ffufPostprocessing

Ffuf: 後処理 残念ながら、ffuf は「-ac」フラグにもかかわらず、無関係なエントリを大量に生成する傾向があります。そのため、これらのエントリをフィルタリングするための後処理ツールを作成しました。 さらに、「-ac」を使用すると、関連するエントリが多く削除されるのを確認しました。特に ffuf が json や xml ファイルに遭遇した場合、「-ac」はそれらを完全に削除する可能性があります。 このツールは ffuf が完了した後に実行する必要があります。また、最初の ffuf コマンドは以下のフラグを指定して実行する必要があります: -o...

NewPowerDNS

NewPowerDNS NewPowerDNS は、@domchell's の PowerDNS を更新したバージョンです。主な追加機能は、DNS A レコードを使用したファイル転送のサポートです。以下に、行われた変更の完全なリストを示します： DNS A レコードを介した転送のサポート ファイル転送サイズを削減する Gzip 圧縮 あらゆる種類のファイル転送のサポート AV/EDR によるブロックを回避するために、簡単に難読化したり、1行ずつ実行したりできる新しいステージャー 転送されたファイルを印刷、実行、または保存するオプション python2 から python3 へのアップデー...

CVE-2026-82043

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

CVE-2024-12252

SEO LAT Auto Post = 2.2.1 - 원격 코드 실행 설명 WordPress용 SEO LAT Auto Post 플러그인은 2.2.1 이하 모든 버전의 remoteupdate AJAX 액션에서 capability 검사가 누락되어 파일 덮어쓰기 취약점에 노출됩니다. 이로 인해 인증되지 않은 공격자가 seo-beginner-auto-post.php 파일을 덮어쓸 수 있으며, 이를 악용하여 원격 코드 실행을 달성할 수 있습니다. 취약점 세부 정보 CVE : CVE-2024-12252 CVSS 점수 : 9.8 심각 익스플로...

EUVD-2026-91802

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...

CVE-2026-82043 UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

EUVD-2026-91798

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

CVE-2026-82043

Versions of UTMStack prior to 11.2.16 are vulnerable to an account enumeration flaw. An unauthenticated attacker can identify registered email addresses by sending requests to the POST /api/account/reset-password/init endpoint. The application provides different HTTP responses based on the existe...

CVE-2026-82043 UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

CVE-2026-82043 UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

CVE-2024-32002-poc

Bash Script: !/bin/bash Set Git configuration options git config --global protocol.file.allow always git config --global core.symlinks true Avoid warning messages set default branch to main git config --global init.defaultBranch main Define tell-tale path telltalepath="$PWD/tell.tale" Initialize...

doser.go

doser.go Goで書かれたHTTPリクエスト用DoSツール（hulkに触発されたが、より多くの機能を持つ）： 使い方は？ 1. コンパイルする go build doser.go 2. 使用する（例：999スレッドでGETリクエストを送信）。P.S: 私のウェブサイトを実際に攻撃しないでください ./doser -t 999 -g 'https://stylish-bear.ru' 使用方法 Usage of ./doser: -h -g G -p P -d D -ah AH -t T optional arguments: -h, --help show this help...

Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL

Summary A project member can create a webhook alert channel whose delivery URL points at an internal address, and trigger.dev's control plane will send the alert there with no SSRF protection. The webhook URL is stored as an unvalidated string and is fetched directly from the webapp server, so a...

pth-toolkit

pth-toolkit 이식 가능하며 가장 '최소 구성' 시스템에서도 바로 사용할 수 있도록 설계된 passing-the-hash 도구 모음 https://code.google.com/p/passing-the-hash/ 의 수정 버전입니다. 마스터 브랜치는 amd64용으로 컴파일되어 있으며, 최종 목표는 이러한 도구들을 가능한 모든 아키텍처로 크로스 컴파일하는 것입니다. 현재 이 저장소는 다음 패치된 도구/유틸리티를 제공합니다: winexe wmic wmis rpcclient smbclient smbget net 요구 사항 sh...

WordPress Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Content Modification vulnerability discovered by Webbernaut in WordPress Plugin Download Alt Text AI versions = 1.10.41...

CVE-2026-51916

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in deleteuserknowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledgeid deletes the selected knowledge object without requiring authentication in the rout...

TornadoRevC2

TornadoRevC2 A lightweight, modular post-exploitation framework for authorized security research, red-team operations, and penetration testing. TornadoRevC2 manages interactive reverse shell and bind shell sessions on Linux and Windows hosts through a unified operator console, across plain TCP,...

metasploitable-pentest-lab

Metasploitable 취약점 악용 통제되고 격리된 환경에서의 실제 공격 전체 사이클: 실습 환경 준비, nmap을 통한 정찰, 공격 표면 우선순위 지정, CVE 매핑, Metasploit을 통한 악용, 후속 악용, 자격 증명 추출 및 크래킹, SSH 키 주입을 통한 지속성 확보. 1. 환경 준비 공격자 : Kali Linux — msfconsole, nmap, John the Ripper. 대상 : Metasploitable 1 — Ubuntu 8.042010, 패치되지 않았으며 알려진 CVE를 다수 보유. 네트워크 :...

Exploit for Argument Injection in Thecodingmachine Gotenberg

CVE-2026-40281 Gotenberg --- 📖 Table of...

CVE-2026-104611

A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fastsettinginternetset of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carrie...