cloud Templates & Patterns collection = 1.2.2 - Exposición de Información Sensible mediante Archivo de Registro Description: The Cloud Templates & Patterns collection plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.2 vi...

CVE-2023-47668

CVE-2023-47668 Descripción Vulnerabilidad de exposición de información sensible a un actor no autorizado en el plugin StellarWP Membership Plugin – Restrict Content en versiones Ejemplo del resultado Log file content: 2024-12-24 20:47:19 - wprcpdiscounts table upgrade to 202003311 successful...

SuiteCRM-RCE

CVE-2020-28328 Ejecución remota de código en SuiteCRM a través de la configuración del sistema de archivos de registro y envenenamiento del archivo de registro Descripción general Recientemente descubrí dos vulnerabilidades en SuiteCRM que proporcionan una cadena de ataque para que un usuario con...

CVE-2022-37969

CVE-2022-37969 Windows Local Privilege Escalation PoC autores: Ricardo Narvaja & Daniel Kazimirow Solid Solo con fines de demostración. El exploit completo funciona en sistemas vulnerables Windows 11 21H2. PoC funcional basado en información previamente publicada por Zscaler Consulte el artículo...

CVE-2020-23968-ILEX-SignGo-EoP

CVE-2020-23968 Ilex International Sign&go Workstation Security Suite 7.1 allows elevation of privileges via a symlink attack on C:\ProgramData\Ilex\S&G\Logs\000-sngWSService1.log...

ketshash

Ketshash A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs. The tool was published as part of the "Pass-The-Hash detection" research - more details on "Pass-The-Hash detection" are in the blog post:...

ColdFusion_EXp

Herramienta de reverse shell para explotar CVE-2023-29298/CVE-2023-26360 Introducción El principio de la vulnerabilidad es que los datos que construimos en la solicitud del cliente CFML se guardan en coldfusion-out.log del servidor. Este directorio registra la información de errores de la...

CVE-2025-27591-Below

CVE-2025-27591-Below 📌 Descripción Este es un exploit prueba de concepto PoC para CVE-2025-27591 , una vulnerabilidad de escalada local de privilegios en la herramienta de monitorización del sistema below. El problema surge de la gestión insegura de los archivos de registro...

MagnusBilling Login Logs - Cross-Site Scripting

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is...

All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path. This makes it possible for unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage...

below-log-race-poc

below-log-race-poc Exploit CVE-2025-27591 Escalada de privilegios de below Descripción Este repositorio contiene una prueba de concepto PoC para CVE-2025-27591 , una vulnerabilidad de escalada de privilegios en la utilidad below. El problema surge porque below maneja incorrectamente los archivos ...

CVE-2026-103371

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

EUVD-2026-94553

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

CVE-2026-103371

Apache Geode versions 2.0.0 through 2.0.3 are affected by a vulnerability where the Management REST API improperly inserts sensitive information into log files. This issue, identified as CWE-532 , could lead to the exposure of confidential data through system logs. To mitigate this risk, users ar...