CVE-2026-72001

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token...

CVE-2026-53552

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the...

CVE-2023-24055_PoC

CVE-2023-24055 PoC KeePass 2.5x Bajo discusión y análisis... https://sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b/ https://sourceforge.net/p/keepass/feature-requests/2773/ Un atacante que tenga acceso de escritura al archivo de configuración de KeePass puede modificarlo e inyecta...

CVE-2024-42009-PoC

CVE-2024-42009 PoC: Captura de Correo Electrónico y Exploit XSS en Roundcube Webmail Resumen Este repositorio contiene una prueba de concepto PoC para CVE-2024-42009 , una vulnerabilidad de Cross-Site Scripting XSS almacenado en Roundcube Webmail versión 1.6.7 y otras versiones. El exploit...

CVE-2024-1512

CVE-2024-1512 Prueba de Concepto Resumen de la Vulnerabilidad CVE-2024-1512 expone una vulnerabilidad crítica en el plugin MasterStudy LMS de WordPress, específicamente en la implementación de la ruta REST /lms/stm-lms/order/items. El problema surge por la falta de escape adecuado del parámetro...

CVE-2021-3131

CVE-2021-3131 Descripción sugerida El servidor web en 1C:Enterprise 8 anterior a 8.3.17.1851 envía credenciales codificadas en base64 en el parámetro URL 'creds'. Tipo de vulnerabilidad Otro CWE-522 Credenciales insuficientemente protegidas Vendedor del producto 1C Company Código base del product...

CVE-2024-34222

Sistema de Gestión de Recursos Humanos 1.0 Presentado por: Kha Do Vulnerabilidad Inyección SQL Descripción La vulnerabilidad de inyección SQL en /hrm/country.php en SourceCodester Human Resource Management System 1.0 permite a los atacantes ejecutar comandos SQL arbitrarios a través del parámetro...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

HIDEAGEM

root@kitploit: 888 888 8888888 8888888b. 8888888888 d8888 .d8888b. 8888888888 888b d888 888 888 888 888 "Y88b 888 d88888 d88P Y88b 888 8888b d8888 888 888 888 888 888 888 d88P888 888 888 888 88888b.d88888 8888888888 888 888 888 8888888 d88P 888 888 8888888 888Y88888P888 888 888 888 888 888 888 d8...

makin

I create makin to make initial malware assessment little bit easier for me, I think it's useful for others as well, It helps to reveal a debugger detection techniques used by a sample. Any feedback is greatly appreciated: @qazqaz How does it work? makin opens a sample as a debuggee and injects...

Bolt

Bolt A dumb CSRF scanner Important Bolt is in beta phase of development which means there can be bugs. Any production use of this tool discouraged. Pull requests and issues are welcome. I also suggest you to put this repo on watch if you are interested in it. Workflow Crawling Bolt crawls the...

GWTMap

Description GWTMap is a tool to help map the attack surface of Google Web Toolkit GWT based applications. The purpose of this tool is to facilitate the extraction of any service method endpoints buried within a modern GWT application's obfuscated client-side code, and attempt to generate example...

mip22

mip22 mip22 v3.3 mip22 es una herramienta avanzada de phishing 83 sitios web predeterminados, clona cualquier sitio con método manual, agrega cualquier sitio con método personalizado, enmascara enlaces con subdominios, acortador de URL, notificación de audio para ver las credenciales en vivo,...

iocextract

iocextract Indicator of Compromise IOC extractor for some of the most commonly ingested artifacts. Table of contents Overview The Problem Our Solution Example Use Case Installation Usage Library Command Line Interface Helpful Information FAQ More Details Custom Regex Related Projects Contributing...

SharpImpersonation

SharpImpersonation This was a learning by doing project from my side. Well known techniques are used to built just another impersonation tool with some improvements in comparison to other public tools. The code base was taken from: https://github.com/0xbadjuju/Tokenvator A blog post for the...

wreckuests

What is this? Wreckuests is a script, which allows you to run DDoS attacks with HTTP-floodGET/POST. It's written in pure Python and uses proxy-servers as "bots". OF COURSE, this script is not universal and you can't just drop Pentagon/NSA/whatever website with just a single mouse click. Each atta...

Damn-Vulnerable-Bank

Damn Vulnerable Bank Guide: https://rewanthtammana.com/damn-vulnerable-bank/ About application Damn Vulnerable Bank is designed to be an intentionally vulnerable android application. All the details are documented in the guide, here. Upcoming Sessions NoNameCon...

nginx_log_check

nginxlogcheck Script de análisis de seguridad de registros de Nginx Funcionalidades Estadísticas de las 20 direcciones principales Análisis de inyección SQL Análisis de alertas de escáneres Detección de explotación de vulnerabilidades Acceso a rutas sensibles Ataques de inclusión de archivos...

Phirautee

Phirautee A proof of concept crypto virus to spread user awareness about attacks and implications of ransomwares. Phirautee is written purely using PowerShell and does not require any third-party libraries. This tool steals the information, holds an organisation’s data to hostage for payments or...

CVE-2026-53552

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the...