5605 matches found
zclaw
zclaw Il più piccolo assistente personale AI possibile per ESP32. zclaw è scritto in C e funziona su schede ESP32 con un rigoroso budget totale di firmware di = 888 KiB nella build predefinita. Supporta attività programmate, controllo GPIO, memoria persistente e composizione di strumenti...
git-all-secrets
git-all-secrets About git-all-secrets is a tool that can: Clone multiple public/private github repositories of an organization and scan them, Clone multiple public/private github repositories of a user that belongs to an organization and scan them, Clone a single public/private repository of an...
CVE-2025-28355
CVE-2025-28355 È stato identificato che l'applicazione https://github.com/Volmarg/personal-management-system è vulnerabile ad attacchi CSRF. Una delle molte azioni che un attaccante può eseguire è ingannare un utente legittimo per fargli eseguire una richiesta cross-site che modificherà la sua...
CVE-2026-58108
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...
CVE-2025-51400
Exploit-Titel: LiveHelperChat =4.61 – Stored Cross Site Scripting XSS über persönliche vorgefertigte Nachrichten Personal Canned Messages Datum: 09/06/2025 Exploit-Autor: Manojkumar J TheWhiteEvil LinkedIn: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Hersteller-Homepage:...
CVE-2025-69581
CVE-2025-69581 In Chamilo LMS 1.11.2 wurde ein Problem entdeckt. Der Endpunkt /personaldata des sozialen Netzwerks legt selbst nach dem Abmelden vollständige sensible Benutzerinformationen offen, da ein ordnungsgemäßer Cache-Control fehlt. Durch die Verwendung der Zurück-Schaltfläche des Browsers...
AdTran-Personal-Phone-Manager-Vulns
AdTran-Personal-Phone-Manager-Vulns Un repository che ospita write-up per le vulnerabilità zero-day CVE-2021-25679, CVE-2021-25680 e CVE-2021-25681. Riepilogo CVE-2021-25679: Adtran Personal Phone Manager XSS Memorizzato Autenticato nel modulo di modifica dell'indirizzo email CVE-2021-25680: Adtr...
memory-poisoning-axis
memory-poisoning-axis Deterministische Memory-Poisoning-/Prompt-Injection-Messung — verankert an CVE-2026-24301 „CoSnitch" Microsoft Copilot Personal, CVSS 3.1 8.8, gepatcht am 18. Aug. 2026. CoSnitch verknüpfte: i automatische Prompt-Ausführung ?q= + undokumentiertes ?autorun=1, ii...
HackingAllTheThings
HackingAllTheThings Riepilogo Questo repository serve a mantenere una struttura per i miei strumenti e appunti che utilizzo quando lavoro per ottenere alcune certificazioni IT-Security. Alcuni strumenti saranno scritti da me e altri saranno risorse trovate da diverse fonti...
socid-extractor
socidextractor Turn any public profile page into a structured account record — usernames, display names, bios, avatars, locations, joined-at dates, follower counts, external links, and the stable internal identifiers that uniquely pin an account across renames, redesigns, and deletions...
EUVD-2026-63550
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, an...
EUVD-2026-63359
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...
EUVD-2026-62628
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...
Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session. The flaws, which the researchers collectively...
CVE-2026-17087
The CVE describes an authorization bypass in the WP Travel Engine – Tour Booking Plugin (Tour Operator Software) for WordPress, up to version 6.8.4. An unauthenticated attacker can view private booking billing details (customer name, email, address, phone) by binding an arbitrary booking_id to th...
Exploit for CVE-2026-9830
CVE-2026-9830 BookingPress Pro API Assessment PoC This reposi...
CVE-2026-58444
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
CVE-2026-58444
CVE-2026-58444 covers a bypass of personal access token scope enforcement on the Gitea repository home page (GET /{owner}/{repo}), which can disclose private repository contents. Affected: Gitea (open-source Git hosting) with token scope checks on repository home pages; root cause: deficiencies i...