WifiPassword-Stealer

WifiPassword-Stealer 대상 컴퓨터에서 등록된 모든 Wi-Fi 비밀번호를 가져옵니다. 설치 파이썬 파일을 사용하는 경우 root@kitploit: pip install smtplib pip install subprocess pip install glob 사용법 •임시 메일을 사용하여 "https://mailtrap.io/"에 계정을 만드세요. •'main.py'에 자신의 SMTP USERNAME과 SMTP PASSWORD를 설정하세요. •다음 명령어로 EXE를 생성하세요". root@kitploit: python...

e013

e013 Windows에서 Wi-Fi 비밀번호를 훔치는 작은 VBScript WifiName.txt 파일에서 VBScript를 지원하는 모든 Windows 컴퓨터에 저장된 모든 Wi-Fi의 비밀번호를 확인할 수 있습니다. ⚠️ 메모장으로 스크립트를 수정하지 마세요. 텍스트 편집기GNU Emacs, Vim, Atom, Vscode, Sublime text 등를 사용하세요. ⚠️...

CredPhish

CredPhish는 자격 증명 프롬프트를 호출하고 비밀번호를 유출하도록 설계된 PowerShell 스크립트입니다. 이 스크립트는 사용자 비밀번호 수집을 위해 CredentialPicker, DNS 유출을 위해 Resolve-DnsName, 그리고 임의의 GET 요청을 수행하기 위해 Windows Defender의 ConfigSecurityPolicy.exe를 사용합니다. 자세한 내용은 Black Hills Infosec 게시물을 참조하십시오...

CVE-2026-84721

A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an...

EUVD-2026-85615

A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an...

sleepall

sleepall CVE-2024-28085 https://people.rit.edu/sjf5462/6831711781/wall2272024.txt のバグに基づくトロイの木馬で、まだどこでも修正されていません。要点: bash はエスケープコードをサポートしているため、ターミナル内の文字列の表示を制御できます。このトロイの木馬はプロセスを監視して sudo コマンドの pid を探し、その親を特定してルートプロセスを強制終了させ、偽の SUDO プロンプト文字列を差し込みます。 ユーザーがターミナルで sudo...

CVE-2023-24055

免責事項 このスクリプトは教育およびデモンストレーション目的でのみ使用されます。作者は、このスクリプトを犯罪や悪意のある活動に使用することを推奨または容認しておらず、明示的に許可された適切な許可がある場合にのみ使用すべきです。 このスクリプトは注意して使用してください。KeePassの設定ファイルを変更し、以前に設定されたトリガーを削除します。このスクリプトを使用すると、予期しない動作が発生し、KeePassアプリケーションが壊れる可能性があります。自己責任で使用してください。 はじめに このスクリプトは、バージョン2.53までのKeePass（デフォルトインストール）における 論争中...

Linux Distros Unpatched Vulnerability : CVE-2026-55856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java...

PT-2026-83771

Name of the Vulnerable Software and Affected Versions ZTE ZXDU68 S202 affected versions not specified Description Command injection flaws allow attackers to delete core system runtime files, which leads to the crash and paralysis of the monitoring module. Additionally, attackers can obtain root...

Exploit for CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS...

CVE-2026-54218: Use of Hard-coded Cryptographic Key

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server see...

EUVD-2026-52660

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

Introduction We have been tracking two new backdoors, OctLurk and SilkLurk , observed in attacks against government organizations primarily in Central Asia since January 2025. Identified victims are located in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab...

Drupal plugin "AI Agents" vulnerable to incorrect authorization

Overview AI Agents provided by Drupal contains the vulnerability listed below. Incorrect authorization CWE-863 - CVE-2026-13236 Kuniyoshi Noguchi @KuniNogu reported this vulnerability to the developer and IPA. JPCERT/CC coordinated with the developer to publish the advisory under Information...

CVE-2024-23564: Inadequate Encryption Strength

HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verif...

CVE-2026-47840

CVE-2026-47840 concerns LDAP StartTLS with UAA: a network attacker between UAA and its LDAP directory can impersonate the directory using any trusted certificate, harvest LDAP bind passwords and end-user passwords during simple-bind, and return forged group memberships that grant admin scopes. Af...

CVE-2026-47840 - LDAP StartTLS unconditionally disables hostname verification | Cloud Foundry

Severity High CVSS score: 8.3 High CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS score: 7.5 High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N/RL:O Vendor CloudFoundry Foundation Versions Affected Severity is High unless otherwise noted. UAA All versions prior to v78.13.0...

CVE-2026-57305: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password...

CVE-2026-8636: Cleartext Storage of Sensitive Information in Memory

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can use the same keys to decrypt password, gain access to the application and access sensitive data in the database...

Pirated PC games are delivering password-stealing malware

A new Windows malware campaign hides inside pirated PC games and modified installers for franchises like Far Cry, Need for Speed, FIFA, and Assassin’s Creed. Researchers estimate that more than 400,000 devices worldwide have been infected, with around 30,000 users in the US. The infection method ...