CVE-2026-105064

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Parameter Injection.This issue affects Unlimited Elements For Elementor Fre...

CVE-2026-105064

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Parameter Injection.This issue affects Unlimited Elements For Elementor Fre...

CVE-2026-105064 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.22 - Broken Access Control vulnerability

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Parameter Injection.This issue affects Unlimited Elements For Elementor Fre...

CVE-2026-72887

A flaw was found in Net::OAuth::Client. A malicious service provider can silently downgrade an OAuth 1.0a connection to OAuth 1.0 by omitting the oauthcallbackconfirmed parameter in the request token response. This downgrade vulnerability removes the oauthverifier binding, making the application...

targetedKerberoast

targetedKerberoast targetedKerberoast は、他の多くのツール（例: GetUserSPNs.py）と同様に、SPN が設定されたユーザーアカウントの「kerberoast」ハッシュを出力できる Python スクリプトです。 このツールには以下の追加機能があります。SPN を持たない各ユーザーに対して、SPN を設定しようと試み（servicePrincipalName 属性への書き込み権限の悪用）、その「kerberoast」ハッシュを出力し、その操作のために設定された一時的な SPN を削除します。これは Targeted Kerberoastin...

templates

报告模板 目录结构说明： 脚本 generate-directories.py 从 GitHub 获取当前最新版本的 VRT 结构，并创建任何缺失的目录。不会根据从 VRT 中移除的项目来删除或重命名目录。 脚本遵循标准条目名称，并保留 VRT id 字段提供的下划线 / 大小写。 使用此仓库 此仓库启用了“受保护的主分支（Protected Master）”；这意味着只有项目管理员才能通过 Pull Request 提交到 master 分支。所有更新都需要通过 pull request 来进行，以确保完整性。 以下内容假定 SSH 访问已正确配置。 首先，检出 master 分支：...

CVE-2023-46017-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability

CVE-2023-46017-Code-Projects血库1.0 SQL注入漏洞 漏洞利用作者：ersinerenler 厂商主页 https://code-projects.org/blood-bank-in-php-with-source-code 软件链接 https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip 概述...

CVE-2025-57819-POC

CVE-2025-57819 — FreePBX SQL 注入 → RCE PoC CVE-2025-57819 是 FreePBX 中的一个严重 SQL 注入漏洞，未认证的攻击者可通过将 SQL 注入与 cron 任务注入相结合来实现远程代码执行。 ⚠️ 免责声明 ：本仓库仅用于授权安全测试和教育目的。未经授权对你不拥有或未获得明确测试许可的系统使用此漏洞利用程序属于违法行为。作者不对任何滥用或损害负责。 漏洞概述 字段| 详情 ---|--- CVE| CVE-2025-57819 受影响产品| FreePBX（认证前） 漏洞类型| SQL 注入（堆叠查询） 影响| 远程代码执行 RC...

modifyCertTemplate

目的 このツールは、オペレーターがADCS証明書テンプレートを変更し、作成された脆弱な状態を特権昇格に利用できるようにする（その後、テンプレートを以前の状態にリセットする）ことを支援するために設計されています。これは、テンプレートに対するWriteProperty権限が侵害されたが、オペレーターがその権限がどのプロパティに適用されるか不明なシナリオ向けに特別に設計されています。このシナリオでは、テンプレートのACLをクエリし、該当するACE情報をプロパティGUIDと照合することで、変更可能なプロパティを特定できます。 関連するブログ記事（ツールとトピックについて） 使用方法 usage:...

fortress

One browser engine to rule them all Stealth Chromium engine · v3 Chromium 153 Fortress is a stealth Chromium engine that stops your scrapers and browser agents from getting blocked, with one line of code change. Bot detectors flag automation by reading the browser fingerprint; Fortress corrects...

CVE-2026-57827

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE Overview CVE-2026-57827 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in RSFiles! comrsfiles, a widely...

Pachine

Pachine 针对 CVE-2021-42278（Active Directory 权限提升）的 Python 实现。 安装 $ pip3 install impacket 用法 Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation usage: pachine.py -h -scan -spn SPN -impersonate IMPERSONATE -domain-netbios NETBIOSNAME -computer-name NEW-COMPUTER-NAME$ -computer-pass password...

uro

uro Using a URL list for security testing can be painful as there are a lot of URLs that have uninteresting/duplicate content; uro aims to solve that. It doesn't make any http requests to the URLs and removes: incremental urls e.g. /page/1/ and /page/2/ blog posts and similar human written conten...

CVE-2020-26217-XStream-RCE-POC

CVE-2020-26217-XStream-RCE-POC 示例 package org.example; import com.thoughtworks.xstream.XStream; import java.io.IOException; public class CVE202026217 public static void mainString args throws IOException XStream xStream = new XStream; String payload = "\n" + " \n" + " \n" + " 0\n" + " \n" + " \n"...

gftrace

gftrace A command line Windows API tracing tool for Golang binaries. Note: This tool is a PoC and a work-in-progress prototype so please treat it as such. Feedbacks are always welcome! How it works? Although Golang programs contains a lot of nuances regarding the way they are built and their...

ai-tool-poisoning-guard

ai-tool-poisoning-guard Minimum security-baseline rule for Claude Code, Codex, and Cursor. This free rule closes a real gap in each tool's built-in review. Full ruleset + implementation guide: Gumroad link — coming soon. Your AI coding assistant reviews code. It doesn't review the sentence that...

heartbleedscanner

Heartbleed Scanner Network Scanner for OpenSSL Memory Leak CVE-2014-0160 -t parameter to optimize the timeout in seconds. -f parameter to log the memleak of vulnerable systems. -n parameter to scan entire network. -i parameter to scan from a list file. Useful if you already have targets. -r...

restler-fuzzer

RESTler What is RESTler? RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services. For a given cloud service with an OpenAPI formerly Swagger specification, RESTler analyzes its...

graphw00f

Credits to Nick Aleks for the logo! graphw00f - GraphQL Server Fingerprinting Table of Contents How does it work? Detections GraphQL Threat Matrix Prerequisites Installation Configuration Example Usage Fingerprinting GraphQL Detecting & Fingerprinting GraphQL Support & Issues Resources How does i...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...