sh00t

root@kitploit: A Testing Environment for Manual Security Testers Sh00t is a task manager to let you focus on performing security testing provides To Do checklists of test cases helps to create bug reports with customizable bug templates Features: Dynamic Task Manager to replace simple editors or...

git-alerts

GitAlerts 它解决了什么问题？ 组织下创建的 GitHub 仓库可由 GitHub 管理员控制。然而，在组织用户账户下创建的任何仓库是无法控制的，除非组织采用了 GitHub 企业托管用户（EMU）模型。 组织用户账户下意外创建或用于测试目的的任何公开仓库，都可能泄露机密、内部信息、代码等。GitAlerts 可帮助您检测和监控此类情况。 示例 可由管理员控制 https://github.com// 无法由管理员控制 https://github.com// GitAlerts 平台（Web UI + API） 寻找一个完整的平台？ GitAlerts API...

tookie-osint

我们必须重塑品牌 🔎 概述 Tookie-osint 有一个简单易用的用户界面，而且非常直接。 Tookie-osint 的主要思想是从输入中发现请求的用户名。 Tookie-osint 类似于一个名为 Sherlock 的工具。它会发现不同网站上的所有用户帐户，Tookie-osint 在这项任务上的成功率几乎达到 80%。 我们的工具是由我和社区创建的，可供您使用。 对于因我的工具造成的任何恶意行为和/或责任，我概不负责。: 请注意，Tookie-osint 的创建是为了帮助新的程序员或渗透测试人员进入 OSINT 的世界。我的最终目标是让 Tookie-osint...

npcap

Npcap Npcap is a packet capture and injection library for Windows by the Nmap Project. It is a complete update to the unmaintained WinPcap project with improved speed, reliability, and security. Documentation The complete documentation for Npcap is available in the Npcap Guide on npcap.com. There...

WSO2 User Registration - Arbitrary Account Creation

The SOAP admin service in WSO2 products has a security vulnerability that allows the creation of new user accounts regardless of the self-registration configuration settings. id: CVE-2024-7097 info: name: WSO2 User Registration - Arbitrary Account Creation author: iamnoooob,rootxharsh,pdresearch...

refreshing-mcp-tool

This isn't really done or ready yet, but I wanted to get the code checked in. This basically implements F5's database protocol, "mcp", which operates through a UNIX domain socket. That means that you need a shell on the F5 device before you can use any of these. You'll typically forward the outpu...

CVE-2022-26138

CVE-2022-26138 POC Descripción root@kitploit: The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with...

username-anarchy

Username Anarchy Version: 0.6 20 September 2024 Author: urbanadventurer Andrew Horton Homepage: https://www.morningstarsecurity.com/research/username-anarchy Source: https://github.com/urbanadventurer/username-anarchy/ License: MIT Description Tools for generating usernames when penetration...

CVE-2026-28766

CVE-2026-28766 Autenticación faltante: endpoint de cuenta de usuario Campo| Valor ---|--- CVE| CVE-2026-28766 Gravedad| Crítico 9.3 Vector CVSS| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N Debilidad CWE| CWE-306: Autenticación faltante para función crítica Componentes afectados| Cloud API...

CVE-2025-64446-FortiWeb-CGI-Bypass-PoC

Herramienta de explotación CVE-2025-64446 Herramienta de explotación para la verificación y explotación de la vulnerabilidad CVE-2025-64446 en dispositivos FortiWeb. Descripción Esta herramienta prueba y explota una vulnerabilidad de path traversal CVE-2025-64446 en firewalls de aplicaciones web...

CVE-2021-38699

CVE-2021-38699 TastyIgniter 3.0.7 permite XSS a través del campo name durante la creación de cuentas de usuario. Existe una vulnerabilidad de Cross Site Scripting Almacenado en múltiples páginas de TastyIgniter v3.0.7 que permite la ejecución arbitraria de JavaScript...

CVE-2020-24033

fs.com S3900 24T4S 1.7.1 及所有先前版本的最新版本，CSRF 后台管理员 该表单没有身份验证或令牌验证机制，因此存在跨站请求伪造（添加用户账户）漏洞，可添加一个具有完全访问权限的用户。 S3900 24T4S 上的所有表单都容易受到跨站请求伪造攻击。 root@kitploit: User Name admin guest admin2 Access Level 0 1...

CVE-2023-32749

CVE-2023-32749 的概念验证 这是我为 Pydio Cells 的 CVE-2023-32749 编写的一个快速粗糙的概念验证脚本。该脚本在提供有效凭证后，会创建一个拥有所有可用角色的新用户账户。 所有功劳归功于原始研究者。 安装 唯一的要求是 Python 的 requests 包，用于发送网络请求。如果您的系统上未安装，可以通过以下命令安装： root@kitploit: pip3 install -r requirements.txt 使用方法 root@kitploit: exploit.py -h -u USER -p PASSWORD -l URL PyDio...

linux-malware-detect

Linux Malware Detect LMD Malware scanner for Linux — multi-stage threat detection MD5, SHA-256, HEX, YARA, statistical analysis, ClamAV integration, real-time inotify monitoring, quarantine/clean/restore operations, and multi-channel alerting email, Slack, Telegram, Discord. C 2002-2026, R-fx...

CVE-2026-84905 Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploadin...

Astra Linux – Vulnerability in Samba

A flaw was discovered in the Samba AD LDAP server. The AD DC database audit logging module can access values of LDAP messages freed by a preceding database module, leading to a use-after-free issue. This issue only occurs when certain privileged attributes are modified, such as userAccountControl...

EUVD-2026-74927

Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...

CVE-2026-86750 snipe-it before 8.7.0 Authorization Bypass via API User Create/Update

Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...

SUSE CVE-2026-27657

Gitea versions before 1.25.5 allow a user to change another user's primary email address...

CVE-2026-16279

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts...