CVE-2026-0920-

CVE-2026-0920- LA-Studio Element Kit for Elementor 📡 漏洞利用代码最先在此发布。 在 Telegram 上关注 @KNxploited —— 获取最新披露 CVE、可用 PoC 与精准安全研究的顶尖资讯。持续更新，专为领先者打造。 🧠 概述 CVE-2026-0920 是在 LA-Studio Element Kit for Elementor WordPress 插件中发现的一个 CVSS 9.8 严重级别 漏洞。 该缺陷位于 ajaxregisterhandle 函数中，该函数通过 AJAX 处理未经认证的用户注册流程。该函数未对...

awesome-web-security

Awesome Web Security - JP 🐶 Curated list of Web Security materials and resources. Needless to say, most websites suffer from various types of bugs which may eventually lead to vulnerabilities. Why would this happen so often? There can be many factors involved including misconfiguration, shortage ...

frida

Frida Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Learn more at frida.re. Two ways to install 1. Install from prebuilt binaries This is the recommended way to get started. All you need to do is: pip install frida-tools CLI tools pip install frida...

ncrack

ncrack Ncrack is a high-speed network authentication cracking tool. It was built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords. Security professionals also rely on Ncrack when auditing their clients. Ncrack was designed...

WhatWeb

WhatWeb - 次世代ウェブスキャナー 開発者: Andrew Horton urbanadventurer & Brendan Coles bcoles 最新リリース: v0.6.4. 2026年4月3日 ライセンス: GPLv2 本製品は、ライセンス契約に記載された条件に従うものとします。WhatWebの詳細については、https://github.com/urbanadventurer/ をご覧ください。 Wiki: https://github.com/urbanadventurer/WhatWeb/wiki/...

Empire

Empire Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

CVE-2026-57742

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2...

EXPLOIT-CVE-2026-26216

CVE-2026-26216 — 通过 hooks 实现 Crawl4AI 未认证 RCE（GHSA-5882-5rx9-xgxp） CVSS 10.0 · 未认证 RCE · CWE-94（代码注入） 在 Crawl4AI （ 字段中的任意 Python 代码 。该代码在一个“自制沙箱”——一个受限的 builtins 字典——中通过 exec 执行。只不过 import 被留在了允许列表（allowlist）中，从而可以调用 import'os'.system...，彻底击溃整个沙箱。 POST /crawl "urls": "https://example.com", "hooks...

cve-2025-55182-scanner

CVE-2025-55182 / CVE-2025-66478 脆弱性スキャナー React Server Components Flight Protocol リモートコード実行検出ツール エグゼクティブサマリー このスキャナーは、React Server Components RSC "Flight" プロトコルにおける重大な認証なしリモートコード実行脆弱性である CVE-2025-55182 React および CVE-2025-66478 Next.js に対して潜在的に脆弱なシステムを特定します。 主なリスク要因: CVSS 10.0 - 最大深刻度 認証不要 - ログイン不要...

CVE-2025-34299

CVE-2025-34299 Monsta FTP 2.11 及更早版本存在一个漏洞，允许未经身份验证的任意文件上传。此缺陷使得攻击者能够通过从恶意 SFTP 服务器上传特制文件来执行任意代码。 此检测方法如何工作？ 此检测模板通过向目标 URL 发送 GET 请求，检查响应是否包含 Monsta FTP 且状态码为 200，使用正则表达式从 title 标签中提取版本号，然后将其与 2.11 版本进行比较，以识别存在漏洞的实例。 如何运行此脚本？ 1. 下载并安装 Nuclei。 2. 将此仓库克隆到本地系统。 3. 运行以下命令： nuclei -u -t template.yaml...

kubebox

= Kubebox small^⎈❏^ Antonin Stefanutti https://github.com/astefanutti@astefanutti // Meta :description: Terminal and Web console for Kubernetes // Settings :idprefix: :idseparator: - :experimental: // Aliases ifdef::env-github :note-caption: ℹ️ :icon-check: ✔️ :icon-edit: ✏️ endif::...

gef

GEF pronounced ʤɛf - "Jeff" is a set of commands for x86/64, ARM, MIPS, PowerPC and SPARC to assist exploit developers and reverse-engineers when using old school GDB. It provides additional features to GDB using the Python API to assist during the process of dynamic analysis and exploit...

nikto

nikto Nikto web server scanner - https://cirt.net/Nikto2 Full documentation - https://github.com/sullo/nikto/wiki Run normally: git clone https://github.com/sullo/nikto Main script is in program/ cd nikto/program Run using the shebang interpreter ./nikto.pl -h http://www.example.com Run using per...

nikto

nikto Niktoウェブサーバースキャナー - https://cirt.net/Nikto2 完全なドキュメント - https://github.com/sullo/nikto/wiki 通常の実行: git clone https://github.com/sullo/nikto Main script is in program/ cd nikto/program Run using the shebang interpreter ./nikto.pl -h http://www.example.com Run using perl if you forget to chmo...

inspector

MCP Inspector A developer tool for inspecting Model Context Protocol MCP servers. It ships as a single package, @modelcontextprotocol/inspector, that provides four ways to inspect a server: Web — a Vite + React + Mantine single-page app with a Node backend. CLI — a scriptable command-line client...

trufflehog

TruffleHog Find leaked credentials. 🔎 Now Scanning ...and more To learn more about TruffleHog and its features and capabilities, visit our product page. 🌐 TruffleHog Enterprise Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint and more for...

trufflehog

TruffleHog Find leaked credentials. 🔎 Now Scanning ...and more To learn more about TruffleHog and its features and capabilities, visit our product page. 🌐 TruffleHog Enterprise Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint and more for...

CVE-2026-57742

The Kids Planet WordPress theme (versions n/a through 2.2.14.2 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the Improper Neutralization of Input During Web Page Generation (CWE-79) within the ThemeREX Group theme. This flaw allows an attacker to refle...

CVE-2026-57742 WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2...