CVE-2024-42657

CVE-2024-42657 CVE-2024-42657 An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login process. CVE-2024-42657: Summary: A vulnerability in the wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0...

gxdlmsdirector-cve

Multiple vulnerabilities in Gurux GXDLMS Director – remote code execution Gurux GXDLMS Director is an open-source Windows program for interacting with energy meters through the use of DLMS/COSEM protocol. The software has a remote update functionality for add-in DLLs as well as for files containi...

CVE-2025-56513-NiceHash-Update-Chain-Compromise

CVE-2025-56513 Critical Supply-Chain Vulnerability in NiceHash QuickMiner Update Mechanism Author: Prince T Philip Role: Independent Security Researcher Severity: CRITICAL — CVSS 9.8 Impact: Remote Code Execution / Supply-Chain Compromise Status: Publicly Disclosed & Assigned CVE-2025-56513...

CVE-2024-48955_Overview

CVE-2024-48955Overview Description: Netadmin 4 IAM with access control flaws. Affected version: V4.030319 NetAdmin system returns data with functionalities in the endpoint that "builds" the functionality menus; the response of this call is not encrypted, and as the system does not validate sessio...

TYPO3-v7.6.15-Unencrypted-Login-Request

TYPO3-v7.6.15-Unencrypted-Login-Request TYPO3 v7.6.15 Unencrypted Login Request Assigned CVE Number: CVE-2017-6370...

CVE-2022-27254

CVE-2022-27254 PoC for vulnerability in Honda's Remote Keyless SystemCVE-2022-27254 Disclaimer: For educational purposes only. Kindly note that the discoverers for this vulnerability are Ayyappan Rajesh, a student at UMass Dartmouth and HackingIntoYourHeart. Others mentioned in this repository ar...

iOSRestrictionBruteForce

iOS Restriction Passcode Brute Force Overview This version of the application is written in Python, which is used to crack the restriction passcode of an iPhone/iPad takes advantage of a flaw in unencrypted backups allowing the hash and salt to be discovered. DEPENDENCIES This has been tested wit...

bd-alaris-firmware-analysis

BD Alaris 8015 Firmware Security Analysis Firmware Security Analysis of the BD Alaris 8015 PC Unit: Unencrypted Wi-Fi Credential Storage and Compound Vulnerabilities CVE-2016-9355 -orange Overview This project presents a firmware security analysis of the BD Alaris 8015 Point-of-Care PC infusion...

kcmdump

KCM dumper Quick script to dump the KCM database used by SSSD and recover Kerberos tickets in the CCACHE format. Initially based on SSSDKCMExtractor and KCMTicketFormatter. Description Since version 2.0.0 2018-08-13, the back end storage of the KCM responder of SSSD does not encrypt the database...

cve-2020-13777

Zeek test script for CVE-2020-13777 This script performs a simple test to check if a server is potentially vulnerable to CVE-2020-13777. CVE-2020-13777 causes GnuTLS to create unencrypted session tickets. This seems to be detectable by checking gnutls sets the keyname to zero - for which it uses...

phonepe-sensitive-data-exposure-cve-2025-5154

-Insecure-Local-Storage-of-Sensitive-User-Data-in-PhonePe-Android-App-Unpatched- Discovered byhc4 Date Reported: April 2025 CVE Status: CVE Requested Pending CVE Request 1862785 for CVE ID Reques 📌 Overview A critical local vulnerability was discovered in the PhonePe Android app tested on...

CVE-2025-45620

Issue details Camera model PTC310UV2 running firmware version 0.1.0000.59. The vulnerability is found in the web interface that is used to access the camera. The vulnerability was found during a penetration test, thus, certain information in the PoC screenshots have been redacted. Description Thi...

CVE-2024-27316

CVE-2024-27316 I decided to call this vulnerability specifically "CVE-2024-27316" since I have tested it against this vulnerability. The underlying flaw effects other CVEs so I thought I'd mention those with the hope that others could test and modify this PoC : This PoC currently only works again...

OST-C2-Spec

Draft: Request for Discussion Abstract This document provides an overview of Version 1 of the OST C&C Specification. It is intended to provide a detailed description of messages and the fields within those messages. Introduction The motivation behind this specification is to provide a C&C messagi...

CVE-2020-11539

CVE-2020-11539: Improper Access Control in Tata Sonata Smartband Information Description: It has been identified that the smart band has no pairing mode 0 BLE security level The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't hav...

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn , an abandoned cop...

PetitPotam-notest

PetitPotam NTLM Relay Attack Detection A Zeek package for detecting some attempts to trigger NTLM relay attacks via the Petit Potam exploit. This package will detect what appear to be successful and unsuccessful exploit attempts. It makes a distinction between them by examining the return code fo...

CVE-2026-114614

A flaw was found in Authlib. The library's transport security verification improperly validates web addresses by using prefix matching to exempt local loopback addresses from encryption requirements. A remote attacker can exploit this issue by supplying a crafted URL containing local host...

CLEANSTART-2026-FR89285 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CVE-2026-105933

Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryptionrequired namespace policy. When this policy is set, the broker rejects messages that are published without encryption. When the broker loads a persistent topic, it...