nrf24-playset

nRF24 Playset The nRF24 Playset is a collection of software tools for wireless input devices like keyboards, mice, and presenters based on Nordic Semiconductor nRF24 transceivers, e.g. nRF24LE1 and nRF24LU1+. All software tools support USB dongles with the nrf-research-firmware by the Bastille...

CVE-2022-27254

CVE-2022-27254 PoC for vulnerability in Honda's Remote Keyless SystemCVE-2022-27254 Disclaimer: For educational purposes only. Kindly note that the discoverers for this vulnerability are Ayyappan Rajesh, a student at UMass Dartmouth and HackingIntoYourHeart. Others mentioned in this repository ar...

CVE-2026-21010-VoIP-SIP-Digest-Authentication-Replay

CVE-2026-21010 – Replay de autenticación digest SIP en VoIP Código del programa simulador SIP en Python root@kitploit: sipserversim.py - SIP server that accepts replayed authenticated requests from flask import Flask, request app = Flaskname Simulated nonce storage: doesn't track used nonces...

linux-fingerprint-r503

linux-fingerprint-r503 — fingerprint login for Linux using a Grow R503 + Arduino A from-parts USB fingerprint reader for Linux desktops. Total parts cost under $15. Drop-in replacement for upstream fprintd — PAM, KDE Settings, GNOME Settings, fprintd-verify, sudo with finger, screen-unlock with...

radio-hackbox

SySS Radio Hack Box The SySS Radio Hack Box is a proof-of-concept software tool to demonstrate the replay and keystroke injection vulnerabilities of the wireless keyboard Cherry B.Unlimited AES. Requirements Raspberry Pi Raspberry Pi Radio Hack Box shield a LCD, some LEDs, and some buttons...

CVE-2026-23004-Automotive-UDS-Authentication-Bypass-via-Replay-Attack

CVE-2026-23004 – Omisión de autenticación UDS en automoción mediante ataque de repetición Código del programa simulador Python CAN‑UDS root@kitploit: udssim.py - ECU that authenticates with a simple challenge import random, hashlib class ECU: def initself: self.secret = b'longsecretkey' def...

RFCrack

/ | | | / | | | | / \ ' - / \ / - | / \ V V / ' / \ || - /||// /| ///|. //, / / |/ | /| | | || | / | | '/ /| / / | || || , | \ root@kitploit: Welcome to RFCrack - A Software Defined Radio Attack Tool Developer: @Ficti0n - http://ConsoleCowboys.com CCLabs: http://cclabs.io Blog:...

EUVD-2026-86451

The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another clie...

CVE-2026-23010-CCSDS-Telecommand-Replay-Without-Sequence-Number

CVE-2026-23010 – Replay de Telecomando CCSDS sin Número de Secuencia Código del Programa simulador de satélite en Python root@kitploit: satellitesim.py - Spacecraft that executes telecommands without checking sequence number class Satellite: def initself: self.executed = set def receivetcself,...

CVE-2026-94612

The authentik identity provider is vulnerable to an authentication bypass via assertion confusion in SAML Sources prior to versions 2026.2.7, 2026.5.7, and 2026.8.2. The root cause is that the SAML Source verifies an assertion's signature and validity period but fails to ensure the assertion was ...

CVE-2026-94612 authentik: Authentication bypass via assertion confusion in SAML sources

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that...

EUVD-2026-86276

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that...

ESP-RFID-Tool

ESP-RFID-Tool Por Corey Harding Sitio web oficial: www.rfid-tool.com April Brother está fabricando actualmente este hardware y se puede comprar directamente desde China a través de su Tienda Oficial: https://blog.aprbrother.com/product/esp-rfid-tool Tienda AliExpress:...

CVE-2022-38766

CVE-2022-38766 PoC para la vulnerabilidad en el sistema sin llave del Renault ZOE CVE-2022-38766 Introducción Companylogo AUTOCRYPT MalHyuk Resumen Esta vulnerabilidad planteó la cuestión de si los vehículos eléctricos ZOE están seguros frente a la piratería por RF. Por esta razón, el vehículo ZO...

CVE-2026-41707

A flaw was found in Spring Security's DPoPProofJwtDecoderFactory. This vulnerability allows a remote attacker to perform a replay attack by flooding the server with dummy requests, which evicts legitimate entries from an internal cache storing JSON Web Token JWT ID claims. Consequently, an attack...

CVE-2026-0101-BLE-Address-Spoofing-via-Weak-Resolvable-Private-Address

CVE-2026-0101 – Suplantación de dirección BLE mediante dirección privada resoluble débil Código del programa Python usando simulación bleak root@kitploit: bleperipheralsim.py - Simulated BLE peripheral with weak RPA verification import asyncio, random, hashlib from bleak import BleakServer,...

ams-failopen

Firma Fail-Open en AppleMediaServices Divulgación de Zero-Day Resumen Este problema constituye una vulnerabilidad Zero-Day activa y refleja un defecto de diseño sistémico en AppleMediaServices.framework, más que una regresión o un error específico de una versión. Una falla crítica de tipo fail-op...

io.netty/netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack

A flaw was found in Netty. The OcspClient component fails to validate that the Certificate ID in an Online Certificate Status Protocol OCSP response matches the requested Certificate ID. This vulnerability allows a remote attacker to bypass certificate revocation checks by presenting a legitimate...

EUVD-2026-83734

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

CVE-2026-63405

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...