ParrotSec-Linux-Hardening-Project

ParrotSec Linux - Public Kiosk Project Designing & Implementing A restricted & Trustworthy Environment Hardened kernel - GrSecurity Patched Kernel - PaX Hardening - x PaXctl - x PaXTest - x PaXctld - x Hardened Kernel Runtime Parameters - x Kernel Self Protection Project KSPP - x pti=on - Kernel...

autocrack

AUTOCRACK.py This python script is a Hashcat https://hashcat.net wrapper to help automate the cracking process. The script includes multiple functions to select a set of wordlists and rules, as well as the ability to run a bruteforce attack, with custom masks, before the wordlist/rule attacks...

CVE-2025-53652-Jenkins-Git-Parameter-Analysis

CVE-2025-53652: Jenkins Git Parameter Plugin의 검증되지 않은 입력 취약점. 요약 이 취약점은 Jenkins 빌드 파라미터의 사용자 제어 입력이 Git 체크아웃 명령에 안전하지 않게 주입되기 때문에 발생합니다. 사용자 입력은 빌드 파라미터예: gitParameters로 제공되며, 여기에는 악의적인 셸 명령이 포함될 수 있습니다. 이 파라미터는 GitParameterValueStringParameterValue를 확장로 래핑되며, 해당 GitParameterValue의 buildEnvironme...

spyse.py

spyse.py Python API wrapper and command-line client for the tools hosted on spyse.com. "Spyse is a developer of complete DAAS Data-As-A-Service solutions for Internet security professionals, corporate and remote system administrators, SSL / TLS encryption certificate providers, data centers and...

meowEye

🐾 MeowEye MeowEye 는 여러 웹 취약점을 위한 실시간 스캐너입니다. 실제 브라우저를 사용하여 트래픽을 관찰하고, 주입 기반 테스트를 수행하여 지금은 반사 매개변수reflective parameters, 로컬 파일 포함LFI, 서버 측 템플릿 주입SSTI 취약점을 탐지합니다. 할 일 목록에는 여러 취약점이 추가될 예정입니다. 🐾 왜 MeowEye인가요? 저는 Koko 라는 고양이를 키우고 있어요. 정말 아름답지만, 솔직히 말하자면… 그녀는 하루 종일 야옹거리고, 히싱하고, 먹고, 자고, 그리고, 음… 💩 말고는 아무...

CVE-2024-34225

Computer Laboratory Management System using PHP and MySQL 1.0 Submitter: Kha Do Vulnerability Cross Site Scripting Description Cross Site Scripting vulnerability in php-lms/admin/?page=systeminfo in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject...

CVE-2024-34224

Computer Laboratory Management System using PHP and MySQL 1.0 Submitter: Kha Do Vulnerability Cross Site Scripting Description Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject...

BurpSentinel

Burp Sentinel 웹 애플리케이션에서 흔한 보안 허점을 쉽게 발견할 수 있게 해줍니다. 소개/튜토리얼: https://github.com/dobin/BurpSentinel/wiki/BurpSentinel---HowTo-and-introduction 블로그: http://dobin.github.io/ BurpSentinel을 사용하면 침투 테스터가 HTTP 요청의 매개변수에 많은 악성 요청을 빠르고 쉽게 보낼 수 있습니다. 그뿐만 아니라, 공격 요청에 해당하는 HTTP 응답에 대한 많은 정보도 표시합니다. 이처럼 쉽게 발...

CVE-2019-12725-Command-Injection

POC CVE-2019-12725-Remote-Command-Execution ZeroShell 3.9.0 Remote Command Injection Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this iss...

CVE-2023-39062

CVE-2023-39062 Spipu Html2Pdf alertdocument.domain HTTP/1.1 Host: example.afine.com Cookie: PHPSESSID=oiqo2oopiqt88teqgfb0a23vk0 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:109.0 Gecko/20100101 Firefox/113.0 Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate...

CVE-2024-4577

Orange Tsi 🍊 This vulnerability was found by Orange Tsai @orange8361 of DEVCORE @d3vc0r3. Make sure to follow his outstanding research, our role was to only recreate and develop the exploit for this issue. Security Alert: CVE-2024-4577 PHP CGI Argument Injection Vulnerability Overview CVE-2024-45...

mooSocial 3.1.8 - External Service Interaction

mooSocial 3.1.8 is vulnerable to external service interaction via multiple parameters in the post function. id: CVE-2023-43323 info: name: mooSocial 3.1.8 - External Service Interaction author: ritikchaddha severity: medium description: | mooSocial 3.1.8 is vulnerable to external service...

WordPress Tutor LMS <2.0.10 - Cross Site Scripting

WordPress Tutor LMS plugin before 2.0.10 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the resetkey and userid parameters before outputting then back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the conte...

Shopware < 5.5.8 - Cross-Site Scripting

Shopware before 5.5.8 contains a reflected cross-site scripting XSS caused by unsanitized query string parameters in the backend/Login or backend/Login/load/ URI, letting attackers execute arbitrary scripts in the context of the victim's browser, exploit requires sending crafted URL to the victim...

Datart v1.0.0-rc.3 - Remote Code Execution

Datart v1.0.0-rc.3 contains a vulnerability that allows remote attackers to execute arbitrary code via INIT connection parameters. id: CVE-2025-56819 info: name: Datart v1.0.0-rc.3 - Remote Code Execution author: Redmomn severity: critical description: | Datart v1.0.0-rc.3 contains a vulnerabilit...

Joomla Easy Store - SQL Injection

Joomla Easy Store extension 1.0.0-2.0.1 contains an unauthenticated SQL injection caused by improper validation of order parameters, letting unauthenticated attackers read the full database including credentials and sessions. id: CVE-2026-65761 info: name: Joomla Easy Store - SQL Injection author...

OpenMetadata - Authentication Bypass

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The JwtFilter handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request...

Navidrome < 0.53.0 - Authenticated SQL Injection

Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like password=... in the URL ORM Leak. Furthermore, the names of the parameters are not...

Piwigo 13.7.0 - SQL Injection

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header User-Agent is vulnerable at the endpoint that records user information when logging in to the...

CVE-2022-28346

CVE-2022-28346 PoC 영향: QuerySet.annotate, aggregate 및 extra에서 잠재적 SQL 인젝션. 설치 poetry install python manage.py makemigrations python manage.py migrate python manage.py loaddata data.json python manage.py runserver PoC ?field=poc.title" FROM "pocblog" union SELECT "-1,",sqliteversion,"3" -- 참고 자료 C...