CVE-2026-104028 Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE

The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code...

notionterm

notionterm Embed reverse shell inNotion pages. Hack while taking notes FOR ➕: Hiding attacker IP in reverse shell No direct interaction between attacker and target machine. Notion is used as a proxy hosting the reverse shell Demo/Quick proof insertion within report High available and shareable...

wotop

Web-On-Top-Of-Protocol WOTOP ██╗ ██╗ ██████╗ ████████╗ ██████╗ ██████╗ ██║ ██║██╔═══██╗╚══██╔══╝██╔═══██╗██╔══██╗ ██║ █╗ ██║██║ ██║ ██║ ██║ ██║██████╔╝ ██║███╗██║██║ ██║ ██║ ██║ ██║██╔═══╝ ╚███╔███╔╝╚██████╔╝ ██║ ╚██████╔╝██║ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═════╝ ╚═╝ Introduction WOTOP is a tool meant to...

fprobe

FProbe FProbe - Fast HTTP Probe Installation GO111MODULE=on go get -u github.com/theblackturtle/fprobe Features Take a list of domains/subdomains and probe for working http/https server. Optimize RAM and CPU in runtime. Support special ports for each domain Verbose in JSON format with some...

fprobe

FProbe FProbe - Sonda HTTP rápida Instalación GO111MODULE=on go get -u github.com/theblackturtle/fprobe Características Toma una lista de dominios/subdominios y prueba si tienen servidores http/https funcionando. Optimiza RAM y CPU en tiempo de ejecución. Soporta puertos especiales para cada...

python-ecdsa

ECDSA ed ECDH in puro Python Questa è un'implementazione facile da usare di ECC Elliptic Curve Cryptography con supporto per ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm ed ECDH Elliptic Curve Diffie-Hellman, implementata interamente in Python,...

pwninit

pwninit Ein Tool zur Automatisierung des Starts von Binary-Exploit-Challenges Funktionen Challenge-Binary als ausführbar markieren Einen Linker ld-linux.so. herunterladen, der die bereitgestellte libc ohne Segfault laden kann Debug-Symbole herunterladen und die libc entstrippen Das Binary mit...

sploit

sploit Sploit is a Go package that aids in binary analysis and exploitation. The motivating factor behind the development of sploit is to be able to have a well designed API with functionality that rivals some of the more common Python exploit development frameworks while taking advantage of the ...

oauth2-proxy

OAuth2 Proxy è uno strumento open-source flessibile che può fungere da reverse proxy autonomo o da middleware integrato in configurazioni di reverse proxy o load balancer esistenti. Fornisce un modo semplice e sicuro per proteggere le tue applicazioni web con l'autenticazione OAuth2 / OIDC. Come...

ADSyncDump-BOF

ADSyncDump BOF The ADSyncDump BOF is a port of Dirkjan Mollema's adconnectdump.py / ADSyncDecrypt into a Beacon Object File BOF for use with Cobalt Strike, Sliver and Havoc. !NOTE The tool has been tested on a Windows Server 2019 with Azure AD Connect version 2.2.1.0. The 32 bit version of the BO...

sidedoor

sidedoor sidedoor maintains an SSH connection or tunnel with a shell script daemon. The primary use case is maintaining a remote port forward to the local SSH server or another port. Thus, the local device can be accessed without using incoming connections that may be blocked by a NAT or firewall...

Chaya

Chaya Right To Privacy Chaya protects your privacy through steganography, cryptography and compression. It effectively encrypts your payloads using AES-256-GCM cryptography, embeds them using LSB-LPS steganography technique into images and compresses them using FLIF to evade detection by performi...

posta

Posta Posta is a tool for researching Cross-document Messaging communication. It allows you to track, explore and exploit postMessage vulnerabilities, and includes features such as replaying messages sent between windows within any attached browser. Prerequisites Google Chrome / Chromium Node.js...

CVE-2019-19781

CVE-2019-19781 Ejecución Remota de Código en Citrix ADC uso de python: python CVE-2019-19781.py http://192.168.3.244 0x01 descargar NSVPX-ESX-13.0-47.22nc64.zip https://www.citrix.com/downloads/citrix-gateway/ configurar red estática 0x02 escaneo nmap Scanning 192.168.3.244 65535 ports Discovered...

clusterd

clusterd clusterd es un conjunto de herramientas de ataque para servidores de aplicaciones de código abierto. Nacido de la frustración con los métodos actuales de fingerprinting y explotación, clusterd automatiza las fases de fingerprinting, reconocimiento y explotación de un ataque a servidores ...

refinery

Binary Refinery docs tests codecov pypi High Octane Triage Analysis || || || || || | / / / \ || ==||=====|| | / |/ \ /==| / \ ===| '======|| | \ | | \ | \ /| | || || /||/ / | | | || =========''====/=========/ /==||=====||======' \ / / Il Binary Refinery™ è una raccolta di script Python che...

CVE-2020-5148

CVE-2020-5148 Forced Authentication in the SonicWall UTM SSO Agent The SonicWall SSO Agent identifies the user behind a given IP address by probing that workstation with NetAPI the default or WMI. It does not validate the workstation before initiating the NTLM authentication, and it continues...

CVE-2026-59243

CVE-2026-59243 — Apache Airflow FAB Auth Manager JWT signature bypass Korean: README.ko.md Apache advisory: https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl published 2026-07-29 CVE record: https://vulners.com/cve/CVE-2026-59243 Fixed in: apache-airflow-providers-fab==3.7.3 Class:...

ShellShockHunter

ShellShockHunter v1.0 It's a simple tool for test vulnerability shellshock Autor: MrCl0wn Blog: http://blog.mrcl0wn.com GitHub: https://github.com/MrCl0wnLab Twitter: https://twitter.com/MrCl0wnLab Email: mrcl0wnlab@\gmail.com Shellshock software bug Shellshock, also known as Bashdoor, is a famil...

CVE-2024-6387

CVE-2024-6387 - PoC 📜 Descripción Nota: Este script es un PoC prototipo rápido, espere que puedan ocurrir algunos errores y fallos. Probado en: Kali Linux, ParrotSec, Ubuntu 22.04 Vulnerabilidad de ejecución remota de código no autenticado en el servidor OpenSSH Se encontró una condición de carre...