CESS

CESS — Secreto de Shamir Encantado Criptológicamente ¿Esto es basura o chapuza de IA? Un criptógrafo o implementador serio que revise CESS normalmente abrirá vectors/ y testdata/ antes de leer prosa. El conjunto de pruebas es la prueba de trabajo: codifica conocimiento de dominio que no puede...

CVE-2018-14847

WinboxExploit Esta es una prueba de concepto de la vulnerabilidad crítica de WinBox CVE-2018-14847 que permite la lectura arbitraria de archivos de contraseñas en texto plano. Publicación del blog https://n0p.me/winbox-bug-dissection/ Requisitos Python 3+ Este script NO se ejecutará con Python 2....

CVE-2025-32463

CVE-2025-32463 Sudo में दुर्भावनापूर्ण nsswitch.conf के साथ sudo -R के माध्यम से स्थानीय विशेषाधिकार वृद्धि। प्रभावित संस्करण 1.9.14 – 1.9.17 📘 परिचय Sudo एक व्यापक रूप से उपयोग की जाने वाली कमांड-लाइन उपयोगिता है जो यूनिक्स-जैसी प्रणालियों पर अनुमति प्राप्त उपयोगकर्ताओं को बढ़े हुए विशेषाधिकारों...

n00bRAT

n00bRAT v0.7 إنه برنامج C صغير يحاكي خادم HTTP بالحد الأدنى من المتطلبات لتحديد بصمة الماسحات الأمنية fingerprinting security scanners. يسمح لك بالتحكم في الجهاز عبر هذا البروتوكول المزيف HTTPv0.1. تم إنشاء هذا الخادم n00b كأداة RAT أثناء الدراسة الجامعية لمقرر الاختراق الأخلاقي. ما هو / لماذا هو...

NodeGoat

NodeGoat Being lightweight, fast, and scalable, Node.js is becoming a widely adopted platform for developing web applications. This project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them. Getti...

strafer

Strafer Elasticsearch infections are rising exponentially. The adversaries are exploiting open and exposed Elasticsearch interfaces to trigger infections in the cloud and non-cloud deployments. During this talk, we will release a tool named "STRAFER" to detect potential infections in the...

ADCSPwn

ADCSPwn Una herramienta para escalar privilegios en una red de Active Directory mediante la coerción de autenticación de cuentas de máquina Petitpotam y la retransmisión al servicio de certificados. Uso Ejecuta ADCSPwn en tu red objetivo. root@kitploit: Author: @batsec - MDSec ActiveBreach...

CVE-2024-21413

CVE-2024-21413 - Critical Remote Code Execution Vulnerability in Microsoft Outlook Setup 1. Create a config.ini file in the same directory as the script with the following format: root@kitploit: emailcredentials senderemail = [email protected] senderpassword = yourapppassword smtpserver =...

-CVE-2021-26904

CVE-2021-26904 LMA ISIDA Retriever 5.2 allows SQL Injection Suggested description : "ISIDA RETRIEVER v5.2" SQL Injection Vulnerable functionality : ISIDA RETRIEVER Platform is vulnerable to SQL Injection Vulnerable URL and paramert : website.com/index.php?title=Injection Vulnerable URL and parame...

Resources-for-Application-Security

Publicación actualizada en https://ishaqmohammed.me/posts/resources-for-application-security/ Recursos para la Seguridad de Aplicaciones Algunos buenos recursos para comenzar con la seguridad de aplicaciones Nota: Los recursos que he puesto son aquellos que usaré en mis aprendizajes de seguridad ...

CVE-2024-29671-POC

NEXTU FLETA Wifi6 Router RCE Exploit POC This document describes how the CVE-2024-29671 vulnerability was exploited in the NEXTU FLATA AX1500 Router firmware. Execution Environment This router is based on the MIPS architecture using the Realtek chipset with Little-Endian. The target router firmwa...

Centry

Centry WARNING: THIS IS EXPERIMENTAL SOFTWARE. IT IS LIKELY TO CONTAIN BUGS. Updates If you have already installed Centry, please run git pull to update to the latest version. The latest updates make it much more secure against replay attacks. Introduction Centry is a panic button intended to...

CVE-2026-81521

A flaw was found in the MongoDB Go Driver. The Client.BulkWrite operation does not properly validate database names, allowing a specially crafted name with reserved characters to redirect write operations. This vulnerability could enable an attacker to modify or corrupt data in unintended databas...

CVE-2026-70354

A flaw was found in .NET. This vulnerability, caused by an out-of-bounds write, could allow an unauthorized attacker to execute code locally. Exploitation requires local access and user interaction, but if successful, it can lead to significant impact on the system's confidentiality, integrity, a...

CVE-2023-26255-6

Jira plugin STAGIL Navigation FileName Parameter Arbitrary File Read Vulnerability POC Script Usage as follows: Single URL Detection 1. Use the command line to detect a single URL, pass the URL parameter with -U 2. Observe the returned result; if it shows "is vulnerable!", then the vulnerability...

EUVD-2026-70410

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

CVE-2026-85175 SiYuan before v3.8.2 TLS Private Key Disclosure via getFile

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

CVE-2026-85175

SiYuan versions ≤ 3.8.1 contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go) that only blocks conf/conf.json by exact match but fails to restrict the TLS private key (conf/key.pem) and CA private key (conf/ca.key). Because the getFile handler skips the ...

EUVD-2026-70409

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access...

CVE-2026-85174 SiYuan before v3.8.2 API Token Exposure via Log File

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access...