CVE-2019-9193

CVE-2019–9193 - PostgreSQL 9.6.1 원격 코드 실행 인증됨 개념 증명 PostgreSQL 데이터베이스 9.6.1 버전부터는 인증된 원격 코드 실행Authenticated Remote Code Execution에 취약합니다. 개발 팀이 이를 취약점 자체로 간주하지 않더라도, 잘못 구성된 시스템에 접근 권한을 얻는 데 악용될 수 있습니다. 도움말 메뉴 악용 예시 참고 자료 NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-9193 CVE Details:...

LOLBins

LOLBins 用于列出 Windows 上所有“Living Off The Land”二进制文件和脚本（来自 LOLBAS）以及 Unix 上可用于绕过错误配置系统中本地安全限制的二进制文件（来自 GTFOBins）的 PyQT 应用程序。 Windows Linux...

pentest_teamcity

Pentest TeamCity using Metasploit TL;DR: Obtain passwords fromJetBrains IDE like IntelliJ or PyCharm and use those credentials inside TeamCity Continuous Integration Server in order to get meterpreter session on server and build agents using metasploit by Kacper Szurek. JetBrains Comment This is ...

CVE-2025-23419

🔐 مُختبِر استغلال إعادة استخدام جلسة TLS بواسطة XIT $ أداة مبنية على بايثون لاختبار ثغرات إعادة استخدام جلسة TLS المحتملة التي قد تسمح بتجاوز المصادقة على الخوادم غير المهيأة بشكل صحيح. ⚠️ إخلاء مسؤولية هذه الأداة لأغراض التعليم والاختبارات الأمنية المصرّح بها فقط. لا تستخدمها على أنظمة دون إذن...

firebase

firebase Ausnutzung von anfälligen/falsch konfigurierten Firebase Datenbanken Haftungsausschluss: Die bereitgestellte Software dient ausschließlich zu Bildungszwecken. Verwenden Sie sie auf eigenes Risiko, der Ersteller kann nicht für entstandene Schäden verantwortlich gemacht werden. Bitte...

stunner

STUNNER Stunner é uma ferramenta para testar e explorar servidores STUN, TURN e TURN sobre TCP. TURN é um protocolo usado principalmente em videoconferências e chats de áudio WebRTC. Se você encontrar um servidor mal configurado, pode usar esta ferramenta para abrir um proxy socks local que...

GTFOBins.github.io

GTFOBins GTFOBins è un elenco curato di eseguibili Unix-like che possono essere utilizzati per aggirare le restrizioni di sicurezza locali in sistemi malconfigurati. Trova il progetto su: gtfobins.org...

CVE-2017-12617

CVE-2017-12617 CVE-2017-12617 ist eine kritische Schwachstelle, die zu Remote Code Execution RCE in Apache Tomcat führt. Diese Schwachstelle betrifft die Versionen 9.0.0.M1 - 9.0.0, 8.5.0-8.5.22, 8.0.0.RC1 - 8.0.46, 7.0.0 - 7.0.81. Getestet nur auf 8.0.24. Die Schwachstelle nutzt eine...

POC-CVE-2021-42013-EXPLOIT

-ff0055?style=for-the-badge&logo=python root@kitploit: 🔥 CVE-2021-42013 Exploit Framework di Makaveli 💀 Modalità Hacker Cosmico Multidimensionale attivata... Uno strumento avanzato di scansione, sfruttamento e interazione remota progettato per rilevare e sfruttare la vulnerabilità Apache Path...

CVE-2021-36934-HiveNightmare-Lab

CVE-2021-36934 HiveNightmare - Laboratorio Didattico 🎯 Obiettivo Riprodurre e analizzare la vulnerabilità HiveNightmare in un ambiente di laboratorio controllato. 📋 Indice Descrizione della Vulnerabilità Implementazione Dimostrazione Configurazione del Laboratorio e Strumenti Fasi di Sfruttamento...

gtfocli

GTFOcli GTFOcli é uma interface de linha de comando para busca fácil de comandos de binários que podem ser usados para contornar restrições de segurança locais em sistemas mal configurados. Índice Índice Instalação Uso Buscar por binários Unix Buscar por binários Windows Buscar usando solução...

CVE-2025-27558_Patching

CVE-2025-27558Patch Patch per la vulnerabilità CVE-2025-27558 che aveva colpito la mia immagine Linux. Incidente Atlas: Connessione in uscita inaspettata 197.155.77.1 Questa cartella documenta un'anomalia di rete reale rilevata sulla macchina Atlas , un sistema Ubuntu monitorato da Wazuh. Durante...

stunner

STUNNER Stunner is a tool to test and exploit STUN, TURN and TURN over TCP servers. TURN is a protocol mostly used in videoconferencing and audio chats WebRTC. If you find a misconfigured server you can use this tool to open a local socks proxy that relays all traffic via the TURN protocol into t...

gitjacker

gitjacker Gitjacker downloads git repositories and extracts their contents from sites where the .git directory has been mistakenly uploaded. It will still manage to recover a significant portion of a repository even where directory listings are disabled. For educational/penetration testing use...

Reverse-Lookup Service Exposed Millions of Photos of People’s Faces

The people-search tool ClarityCheck says its reverse image search service is “private and secure”—but it left a database containing more than 9 million image files exposed...

CVE-2026-72506

VoiceTra provided by National Institute of Information and Communications Technology NICT contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server or service controlled by an attacker, potentially resulting in the theft of input dat...

EUVD-2026-57716

VoiceTra provided by National Institute of Information and Communications Technology NICT contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server or service controlled by an attacker, potentially resulting in the theft of input dat...

EUVD-2026-54090

Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True...

CVE-2026-65551

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7...

EUVD-2026-53820

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...