sparta

This is a network infrastructure penetration testing tool called SPARTA. It is a Python GUI application that simplifies the scanning and enumeration phase of penetration testing by providing point-and-click access to various tools and displaying all tool output in a convenient way. The tool...

discover

This is a collection of custom bash scripts used to automate various penetration testing tasks, including reconnaissance, scanning, enumeration, and malicious payload creation using Metasploit. The scripts are designed to be used with Kali Linux. The scripts are organized into several categories,...

Obsidian-framework

Obsidian Framework 🛡️ An advanced, template-driven se...

PT-2025-39388

⚠️ Critical Alert – CVE-2025-78901 • Zero-day in Telerik UI library actively exploited 🚨 • Affects thousands of .NET web apps 2025.3.1 • Mass scanning and ransomware attempts underway • Action: Patch immediately! CyberSecurity ZeroDay Telerik PatchNow NewTalics...

CVE-2025-10894

Malicious code was inserted into the Nx build system package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo...

CVE-2025-10894

Malicious code was inserted into the Nx build system package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo...

Malicious Package

Overview asyncprintln is a malicious package. Two malicious Rust crates, fasterlog impersonates the legitimate fastlog library and asyncprintln attempt to scan source files for Quoted Ethereum private keys 0x + 64 hex, Solana-style Base58 secrets and Bracketed byte arrays to later exfiltrate...

xss.yaml

It is an offensive tool for web application security testing. Th...

Static Security Vulnerability Scanning of Proprietary and Open-Source Software: an Adaptable Process with Variants and Results

Software vulnerabilities remain a significant risk factor in achieving security objectives within software development organizations. This is especially true where either proprietary or open-source software OSS is included in the technological environment. In this paper an end-to-end process with...

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Sudo_Project Sudo

🚀 CVE-2025-32463 - Secure Your System from Privilege Escalatio...

Introducing Enhanced User Interface for Qualys PCI DSS 4.0 ASV Compliant Solution

We’re excited to introduce the new Qualys PCI ASV user interface, built to deliver a smarter, faster, and more intuitive experience. The redesigned PCI ASV UI helps you simplify PCI DSS 4.0 compliance, save time, and reduce audit-related stress. This major update improves usability, streamlines...

Fedora 41 : lemonldap-ng (2025-67d99d2c39)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-67d99d2c39 advisory. See https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-21-3-is-out/ Tenable has extracted the preceding description block directly from the Fedora...

GHSA-4VR7-G93G-CF6M Duplicate Advisory: Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m4j5-5x4r-2xp9. This link is maintained to preserve external references. Original Description An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314...

CVE-2025-10156

CVE-2025-10156 concerns the ZIP archive scanning component of mmaitre314 picklescan. The issue is an improper handling of exceptional conditions: crafting a ZIP with a file having a bad CRC can cause the scanner to halt analysis of contents, leading to a file marked as safe being loaded and the e...

SemiAutoPenTestingTool

It is an offensive tool for network exploitation. This repositor...

XOffense: an AI-Driven Autonomous Penetration Testing Framework with Offensive Knowledge-Enhanced LLMs and Multi Agent Systems

This work introduces xOffense, an AI-driven, multi-agent penetration testing framework that shifts the process from labor-intensive, expert-driven manual efforts to fully automated, machine-executable workflows capable of scaling seamlessly with computational infrastructure. At its core, xOffense...

Exploit for CVE-2025-12654

AnyDesk Exploit AnyDesk, remote access software, has faced se...

LFISuite

This repository is an offensive tool for Local File Inclusion LFI exploitation and scanning. It is primarily used to exploit LFI vulnerabilities in web applications, allowing an attacker to access sensitive files and potentially gain unauthorized access to a system. The tool, called LFI Suite,...

PocCollect

This repository is an offensive tool for vulnerability scanning and exploitation, specifically targeting various web applications and services. The primary vulnerability class targeted is SQL injection, with specific examples of exploits for Struts2, 08CMS, and ASPCMS. The tool is written in Pyth...

AutoRDPwn

This is a post-exploitation framework called AutoRDPwn, written in PowerShell. It is designed to automate the Shadow attack on Microsoft Windows computers, which allows a remote attacker to view and control the victim's desktop without their consent. The framework has a user-friendly interface an...