lehack-2026-challenge

LeHack 2026 Challenge A 3-tier challenge demonstrating impact of direct disk mounting. Challenge Overview Level| Goal| Technique ---|---|--- 1| Access the unencrypted disk| Set boot cmdline to init=/bin/bash in grub 2| Crack vault1 LUKS| Extract header → hashcat → unlock & mount vault 3| Crack...

cryptoquant-key-gen

CryptoQuant Breaker v1.6 — 2026 Unlock CryptoQuant Premium Features | Advanced Analytics & Real-Time Data Access Description CryptoQuant Breaker is a powerful patcher utility designed to bypass CryptoQuant's advanced analytics tier restrictions and real-time data limits. Get unlimited access to...

EUVD-2026-103289

Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares...

FolkPatch

🌏 README Language: English / 中文 / 日本語 FolkPatch - A Root management tool focused on interface optimization and feature extension Built on KernelPatch, FolkPatch delivers a stable Root experience along with a brand-new interface and a three-tier extension system: APM / KPM / Plugins. Get started...

soc-analyst-hub

🛡️ SOC Analyst Hub — Tier 1 Toolkit A free, fully offline interactive toolkit for Tier 1 SOC analysts — covering incident response, alert triage, threat hunting, and analyst onboarding. Zero dependencies. Single HTML file. Open in any browser. 🚀 Live Demo → 📦 What's Inside ⚡ Incident Response...

http-oracle-ebs-cve-2025-61882.nse

http-oracle-ebs-cve-2025-61882.nse Detects Oracle E-Business Suite CVE-2025-61882. Detection: multi-tier checks — fingerprinting, version checks, endpoint & SSRF tests, timing analysis & controlled exploitation 4 high-confidence results. Default = safe fingerprinting only. Set aggressive=true 2...

DDoS-Purple-Teaming-Offensive-Multi-Vector-7-Tier-Defensive-Holistic-Blueprint-

= doi.org/10.5281/zenodo.18287026 = orcid.org/0009-0007-7728-256X Project: DDoS Purple Elite Teaming Exhaustive Analysis 2026 Author: SASTRAADIWIGUNA PurpleEliteTeaming ⚠️ MANDATORY LEGAL DISCLAIMER This repository and its documentation are strictly for educational, defensive, and authorized...

ejbca-pqc-lab

EJBCA Pure PQC Lab — ML-DSA-65 Two-Tier PKI Hierarchy A hands-on implementation of NIST FIPS 204 ML-DSA in a two-tier PKI hierarchy using EJBCA Community Edition. 📖 Full walkthrough: Building a Post-Quantum PKI: How I Signed a Root CA and Sub CA Using ML-DSA on EJBCA What This Lab Builds A comple...

CVE-2026-107636

pH7Builder pH7 Social Dating CMS before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set itemnumber, cartorderid, or the PayPal custom field while...

CVE-2026-107636

The pH7Builder (pH7 Social Dating CMS) application before version 18.5.1 is vulnerable to a payment validation bypass within the Payment Module MainController . This flaw allows registered low-privileged members to gain access to any membership tier by manipulating client-controlled fields such a...

EUVD-2026-95023

pH7Builder pH7 Social Dating CMS before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set itemnumber, cartorderid, or the PayPal custom field while...

CVE-2026-107636 pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController

pH7Builder pH7 Social Dating CMS before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set itemnumber, cartorderid, or the PayPal custom field while...

CVE-2026-107636: External Control of Assumed-Immutable Web Parameter

pH7Builder pH7 Social Dating CMS before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set itemnumber, cartorderid, or the PayPal custom field while...

PT-2026-107995

pH7Builder pH7 Social Dating CMS before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item number, cart order id, or the PayPal custom field...

EUVD-2026-93404

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...

CVE-2026-106041: Missing Authorization

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...

PT-2026-106745

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCAL DISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replic...

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block

Summary /api/block/getRefIDs filters its results for reader roles through a helper that checks only the visibility tiers. The password tier is not checked, because the helper does not receive the request context and therefore cannot evaluate the publish auth cookie. A reader who has not entered a...

CVE-2026-101047

Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests enterprise tier only with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet...

CVE-2026-101047 Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs

Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests enterprise tier only with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet...