restic

Introduction restic is a backup program that is fast, efficient and secure. It supports the three major operating systems Linux, macOS, Windows and a few smaller ones FreeBSD, OpenBSD. For detailed usage and installation instructions check out the documentation. You can ask questions in our...

Malware

Malware macOS Malware Collection ⚠️ This page contains links to live malware! By downloading malware from this site, you waive all rights to claim any damages resulting from mishandling or self-infection. 📡 Running the samples, may results in connections to attack controlled infrastructure e.g...

Evasive_Malware_Book_Samples

Samples from "Evasive Malware" Book The samples referenced in my book, Evasive Malware: A Field Guide to Detecting, Analyzing, and Defeating Advanced Threats https://nostarch.com/evasive-malware Legal Disclaimer This repository is provided for educational and research purposes only in connection...

CVE-2002-0347

CVE-2002-0347 Directory traversal vulnerability in Cobalt RAQ 4 allows remote attackers to read password-protected files, and possibly files outside the web root, via a .. dot dot in an HTTP request. Packetstorm publication at https://packetstormsecurity.com/files/25837/Colbalt-RAQ-v4.txt.html...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

WordPress 3D FlipBook <= 1.16.17 - Information Disclosure

WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions = 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3dsendpostsin, fb3dsendpostpages, fb3dsendpostsinpages, fb3dsendpostsinfirstpage, and fb3dsendpostfirstpage handlers are...

ZipExec

ZipExec ZipExec es una herramienta de Proof-of-Concept POC para envolver herramientas basadas en binarios en un archivo zip protegido por contraseña. Este archivo zip luego se codifica en base64 a una cadena que se reconstruye en disco. Esta cadena codificada se carga en un archivo JScript que, a...

CVE-2026-90540

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting the...

CVE-2026-90550

WWBN AVideo (through commit c3edcc27) is affected by a missing authorization vulnerability in the PlayerSkins mediaSession.json.php endpoint. The endpoint fails to verify user authorization before returning video metadata, allowing unauthenticated attackers to supply a video ID parameter and retr...

EUVD-2026-76867

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner...

CVE-2026-90549

WWBN AVideo , a PHP-based video platform, is vulnerable to missing authorization on the videosAndroid.json.php endpoint in versions through commit c3edcc274c389816d434acadac07ee78eaf330c1. Unauthenticated attackers can send a simple GET request to the endpoint and retrieve metadata of password-pr...

CVE-2026-90547

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains an authorization flaw in the Bookmark plugin 's getBookmarks.json.php endpoint. The endpoint fails to validate user permissions, allowing unauthenticated attackers to query it with a video ID parameter and retrieve cha...

EUVD-2026-76864

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the like.json.php endpoint, allowing logged-in users to record likes on password-protected and group-restricted videos. Attackers can submit like requests for videos they cannot watch...

CVE-2026-90545

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1 ) fails to validate video access permissions in the commentAddNew.json.php endpoint. This missing authorization check allows authenticated users to post comments on videos that are password-protected or group-restricted, effecti...

EUVD-2026-76863

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests with a valid...

CVE-2026-90540 WWBN AVideo Missing Authorization via playListAddVideo.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting the...

CVE-2026-90540

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a missing authorization flaw in the playListAddVideo.json.php endpoint. The endpoint fails to validate watch permissions when adding videos to playlists, allowing authenticated attackers to add password-protected video...

EUVD-2026-76858

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting the...

PT-2026-90654

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner...

wwwolf-php-webshell

wwwolf's PHP web shell I frequently encountered issues when using other web shells: They use new PHP syntax features not compatible with the old PHP version running on some targets. They make wrong assumption on the remote URL, breaking PHP code injection or GET parameters unexpected by the serve...