CVE-2026-102139 Kiteworks Email Protection Gateway Incorrect Authorization

An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subject, message body, and attachments of...

EUVD-2026-90275

An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subject, message body, and attachments of...

CVE-2026-102139

The Kiteworks Email Protection Gateway contains an incorrect authorization flaw within its optional large file exchange feature. The root cause is a failure to properly verify that a requesting user is a party to the package they are attempting to access. This allows an authenticated user to read...

EUVD-2026-90269

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting XSS weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated...

CVE-2026-102100

Kiteworks Core versions prior to 9.5.0 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This weakness allows an authenticated user to submit malicious content that executes arbitrary JavaScript when viewed by another user within their authenticated session. Such exploitation could enab...

CVE-2026-102100 Kiteworks Core stored XSS

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting XSS weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated...

CVE-2024-40094

CVE-2024-40094 ENF ExecutableNormalizedFields Denial of Service Exploit This script exploits the CVE-2024-40094 vulnerability in graphql-java by triggering an ExecutableNormalizedFields ENF based denial of service. It builds a crafted GraphQL introspection query with deep nested aliases, designed...

CVE-2026-102150

A vulnerability exists in the Kiteworks Advanced Forms component where a specific function is reachable without authentication. An unauthenticated attacker could potentially perform a limited set of internal service operations on the Kiteworks platform. However, the vulnerability does not allow a...

CVE-2026-102150 Kiteworks Secure Data Forms Missing Authentication for Critical Function

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...

EUVD-2026-90386

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...

CVE-2020-35575-TP-LINK-TL-WR841ND-password-disclosure

CVE-2020-35575-password-disclosure-issue-in-the-web-interface A password-disclosure issue in the web interface on certain TP-Link devices allows a remote malicious user to get full administrative access to the web panel. This affects WA901ND devices prior to 3.16.9201211 beta, and Archer C5, Arch...

CVE-2025-32463-PoC

CVE-2025-32463 – Privilege Escalation via Sudo chroot 📝 Overview CVE-2025-32463 is a local privilege escalation vulnerability affecting the sudo utility. It allows a regular user to escalate privileges to root by exploiting the -R option which sets a custom runtime root directory together with...

DrMITM

D̳r̳M̳I̳T̳M̳ DrMITM is a program designed to globally log all traffic. Diagram: H̳o̳w̳ i̳t̳ w̳o̳r̳k̳s̳ DrMITM sends a request to website and returns the IP of the website just in case the server of the website is designed to rely on the website IP for requests, and the request that goes to the...

SharpADWS

SharpADWS 中文文档 Active Directory reconnaissance and exploitation for Red Teams via the Active Directory Web Services ADWS. Overview SharpADWS is an Active Directory reconnaissance and exploitation tool for Red Teams that collects and modifies Active Directory data via the Active Directory Web...

essh

ESSH Un espacio de trabajo SSH con sesiones persistentes y paneles de estado en vivo. Mantén los shells remotos en ejecución a través de caídas de conexión, cambia entre hosts con teclas o el ratón, y comprueba el estado del sistema sin salir de tu terminal. ESSH usa OpenSSH para las conexiones y...

essh

ESSH An SSH workspace with persistent sessions and live health dashboards. Keep remote shells running across connection drops, switch between hosts with keys or the mouse, and check system health without leaving your terminal. ESSH uses OpenSSH for connections and tmux to keep your work alive. Se...

tldfinder

TLDFinder Features • Installation • Usage • Running tldfinder • Join Discord A streamlined tool for discovering private TLDs for security research. Features TLD based DNS lookups Passive TLD based DNS lookups Active STD IN/OUT and TXT/JSON output Installation tldfinder requires Go 1.21 to install...

CVE-2021-21972

CVE-2021-21972 CVE-2021-21972 Works On VMware-VCSA-all-6.7.0-8217866, VMware-VIM-all-6.7.0-8217866 ✔ VMware-VCSA-all-6.5.0-16613358 ✔ For vCenter6.7 U2+ vCenter 6.7U2+ runs the website in memory, so this exploit cannot work for 6.7 u2+. Needs Testing vCenter 6.5 Linux VCSA/WindowsAwaiting Testing...

ldapserver

This package is a work in progress. ldapserver is a helper library for building server software capable of speaking the LDAP protocol. This could be an alternate implementation of LDAP, a custom LDAP proxy or even a completely different backend capable of "masquerading" its API as a LDAP Server...

blur

README Repository about the BLUR attacks presented at AsiaCCS'22 in the paper titled: BLURtooth: Exploiting Cross-Transport Key Derivation in Bluetooth Classic and Bluetooth Low Energy. Useful links: pdf, video, slides, website. BibTex entry: @inproceedingsantonioli22blur, author=Antonioli, Danie...