DeviceToolbox

DeviceToolbox – iOS Sidecar Privilege Toolkit Device privileg...

CVE-2026-77161

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-78175

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...

CVE-2026-77161 Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-77161

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to SQL Injection via Parameter Name in all versions up to and including 5.1.24 . The root cause is insufficient escaping on a user-supplied parameter and lack of sufficient preparation of the existing SQL query, allo...

EUVD-2026-76835

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

EUVD-2026-76834

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...

CVE-2026-78175 Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...

CVE-2026-78175

Tutor LMS (WordPress eLearning plugin) is vulnerable to PHP Object Injection in versions up to and including 4.0.7 via the withdraw_method_field parameter of the tutor_save_withdraw_account AJAX handler. The handler relies solely on a nonce without capability checks, and a flaw in how esc_sql() h...

evine

Evine Interactive CLI Web Crawler. Evine is a simple, fast, and interactive web crawler and web scraper written in Golang. Evine is useful for a wide range of purposes such as metadata and data extraction, data mining, reconnaissance and testing. If you like the project, give it a star. It forces...

Mnemosyne

Mnemosyne 我的个人信息安全备忘录 趣闻 这个项目名称来源于希腊的记忆女神：Mnemosyne 。 另外，值得注意的是，这个词正是英文单词 memory 的词源。 用法 Mnemosyne 在我网站的同名子域名下公开可用。该站点通过 GitLab Pages 托管。你可以通过此链接访问。 在本地运行网站 要运行本网站，首先需要安装 Hugo。 然后，克隆我的仓库： root@kitploit: git clone https://gitlab.com/A1CY0N/mnemosyne.git 并用 Hugo 运行网站： root@kitploit: cd mnemosyne hu...

DSP

DockerSecurityPlayground Docker Security Playground 是一款应用程序，允许您： 创建网络和网络安全场景 ，以便通过在自己的 PC 上安装 DSP 来理解网络协议、规则和安全问题。 通过模拟漏洞实验室场景学习渗透测试技术 管理一组 docker-compose 项目 。DSP 的主要目标是学习渗透测试和网络安全，但其灵活性允许您创建 、图形编辑 和管理运行/停止 所有的docker-compose 实验室 。 安装 推荐的 DSP 安装工作流程是使用 Kali 虚拟机： 安装 docker 和 docker-compose 安装最新的稳定版...

CVE-2022-32548-RCE-POC

CVE-2022-32548-RCE-POC DrayTek unauthenticated remote code execution vulnerability CVE-2022-32548 in /cgi-bin/wlogin.cgi via username field Technical details The web management interface of the vulnerable DrayTek devices is affected by a buffer overflow on the login page at /cgi-bin/wlogin.cgi. A...

festin

FestIN the powered S3 bucket finder and content discover What is FestIn Why Festin Install Using Python Using Docker Full options Usage Configure search domains Concurrency HTTP Crawling configuration Manage results Proxy usage DNS Options Full Text Support Running as a service or watching mode...

Windows-Privilege-Escalation-Notes

Windows Privilege Escalation Preferable room is https://tryhackme.com/room/windows10privesc, but u can use anything of your choice. Some resources, https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/...

CVE-2024-6387-Vulnerability-Checker

Comprobador de Vulnerabilidad CVE-2024-6387 Descripción general Este script de Python está diseñado para verificar servidores SSH en busca de la vulnerabilidad CVE-2024-6387, apuntando específicamente al recientemente descubierto regreSSHion , que está asociado con versiones específicas de OpenSS...

rust_syscalls

RUSTSYSCALLS Stub único para syscalls directas e indirectas con resolución de SSN en tiempo de ejecución para Windows. Características: Una sola línea para todas tus syscalls Hash del nombre de la función en tiempo de compilación Syscalls directas o indirectas Soporte nativo para x8664, WOW64 y x...

CVE-2026-81429

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via...

M474

🛰️ M474 — 网络隐私增强器 M474 是一款开源网络隐私与MAC随机化工具 ，旨在提升你的在线匿名性。 它提供： MAC地址欺骗（Linux） IP地址续约（Linux + Windows） 网络接口自动检测 带备份的安全还原功能 无损坏的供应商解析，无临时文件 完全跨平台安全执行 本工具仅供概念验证和教育目的使用。 !IMPORTANT 滥用MAC地址欺骗可能中断网络连接。 请负责地运行，并仅在你控制的系统上使用。 ✨ 功能特性 🟢 Linux（完全支持） MAC地址欺骗 随机生成本地管理的有效MAC MAC还原功能 从安全备份中自动恢复原始MAC 自动接口检测 支持...

domain_generation_algorithms

Algoritmos de Generación de Dominios Algoritmos de Generación de Dominios DGAs de malware reimplementados en Python. Resumen banjori también conocido como MultiBanker 2, BankPatcher Enlaces http://johannesbader.ch/2015/02/the-dga-of-banjori/ Dominios de ejemplo earnestnessbiophysicalohax.com...