cottage

cott age es una herramienta GitOps para equipos que gestionan secretos cifrados con age en repositorios git. Proporciona un flujo de trabajo sencillo para cifrar/descifrar secretos, gestionar destinatarios y mantener los secretos fuera del repositorio, permitiendo al mismo tiempo compartirlos...

masta-cve-2026-48907

Escáner MASTA CVE-2026-48907 Escáner de archivo único y autónomo para Joomla! JCE Editor Autor: Hussein Mohamed masta ghimau !CAUTION 🚨 DESCARGO DE RESPONSABILIDAD — LEA ANTES DE USAR ESTA ES UNA HERRAMIENTA DE PRUEBAS DE SEGURIDAD INTRUSIVA. root@kitploit: THIS TOOL IS FOR AUTHORIZED SECURITY...

CVE-2021-46422

CVE-2021-46422 SDT-CW3B1 South Korean wireless router OS cmd injection PoC Installation root@kitploit: git clone https://github.com/ZAxyr/CVE-2021-46422.git cd CVE-2021-46422 pip3 install -r requirements.txt Usage Single URL pocsuite -r pocs/CVE-2021-46422.py -u IP Batch URLs pocsuite -r...

grepmarx

Grepmarx - 应用安全平台 Grepmarx 是一个 Web 应用程序，提供单一平台，用于快速理解、分析并识别可能庞大且未知的代码库中的漏洞。 功能 SAST（静态分析安全测试）能力： 多语言支持：C/C++、C、Go、HTML、Java、Kotlin、JavaScript、TypeScript、OCaml、PHP、Python、Ruby、Bash、Rust、Scala、Solidity、Terraform、Swift 多框架支持：Spring、Laravel、Symfony、Django、Flask、Node.js、jQuery、Express、Angular…… 1600+...

seccubus

About Seccubus Seccubus automates regular vulnerability scans with various tools and aids security people in the fast analysis of its output, both on the first scan and on repeated scans. On repeated scan delta reporting ensures that findings only need to be judged when they first appear in the...

CVE-2026-94113

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain a missing authorization vulnerability in three whitelisted timesheet endpoints (get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet) that fail to enforce doctype permissions. An authenticated attacker...

CVE-2023-34039

CVE-2023-34039 POC para CVE-2023-34039 VMWare Aria Operations for Networks vRealize Network Insight RCE por clave SSH estática Análisis técnico Puede encontrar un análisis de causa raíz de la vulnerabilidad en mi blog: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-34039...

CVE-2026-94113 Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

EUVD-2026-83735

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

CVE-2026-94112

mayswind ezBookkeeping versions before 2.0.0 contain a TOTP replay attack vulnerability: the application fails to invalidate one-time passcodes after use. An attacker with stolen credentials can replay a captured TOTP code against multiple authorization attempts within the ~90-second acceptance w...

CVE-2025-51586-PrestaShop-PoC

CVE-2025-51586 - PrestaShop AdminLogin Email Enumeration PoC 📌 Overview This repository contains an ethical Proof-of-Concept PoC for the vulnerability CVE-2025-51586, affecting PrestaShop versions 1.7.x — 8.2.2. The PoC enumerates administrator email addresses via the Back Office password reset...

EUVD-2026-83734

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

kratos

聊天 · 讨论 · 新闻邮件 · 文档 · 试用Ory Network · 工作机会 Ory Kratos 是一个面向云原生应用的 API 优先身份与用户管理系统。它将登录、注册、恢复、验证和配置文件管理流程集中起来，让你的服务可以直接使用它们，而无需重新实现。 目录 什么是 Ory Kratos？ 为什么选择 Ory Kratos 从 Auth0、Okta 及类似提供商迁移 部署选项 在 Ory Network 上使用 Ory Kratos 自托管 Ory Kratos 快速开始 谁在使用它？ 什么是 Ory Kratos？ Ory Kratos 是一个遵循 云架构最佳实践 的 API...

loboguara

Lobo Guará - Cyber Threat Intelligence Platform Lobo Guará is a platform aimed at cybersecurity professionals, with various features focused on Cyber Threat Intelligence CTI. It offers tools that make it easier to identify threats, monitor data leaks, analyze suspicious domains and URLs, and much...

CVE-2022-0185-Analysis-and-Exploit

CVE-2022-0185-Análisis-y-Exploit Investigación y prueba de concepto para la vulnerabilidad de desbordamiento de montón del kernel Linux CVE-2022-0185. CVE-2022-0185 – Análisis de Desbordamiento de Montón del Kernel Linux Resumen CVE-2022-0185 es una vulnerabilidad de desbordamiento de búfer basad...

CVE-2026-66066-POC

PoC para CVE-2026-66066 - Laboratorio mínimo de stock Rails/libvips Este repositorio reproduce la cadena de lectura-de-archivo-a-RCE de Rails Active Storage descrita en GHSA-xr9x-r78c-5hrm contra Rails 8.1.3, la versión afectada más reciente de Rails 8.1. Rails 8.1.3.1 es el control parcheado...

Awesome-BEC

Awesome-BEC Repositorio de información de ataque y defensa para investigaciones de Business Email Compromise Office365/AzureAD ATT&CK O365 ATT&CK Azure Microsoft Azure Threat Research Matrix Microsoft 365 Licensing Microsoft Portals Azure App IDs Microsoft First Party App IDs & Graph Permissions...

awesome-edr-bypass

Awesome EDR Bypass 🛡️ Awesome EDR Bypass 资源，面向道德黑客 ⚔️ EDR 绕过技术并非仅为攻击者所用。如今许多恶意软件已具备 EDR 绕过能力，渗透测试人员和事件响应者也应了解这些知识。本仓库不应用于升级攻击，请用于道德黑客攻防。 PoC trickster0/TartarusGate: TartarusGate, 绕过 EDRs am0nsec/HellsGate: Hell's Gate VX 技术的原始 C 实现 该 PDF 论文提供了 EDR 绕过技术的精彩总结。 Maldev-Academy/HellHall: 执行间接干净系统调用...

CVE-2024-51428-PoC

CVE-2024-51428 - PoC de Inyección SQL Ciega en ZoneMinder Wrapper de Python para sqlmap diseñado para explotar CVE-2024-51428 en ZoneMinder. Esta herramienta automatiza la detección y explotación de una inyección SQL ciega , manteniendo una salida limpia y centrada en los datos útiles. El script...