R2SAE

R2SAE - Exploitation automatique de React2Shell Une extension Firefox pour détecter et exploiter CVE-2025-55182 Vulnérabilité de pollution de prototype dans les actions de serveur React Fonctionnalités • Installation • Utilisation • Avertissement ⚠️ Avertissement Cet outil est destiné uniquement...

My-Presentation-Slides

My-Presentation-Slides شرائح العروض التقديمية العامة الخاصة بـ Orange Tsai. يمكنك التواصل معي عبر: المدوّنة: https://blog.orange.tw/ البريد الإلكتروني: [email protected] تويتر: @orange8361 2024 WorstFit: كشف المحوّلات الخفية في Windows ANSI! Black Hat Europe DEVCORE CONF 2025 هجمات الالتباس:...

JuicyPotatoNG

JuicyPotatoNG Ещё одна локальная эскалация привилегий в Windows от учётной записи службы до System. Подробности по ссылке -- https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/ Использование root@kitploit: JuicyPotatoNG by decoderit & splintercode Mandatory args: -t...

SQLRecon

SQLRecon SQLRecon est un toolkit Microsoft SQL Server conçu pour la reconnaissance offensive et la post-exploitation. Pour des informations détaillées sur l'utilisation de chaque technique, consultez le wiki. Vous pouvez télécharger une copie de SQLRecon depuis la page releases. Vous pouvez...

XSLeaker

XSLeaker XSLeaker est un outil qui aide à trouver des XS-Leaks sur des sites web. L'outil compare les valeurs de ressources pour lesquelles une technique de fuite est connue p. ex. le nombre d'iframes entre différents états. XSLeaker se compose de deux éléments : une extension Chrome utilisée pou...

CVE-2026-77002

The SmilePass Selfie Login WordPress plugin through version 1.0.2 lacks any server-side verification of the identity it is asked to authenticate. This allows unauthenticated users to log in as any registered account, including administrators , resulting in full compromise of confidentiality, inte...

ghe-push-option-rce-scanner

CVE-2026-3854 — RCE sur GitHub Enterprise Server via injection d'options push Aperçu Neutralisation incorrecte des valeurs d'options push dans GHE. Un attaquant disposant d'un accès push obtient une RCE sur l'instance...

CVE-2026-49360

Recce (a data-validation toolkit for dbt PR review) versions prior to 1.50.0 are vulnerable to unauthenticated SQL execution through the query run API when deployed with a DuckDB-backed project and exposed to an untrusted network without authentication. An attacker can leverage DuckDB filesystem ...

CVE-2022-36804-Bitbucket-RCE-Analysis

CVE-2022-36804: تنفيذ الأوامر عن بُعد في Bitbucket RCE تحليل تقني واستغلال مخبري لحقن وسائط البايت الفارغ Null-Byte Argument Injection ملخص الثغرة الأمنية CVE-2022-36804 هي ثغرة حقن وسائط Argument Injection بدرجة خطورة عالية/حرجة ضمن REST API الخاصة بخوادم Atlassian Bitbucket Server وData Center...

CVE-2025-24893-XWiki-SSTI-RCE

CVE-2025-24893 — تنفيذ الأكواد عن بُعد في XWiki عبر حقن القوالب SSTI نظرة عامة...

malvinci

malvinci Ce script simple introduit un nouveau type de malware qui désactivera le pare-feu, démarrera un serveur HTTP, transférera son port via ngrok et enverra l'URL du serveur via un bot Telegram. Vous devrez créer un nouveau bot Telegram. Suivez les étapes indiquées ici pour en créer un ⚡...

CVE-2026-53509

@aborruso/ckan-mcp-server (an MCP server for querying CKAN open data portals) is vulnerable to SSRF prior to version 0.4.106 . The validateServerUrl hostname check in src/utils/http.ts only blocked the literal string localhost, but hostname aliases such as ip6-localhost and ip6-loopback (defined ...

CVE-2026-53509 @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to...

CVE-2026-53509 @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to...

CVE-2026-62316

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/httpservers/linuxmcpserver.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An...

CVE-2026-50538

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with...

CVE-2026-50538 libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with...

CVE-2026-50538

LibVNCClient (part of the LibVNCServer project) versions 0.9.12 through 0.9.15 contain an out-of-bounds heap write in the Tight decoder . A malicious or man-in-the-middle VNC server can trigger this by sending a single crafted FramebufferUpdate message, writing attacker-controlled data past the e...

CVE-2026-50538 libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with...

CVE-2026-62316

Microsoft UFO (open-source intelligent automation framework) is vulnerable to a DNS rebinding attack in versions prior to 3.0.8 . The component ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to localhost:8010 without validating Host , Origin , or Sec-Fetch-...