cirro

A Cirro é uma plataforma de pesquisa de segurança extensível que permite a pesquisadores e testadores de penetração coletar, analisar e visualizar ambientes em nuvem e relacionamentos de identidade por meio de bancos de dados de grafos. Construída com uma arquitetura modular, a Cirro pode ser...

spyse.py

spyse.py Python API wrapper and command-line client for the tools hosted on spyse.com. "Spyse is a developer of complete DAAS Data-As-A-Service solutions for Internet security professionals, corporate and remote system administrators, SSL / TLS encryption certificate providers, data centers and...

cve-2025-2082-POV

CVE-2025-2082 – Sobrescrita de Ponteiro de Função PoV estilo VCSEC Este repositório demonstra uma Prova de Vulnerabilidade PoV simulando uma falha crítica de corrupção de memória inspirada em CVE-2025-2082, descoberta no componente VCSEC Vehicle Controller Security da Tesla. A vulnerabilidade...

IATelligence

IATelligence IATelligence هو برنامج نصي بلغة Python يستخرج جدول عناوين الاستيراد IAT من ملف PE ويستخدم نموذج GPT-3 من OpenAI لتقديم تفاصيل حول كل واجهة برمجة تطبيقات Windows مستوردة بواسطة الملف. يبحث البرنامج النصي أيضًا عن تقنيات MITRE ATT&CK ذات الصلة ويشرح كيف يمكن للمهاجمين استخدام API...

CVE-2025-54110-Kernel-EoP-PoC

CVE-2025-54110-Kernel-EoP-PoC Implementação de PoC para CVE-2025-54110, uma vulnerabilidade de estouro de inteiro no nível do kernel na chamada de sistema NtQueryDirectoryObject do Windows. CVE-2025-54110 - Análise de Estouro de Inteiro no Kernel do Windows CVE:...

hot-jar-swapping-urlclassloader

التبديل الساخن لملفات JAR عبر URLClassLoader يوضح الكود المثال التالي القدرة على تبديل ملف JAR مُحمَّل بالفعل بشكل ساخن والحصول على تنفيذ كود عن طريق استغلال حقيقة أن الفئات الداخلية inner classes لا تزال تصل إلى ملف JAR عند استدعائها، طالما أن inode لم يتغير. تم اختباره على MacOS باستخدام OpenJD...

idacode

IDACode IDACode makes it easy to execute and debug Python scripts in your IDA environment without leaving Visual Studio Code. The VS Code extension can be found on the marketplace. IDACode is still in a very early state and bugs are to be expected. Please open a new issue if you encounter any...

CVE-2026-58025

CVE-2026-58025 — RCE por desserialização de PHP no MediaWiki via importação de entrada de log WikiImporter → LogEntryBase::extractParams → unserialize de logparams controlados pelo usuário → RCE Visão Geral CVE-2026-58025 é uma vulnerabilidade crítica CVSS 9.8 de desserialização de dados não...

vbSparkle

vbSparkle क्या है? vbSparkle एक स्रोत-से-स्रोत source-to-source मल्टी-प्लेटफ़ॉर्म Visual Basic डिओबफसकेटर है जो आंशिक-मूल्यांकन partial-evaluation पर आधारित है और मुख्य रूप से VBScript और VBA Office Macro में लिखे दुर्भावनापूर्ण कोड के विश्लेषण के लिए समर्पित है। यह नेटिव C में लिखा गया है और एक...

CVE-2025-58434-AND-59528-POC

Flowise डुअल CVE PoC — CVE-2025-58434 + CVE-2025-59528 ⚠️ केवल शैक्षिक और अधिकृत सुरक्षा अनुसंधान के लिए। इस टूल को उन सिस्टमों के विरुद्ध चलाना जिनके स्वामी आप नहीं हैं या जिनके परीक्षण के लिए आपके पास लिखित अनुमति नहीं है, अवैध है। विषय-सूची अवलोकन कमजोरियों का विवरण CVE-2025-58434 — खाता...

js-x-ray

!slsa...

Maverick

Maverick Um agente C2 para Adaptix construído com Crystal Palace — um linker PIC Position Independent Code personalizado e sistema de módulos PICO. Demonstra como construir agentes shellcode modulares onde cada componente transporte, tarefas, ofuscação é um blob PICO separado carregado em tempo d...

zig-pe

zig-pe Carregador de PE reflexivo escrito em Zig. Carrega e executa arquivos PE nativos e .NET diretamente da memória. Funcionalidades Pipeline de Carregamento de PE Analisar cabeçalhos DOS e NT PE32 e PE32+ em tempo de execução Mapear seções na memória alocada Resolver importações por nome e...

CVE-2026-97643 GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's givewpcampaigngrid shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied...

CVE-2026-97643 GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's givewpcampaigngrid shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied...

CVE-2026-97643

The GiveWP – Donation Plugin and Fundraising Platform for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 4.17.0 . The root cause is insufficient input sanitization and output escaping within the CampaignGridShortcode::parseAttributes() function. Speci...

CVE-2026-97643 GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's givewpcampaigngrid shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied...

EUVD-2026-96109

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's givewpcampaigngrid shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied...

CVE-2026-92975

The Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress (versions ≤ 4.8.3 ) contains a Privilege Escalation vulnerability in the create_support_user() function. The flaw exists because the function identifies support accounts using publicly hardcoded constants—specifically ...

CVE-2026-92975 Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...