phishurl-list

Phishing URL dataset from JPCERT/CC Column details date: Date confirmed by JPCERT/CC URL: Entire URL of a phishing site description: Information on a spoofed brand Statistics page https://jpcertcc.github.io/phishurl-list/...

CarbonCopy

CarbonCopy A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux Prerequisites In order to use it on Linux, please execute commands below: apt-get install osslsigncode pip3 install pyopenssl...

CVE-2020-0601-spoofkey

CVE-2020-0601-spoofkey To see how to Make Spoofed Key and Signing the code REQ: openssl, main.rbwhich i uplaoded VISIT : https://twitter.com/exploitblizzard...

EvilSlackbot

EvilSlackbot A Slack Attack Framework for conducting Red Team and phishing exercises within Slack workspaces. Disclaimer This tool is intended for Security Professionals only. Do not use this tool against any Slack workspace without explicit permission to test. Use at your own risk. Background...

dnspooq

dnspooq DNSpooq PoC - dnsmasq cache poisoning CVE-2020-25686, CVE-2020-25684, CVE-2020-25685 For educational purposes only Requirements Docker compose Docker Exploit Launch containers $ docker-compose up -d Run exploit.py $ docker-compose exec attacker bash bash-5.0 python exploit.py Querying...

wifi-deauth

A DoS attack that disconnects all devices from a target wifi network. The network's password is not required Tested on Kali NetHunter Snapshot at the bottom IMPORTANT In some occasions, network APs might operate on both 5GHz and 2.4GHz under the same BSSID/SSID name. In order to truly bring the A...

CVE-2024-30850-chaos-rat-rce-poc

https://github.com/chebuya/CVE-2024-30850-chaos-rat-rce-poc/assets/146861503/ac03c8c7-54b3-4280-9f29-719c44af5192 CHAOS RAT v5.01 web panel RCE CVE-2024-30850, CVE-2024-31839 https://github.com/tiagorlampert/CHAOS This exploit works by spoofing an agent callback for an XSS CVE-2024-31839, and...

Apache CloudStack - SAML Signature Exclusion

The CloudStack SAML authentication disabled by default does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response...

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Impact In Echo v5, ExtractIPFromRealIPHeader checked whether the address supplied in X-Real-IP belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by c.RealIP with the...

CVE-2026-79980 Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS

The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier iface-config.dhcpv4.xid as a counter rather than as a per-transaction random value. It was seeded once with sysrand32get in dhcpv4startinternal, incremented by one in dhcpv4senddiscover and dhcpv4senddecline...

CVE-2026-79980

The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c contains a vulnerability where the transaction identifier (xid) is maintained as a predictable counter rather than a per-transaction random value. Because this identifier is the only unpredictable reply-validation token, an attacker observing a ...

CVE-2026-114395

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

CVE-2026-114395 Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

EUVD-2026-107242

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

CVE-2026-114395

Trudesk versions through 1.2.11 are vulnerable to an authorization bypass in the apiMessages.send function. This issue stems from an incomplete fix for CVE-2022-1931, allowing authenticated users to supply arbitrary owner and cId values via a POST request to /api/v1/messages/send. Consequently, a...

CVE-2026-114395 Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

CVE-2026-114395 Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

PT-2026-120582

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...

EUVD-2026-102199

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...