python-uncompyle6

|buildstatus| |Pypi Installs| |Latest Version| |Supported Python Versions| |packagestatus| .. contents:: uncompyle6 A native Python cross-version decompiler and fragment decompiler. The successor to decompyle, uncompyle, and uncompyle2. I gave a talk on this at BlackHat Asia 2024 . Introduction...

CVE-2026-16723

CVE-2026-16723 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments...

CVE-2022-24760

CVE-2022-24760 flow By default, no key is required to add, delete, or modify classes in the database Diff commit https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d Prototype pollution occurs in the function expandResultOnKeyPath DatabaseController.js...

uefi-firmware-parser

UEFI Firmware Parser .. image:: https://travis-ci.org/theopolis/uefi-firmware-parser.svg?branch=master :target: https://travis-ci.org/theopolis/uefi-firmware-parser The UEFI firmware parser is a simple module and set of scripts for parsing, extracting, and recreating UEFI firmware volumes. This...

loki-parse

loki-parse Un script de Python que puede detectar y analizar el tráfico de red relacionado con loki-bot malware entre un host comprometido y un servidor C2. Este script puede ser útil para analistas de DFIR e investigadores de seguridad que quieran saber qué datos se están exfiltrationando al C2,...

pastego

pastego Scrape/Parse Pastebin using GO and grammar expression PEG. pastego.png Installation $ go get -u github.com/notdodo/pastego Usage Search keywords are case sensitive pastego -s "password,keygen,PASSWORD" You can use boolean operators to reduce false positive pastego -s "quake && earthquake,...

bofhound

THIS REPO IS NO LONGER ACTIVE ⛔🚧 This repo is no longer maintained. To submit an issue, pull request, or obtain the lastest version, reference https://github.com/coffeegist/bofhound 🚧⛔ | / / / | /| | | | / \ | | | | | \ | | | \ | | | | | | | | | | || | | | | | | | | | | | | | .--. | | | | | | | |...

POC_SQL_injection_in_Parse_Server_prior_6.5.7_-_7.1.0

Database Ghost 🔥 Advanced PostgreSQL SQL Injection Exploitation Tool 🚨 DISCLAIMER FOR AUTHORIZED SECURITY TESTING ONLY Unauthorized use is illegal. Use only on systems you own or have explicit permission to test. ⚡ QUICK START Install & Run git clone...

xepor

Xepor Xepor pronounced /ˈzɛfə/ , zephyr is a web routing framework for reverse engineers and security researchers. It provides a Flask-like API for hackers to intercept and modify HTTP requests and/or HTTP responses in a human-friendly coding style. This project is meant to be used with mitmproxy...

Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration

Parse Server 8.6.21 / 9.x 9.5.2 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a...

CVE-2026-103441

CVE-2026-103441: Wikibase serialized entity object injection Reporter: Marco Paciaroni BomboBombone. The public action=parse API accepted PHP-serialized Wikibase entities. Unrestricted object construction could reach a Smarty destructor that unlinks a caller-selected path. Available PHP gadget...

gha-lab-51c6b6d0a0

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of parse-community/parse-server at commit...

mediawiki-CVE-2026-100382

Lab reproduction - CVE-2026-100382 ExternalData OS command injection What this lab is MediaWiki 1.43 official image, SQLite + ExternalData3.6.1 last vulnerable, mounted read-only from ../mediawiki-extensions-ExternalData. Loopback only: published on 127.0.0.1:$HOSTPORT default 8080. Anonymous...

usbrip

usbrip inherited from "USB Ripper", not "USB R.I.P." is a simple forensics tool with command line interface that lets you keep track of USB device artifacts i.e., USB event history on Linux machines. Table of Contents: Description Quick Start Showcase System Log Structure Dependencies deb pip...

CVE-2021-1965

CVE-2021-1965 CVE-2021-1965 WiFi Zero Click RCE Trigger PoC This is a quick&dirty Proof-of-Concept code to verify if your phone is vulnerable. After running the poc code, your phone is supposed to crash&reboot within seconds. In case you need more info about the bug & vulnerable code, here you ar...

GHSA-X26Q-WVHG-FH4M Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

Root Cause File: internal/corazawaf/transaction.go, lines 834–866. go parsedURL, err := url.ParseRequestURIuri query := "" if err != nil tx.variables.urlencodedError.Seterr.Error path = uri tx.variables.requestURI.Seturi / tx.Variables.VARIABLEURIPARSEERROR.Set"1" posRawQuery := strings.Indexuri,...

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

Root Cause File: internal/corazawaf/transaction.go, lines 834–866. go parsedURL, err := url.ParseRequestURIuri query := "" if err != nil tx.variables.urlencodedError.Seterr.Error path = uri tx.variables.requestURI.Seturi / tx.Variables.VARIABLEURIPARSEERROR.Set"1" posRawQuery := strings.Indexuri,...

CVE-2026-30863-Exploit

CVE-2026-30863 – Parse Server JWT Audience Validation Affected versions Parse Server 8.6.10 and 9.5.0-alpha.11 Vulnerable components Google auth adapter GoogleAuthAdapter Apple auth adapter AppleAuthAdapter Facebook auth adapter FacebookAuthAdapter Root cause When the adapter is configured withou...

CVE-2026-105828

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send...

EUVD-2026-95015

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send...