208 matches found
Lock-Picking-Robot
🔑 Unlocked 🔑 Introduction Background An open source Lock picking robot. Basically, there are many skeleton keys in use the most common example is the TSA 007, which is bad. Having one key which can open MANY different locks, especially without the lock owners people knowing it exists or can be...
zBang
zBang is a special risk assessment tool that detects potential privileged account threats in the scanned network. Organizations and red teamers can utilize zBang to identify potential attack vectors and improve the security posture of the network. The results can be analyzed with the graphic...
WindowsPatchDetector
Experimental Windows .text section Patch Detector ====================== Experimental: Windows .text section compare - disk versus memory Original Idea After reading about the Skeleton Key malware http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/ develop ...
CVE-2026-92805
CVE-2026-92805 UVdesk unauth wizard super-admin POC UVdesk Community Skeleton through 1.1.8 — installation wizard XHR ConfigureHelpdesk has no authentication and no install-state check. An unauthenticated caller can rewrite DATABASEURL and create a ROLESUPERADMIN. There is no public patched tag...
Exploit for CVE-2026-92805
CVE-2026-92805 UVdesk unauth wizard super-admin POC UVdesk Co...
CVE-2026-92805
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...
CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...
CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...
EUVD-2026-81065
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...
CVE-2026-92805
UVdesk Community Skeleton through version 1.1.8 suffers from missing authentication and installation-state validation on wizard endpoints within ConfigureHelpdesk controller actions. An unauthenticated attacker can submit crafted requests to these wizard endpoints to repoint the database and crea...
CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...
CVE-2026-92805: Missing Authentication for Critical Function
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...
PT-2026-94079
Name of the Vulnerable Software and Affected Versions UVdesk Community Skeleton versions prior to 1.1.9 Description The software fails to authenticate or validate the installation state on wizard endpoints within the ConfigureHelpdesk controller actions. This allows unauthenticated attackers to...
Malicious code in dolyame-ui-skeleton (npm)
Source: amazon-inspector 340d04c991fde57848574728e622b6f4c3b1d2e7dcd061e590c4da91bbc6f12d Package advertises itself as a visual/UI components library but ships a load-time binary dropper. index.js unconditionally requires./vendor.js, which on require downloads a platform-specific binary from...
Malicious code in ads-skeleton (npm)
--- Credit: OpenSSF source...
CVE-2026-81093
The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...
CVE-2026-81093
Apify Actors MCP Server before version 0.9.12 is vulnerable to Server-Side Request Forgery (SSRF) via the get-html-skeleton tool. The URL validation function (isValidHttpUrl) in src/utils/generic.ts confirmed only that the argument began with an http/https scheme and parsed as a URL, without insp...
EUVD-2026-67148
The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...
CVE-2026-81093 Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton
The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...
CVE-2026-81093
The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...