CVE-2024-10586

CVE-2024-10586 Debug Tool = 2.2 - Nicht authentifizierte beliebige Dateierstellung Beschreibung: Das Debug Tool Plugin für WordPress ist anfällig für die Erstellung beliebiger Dateien aufgrund einer fehlenden Berechtigungsprüfung in der Funktion dbtpullimage und einer fehlenden Dateityp-Validieru...

CVE-2022-0543

CVE-2022-0543 Exploit completo per RCE su Redis tramite la vulnerabilità di fuga dalla sandbox Lua. Basato su https://thesecmaster.com/how-to-fix-cve-2022-0543-a-critical-lua-sandbox-escape-vulnerability-in-redis/. Caratteristiche: Reverse shell automatica -I + -P Esecuzione di un singolo comando...

anew

anew Aggiunge righe da stdin a un file, ma solo se non sono già presenti nel file. Invia anche le nuove righe a stdout, rendendolo un po' come un tee -a che rimuove i duplicati. Esempio di utilizzo Qui, un file chiamato things.txt contiene un elenco di numeri. newthings.txt contiene un secondo...

unfurl

unfurl Estrai le parti degli URL forniti su stdin Installazione Se hai Go installato e configurato: root@kitploit: ▶ go install github.com/tomnomnom/unfurl@latest Altrimenti scarica l'ultimo binario per la tua piattaforma, estrailo e spostalo da qualche parte nel tuo $PATH es. /usr/bin/:...

unfurl

unfurl Pull out bits of URLs provided on stdin Install If you have Go installed and configured: root@kitploit: ▶ go install github.com/tomnomnom/unfurl@latest Otherwise download the latest binary for your platform, extract it and move it to somewhere in your $PATH e.g. /usr/bin/: root@kitploit: ▶...

chaostoolkit

Chaos Toolkit - Chaos Engineering für alle Ingenieure...

rebuff

Rebuff.ai Selbsthärtender Prompt-Injection-Detektor Rebuff wurde entwickelt, um KI-Anwendungen durch eine mehrschichtige Verteidigung vor Prompt-Injection-Angriffen PI zu schützen. Playground • Discord • Funktionen • Installation • Erste Schritte • Selbsthosting • Mitwirken • Dokumentation...

wapiti

Wapiti - Scanner di vulnerabilità web .. image:: https://img.shields.io/pypi/v/wapiti3?label=PyPI&logo=PyPI&logoColor=white&color=blue :alt: PyPI version :target: https://pypi.python.org/pypi/wapiti3 .. image:: https://img.shields.io/pypi/pyversions/wapiti3 :alt: Supported Python versions :target...

chainsaw

Schnelles Suchen und Jagen durch Windows-Forensik-Artefakte Chainsaw bietet eine leistungsstarke „First-Response“-Fähigkeit, um Bedrohungen in Windows-Forensik-Artefakten wie Ereignisprotokollen und der MFT-Datei schnell zu identifizieren. Chainsaw bietet eine generische und schnelle Methode zum...

CloudHunter

Dieses Repository hat keine README-Datei...

SnaffPoint

SnaffPoint Cos'è SnaffPoint è uno strumento per i penetration tester che hanno bisogno di un po' di dolcezza in questo mondo. Dovrebbe aiutarti a trovare file sensibili disponibili su SharePoint online e su file OneDrive condivisi per la tua azienda o per il tuo cliente. Come funziona Ci sono in...

CVE-2026-59809

SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the httprequest MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values t...

CVE-2026-60083

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access othe...

EUVD-2026-64268

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access othe...

CVE-2026-60083 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access othe...

CVE-2026-60083

SiYuan versions before v3.8.0 have an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files normally protected by the HTTP API. An authenticated administrator can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and acc...

CVE-2026-60083 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access othe...

CVE-2026-59809 SiYuan before v3.8.0 Secret Exfiltration via http_request URL

SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the httprequest MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values t...

CVE-2026-59809

SiYuan before v3.8.0 is affected by a secret exfiltration vulnerability in the http_request MCP tool . The tool interpolates secret placeholders into the destination URL parameter, meaning an MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send pla...

CVE-2026-59809 SiYuan before v3.8.0 Secret Exfiltration via http_request URL

SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the httprequest MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values t...