DEVVORTEX

DEVVORTEX HackTheBox: Devvortex — Machine Write-Up A comprehensive technical walkthrough detailing the compromise of the Devvortex machine on HackTheBox. This path demonstrates Subdomain Fuzzing , Joomla API Enumeration , Template Modification for initial access, Database Hash Extraction & Cracki...

h-encore

h-encore h-encore , donde h significa hacks y homebrews, es el segundo jailbreak público para la PS Vita™ que es compatible con los firmware más recientes 3.65, 3.67 y 3.68. Te permite realizar modificaciones de kernel y de usuario, cambiar la velocidad del reloj, instalar plugins, ejecutar...

CVE-2026-15598

CVE-2026-15598 Se ha identificado una debilidad en antv layout 2.0.0. Esto afecta a la función setNestedValue en la biblioteca lib/util/object.js. Ejecutar una manipulación del argumento path puede conducir a una modificación indebidamente controlada de los atributos del prototipo del objeto. El...

WordPress Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Content Modification vulnerability discovered by Webbernaut in WordPress Plugin Download Alt Text AI versions = 1.10.41...

CVE-2026-65540

CVE-2026-65540 Popup for CF7 with Sweet Alert Hello document.getElementById'csrf'.submit; 2. Log in to WordPress as an administrator 3. Visit the malicious page 4. Optional Navigate to http://TARGET/wp-admin/admin.php?page=cf7-simplepopup — confirm the Width field now contains...

AZL-105401 CVE-2026-86536 affecting package thrift 0.24.0-1

Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift all JS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue...

CVE-2026-94646

A vulnerability exists in Apache Thrift nodejs bindings prior to version 0.25.0 due to improper input validation and prototype pollution . This condition allows an attacker to modify base JavaScript object properties, causing the application to fail when processing incoming data. A remote attacke...

CVE-2026-103505

A flaw was found in the AWS Elastic File System EFS Container Storage Interface CSI Driver. A remote authenticated user with permissions to create persistent storage volumes can supply crafted comma-separated values within volume configuration attributes. This improper input handling allows the...

Security Bulletin: Multiple vulnerabilities in IBM® SDK Java™ affect IBM Cloud Pak System due to the July 2026 CPU

Summary Multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is...

CVE-2026-86325

A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the accountname parameter when processing account management requests. An attacker authenticated as a read-only user to the...

CVE-2026-15999

The bc-csharp library by Bouncy Castle Inc. is vulnerable to improper validation of integrity check values in its AES-CCM implementation in versions before 2.7.0 . The CcmParameters class accepts arbitrary values for the authentication tag (aes-ICVlen), and CcmBlockCipher only validates this leng...

EUVD-2026-91204

Improper validation of integrity check value in the AES-CCM implementation CcmParameters and CcmBlockCipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to modify CCM-encrypted content without detection via an AlgorithmIdentifier whose CCMParameters declar...

CVE-2026-91023 Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

WordPress Motors plugin < 1.4.124 - Subscriber+ Cross-User Post Meta Modification vulnerability

Subscriber+ Cross-User Post Meta Modification vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Motors versions 1.4.124...

wmiexec-RegOut

⛔ DEPRECATED Active at https://github.com/XiaoliChan/wmiexec-Pro wmiexec-RegOut Modify version of impacket wmiexec.py,wmipersist.py. Got outputdata,response from registry, don't need SMB connection, but I'm in the bad code : Table of content Overview Requirements Usage Cheatsheet Todo References...

Red-Team-Infrastructure-Wiki

Esta wiki está pensada para proporcionar un recurso para configurar una infraestructura de Red Team resiliente. Fue creada para complementar la charla de Steve Borosh @424f424f y Jeff Dimmock @bluscreenofjeff en BSides NoVa 2017, "Doomsday Preppers: Fortifying Your Red Team Infrastructure"...

ApkAnalyser

Copyright C 2012 Sony Mobile Communications AB This file is part of ApkAnalyser. Licensed under the Apache License, Version 2.0 the "License"; you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless...

CVE-2021-21978

CVE-2021-21978 CVE-2021-21978 RCE exp Affected versions VMware View Planner Harness 4.X Similar to CVE-2021-21978, this vulnerability allows uploading arbitrary files without authentication, and achieving remote code execution by modifying the built-in py script. It is worth noting that commands...

CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. id: CVE-2023-43177 info: name: CrushFTP 10.5.1 - Unauthenticated Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: critical description: | CrushFTP prior...

Juniper J-Web - Remote Code Execution

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain environments variables to execute remote commands id: CVE-2023-36845 info: name: Juniper J-Web - Remote Code...