Bastillion

Bastillion A modern, web-based SSH console and SSH key management tool. Bastillion gives you a clean, browser-based way to manage SSH access across all your systems — like a bastion host with a friendly dashboard. It does two things: 1. Web-based SSH terminal — once a host is registered, authoriz...

CVE-2016-6271

CVE-2016-6271 CVE-2016-6271 impacts libbzrtp, which is a ZRTP library developped by Belledonne Communications. This library is embedded in end-user applications, for example linphone, which is available as an Android app on Play store. Current version 3.2.7 embeds a version of libbzrtp shall not ...

ja4

JA4+™ Network Fingerprinting JA4+ is a suite of network fingerprinting methods by FoxIO that are easy to use and easy to share. These methods are both human and machine readable to facilitate more effective threat-hunting and analysis. The use-cases for these fingerprints include scanning for...

FakeAuth

FakeAuth FakeAuth is a tool that prompts for user credentials and exfiltrates it with HTTP protocol. Inspired by following projects 1. hlldz's PICKL3 https://github.com/hlldz/pickl3 Expect dirty code and some bugs ; Installation No special requirements Usage v1.01 Usage: FakeAuth.exe Example:...

bucky

Bucky An S3 account ID enumeration and bucket discovery tool Given a single accessible S3 bucket, bucky extracts the 12-digit AWS account ID that owns it, then discovers additional buckets belonging to the same account by fuzzing bucket names against a wordlist — all in one command. What It Does ...

pgaudit

pgAudit Open Source PostgreSQL Audit Logging Introduction The PostgreSQL Audit Extension pgAudit provides detailed session and/or object audit logging via the standard PostgreSQL logging facility. The goal of pgAudit is to provide PostgreSQL users with capability to produce audit logs often...

enum4linux-ng

enum4linux-ng A next generation version of enum4linux enum4linux-ng.py is a rewrite of Mark Lowe's former Portcullis Labs now Cisco CX Security Labs enum4linux.pl, a tool for enumerating information from Windows and Samba systems, aimed for security professionals and CTF players. The tool is main...

BloodHound

BloodHound is a monolithic web application composed of an embedded React frontend with Sigma.js and a Go based REST API backend. It is deployed with a Postgresql application database and a Neo4j graph database, and is fed by the SharpHound and AzureHound data collectors. BloodHound leverages grap...

openclaw-dashboard

OpenClaw Agent Dashboard A beautiful, secure, real-time monitoring dashboard for OpenClaw agents. Track sessions, monitor API usage, view costs, manage memory files, and keep tabs on system health - all in one place. Screenshots Overview| Sessions| Costs ---|---|--- | | Rate Limits| Live Feed| Lo...

CVE-2026-41940_exploit

============================================================================= CVE-2026-41940 - cPanel & WHM Authentication Bypass Exploit Vulnerability: Session-file manipulation through CRLF injection in cpsrvd's HTTP Basic authentication handler CVE: CVE-2026-41940 CVSS: 9.8 Critical CWE: CWE-9...

CVE-2026-85967

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to a cross-site scripting (XSS) vulnerability. A remote attacker could execute scripts within the browser session of an authenticated user, potentially leading to the disclosure of information or the perfo...

heartbleed

Heartbleed Bug Description of the scenario The Heartbleed bug is an example of a cybersecurity attack that exploits a vulnerability in the OpenSSL library. Briefly, a missing validation step in the OpenSSL library could allow a hacker to access sensitive information on a server that is using the...

CVE-2026-36669-FengOffice

Security Advisory: CVE-2026-36669 Unauthenticated Arbitrary File Upload in Feng Office Community Edition An unauthenticated arbitrary file upload vulnerability exists in ckuploadhandler.php in Feng Office Community Edition version 3.11.13.11. This flaw allows remote, unauthenticated attackers to...

soplanning-1.52-exploits

Exploit Title: SOPlanning v1.52.00 'groupesave.php' XSS Reflected XSS Application: SOPlanning Version: 1.52.00 Date: 4/22/24 Exploit Author: Joseph McPeters Liquidsky Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/ Tested on: Linux CVE:...

CVE-2024-44000

EN GenCookieSessionHijack is a PoC tool designed to exploit insecurely exposed debug logs from WordPress sites and extract session cookies. This allows the attacker to hijack active admin sessions and gain unauthorized access to the WordPress admin dashboard. Features Extract cookies from WordPre...

CVE-2026-109373

ZITADEL versions 3.0.0 before 4.19.2 are vulnerable to an authentication bypass in the Login V2 UI . The root cause allows unauthenticated attackers to forge unsigned session cookies by guessing time-ordered session IDs near a victim's sign-in. By supplying these IDs with empty tokens, attackers ...

EUVD-2026-97671

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them wi...

CVE-2026-109352

LibreNMS versions prior to 26.9.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability located in includes/html/pages/device/wireless.inc.php. The root cause is the lack of proper output escaping when the application echoes sensor_descr values, which are populated from SNMP Display...

EUVD-2026-97654

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensordescr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored...

CVE-2026-109320

The Grav API plugin (grav-plugin-api) version before 1.0.36 is vulnerable to an improper session validation flaw. The root cause is that the SessionAuthenticator fails to enforce account state, allowing users with disabled accounts to maintain API access. Attackers or unauthorized users can reuse...