wwwolf-php-webshell

wwwolf's PHP web shell I frequently encountered issues when using other web shells: They use new PHP syntax features not compatible with the old PHP version running on some targets. They make wrong assumption on the remote URL, breaking PHP code injection or GET parameters unexpected by the serve...

Malware

Malware macOS Malware Collection ⚠️ This page contains links to live malware! By downloading malware from this site, you waive all rights to claim any damages resulting from mishandling or self-infection. 📡 Running the samples, may results in connections to attack controlled infrastructure e.g...

restic

Introduction restic is a backup program that is fast, efficient and secure. It supports the three major operating systems Linux, macOS, Windows and a few smaller ones FreeBSD, OpenBSD. For detailed usage and installation instructions check out the documentation. You can ask questions in our...

ZipExec

ZipExec ZipExec is a Proof-of-Concept POC tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected...

GoFileX

GoFileX Late-90s IRC-client TUI for walking wordlists against a password-protected GoFile share. It talks only to the documented REST API and treats rate limits as a hard rule: sequential requests, a conservative default interval, exponential cooldown on 429 / error-rateLimit, and an automatic...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

WordPress 3D FlipBook <= 1.16.17 - Information Disclosure

WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions = 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3dsendpostsin, fb3dsendpostpages, fb3dsendpostsinpages, fb3dsendpostsinfirstpage, and fb3dsendpostfirstpage handlers are...

CVE-2022-46484

CVE-2022-46484 Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbitrarily submit surveys...

Evasive_Malware_Book_Samples

Samples from "Evasive Malware" Book The samples referenced in my book, Evasive Malware: A Field Guide to Detecting, Analyzing, and Defeating Advanced Threats https://nostarch.com/evasive-malware Legal Disclaimer This repository is provided for educational and research purposes only in connection...

CVE-2002-0347

CVE-2002-0347 Directory traversal vulnerability in Cobalt RAQ 4 allows remote attackers to read password-protected files, and possibly files outside the web root, via a .. dot dot in an HTTP request. Packetstorm publication at https://packetstormsecurity.com/files/25837/Colbalt-RAQ-v4.txt.html...

CVE-2026-120409

The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted...

CVE-2026-120409 All-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via Player Page and Download Handler

The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted...

CVE-2026-120409

The All-in-One Video Gallery WordPress plugin (versions before 5.1.1 ) contains a vulnerability where it fails to verify password protection status before serving content. Unauthenticated visitors can access the media source of password-protected videos via the plugin's standalone player page and...

WordPress All-in-One Video Gallery plugin < 5.1.1 - Unauthenticated Password-Protected Video Disclosure vulnerability

Unauthenticated Password-Protected Video Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin All-in-One Video Gallery versions 5.1.1...

EUVD-2026-119457

The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected...

WordPress WP Recipe Maker plugin < 10.9.2 - Unauthenticated Password-Protected Recipe Disclosure vulnerability

Unauthenticated Password-Protected Recipe Disclosure vulnerability discovered by wellknown.info in WordPress Plugin WP Recipe Maker versions 10.9.2...

CVE-2026-118801

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, wit...

EUVD-2026-118972

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, wit...

CVE-2026-118801 aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, wit...

CVE-2026-68933 Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, public dashboard passwords were stored in plaintext, accepted through a URL query parameter, and checked without effective attempt throttling. The...