swap_digger

swapdigger swapdigger is a bash script used to automate Linux swap analysis for post-exploitation or forensics purpose. It automates swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, HTTP basic authentication, WiFi SSID and keys, etc. Download and run...

munge

MUNGE Uid 'N' Gid Emporium MUNGEMUNGE Uid 'N' Gid Emporium는 사용자 자격 증명credential을 생성하고 검증하기 위한 인증 서비스입니다. HPC 클러스터 환경에서 사용할 수 있도록 확장성이 매우 높게 설계되었습니다. 사용자 ID를 변조 방지 자격 증명으로 인코딩하기 위한 휴대용 API를 제공하며, 이 자격 증명은 보안 영역security realm 내에서 신뢰할 수 없는 클라이언트가 획득하고 신뢰할 수 없는 중개자가 전달할 수 있습니다. 이 영역 내의 클라이언트는 루트 권한, ...

credmap

credmap: The Credential Mapper Credmap is an open source tool that was created to bring awareness to the dangers of credential reuse. It is capable of testing supplied user credentials on several known websites to test if the password has been reused on any of these. An official introductionary...

CVE-2021-46363

CVE-2021-46363: Magnolia CMS의 수식 삽입Formula Injection Magnolia v6.2.3 및 이하 버전의 내보내기Export 기능에서 발생하는 문제로, 공격자가 조작된 CSV/XLS 파일을 통해 수식 삽입Formula Injection 공격을 수행할 수 있습니다. 이러한 수식은 피해자가 내보낸 파일을 Microsoft Excel로 열 때 해당 컴퓨터에서 임의 코드 실행을 초래할 수 있습니다. 공급업체 공지: 이 취약점에 대한 공급업체의 공지 및 수정 사항은 여기에서 확인할 수 있습니다. 요구...

WSO2-2020-0731

WSO2-2020-0731: WSO2 Carbon의 XXE 및 XSS 취약점 여러 WSO2 제품에서 잠재적인 XXE 및 XSS 취약점이 확인되었습니다. 공급업체 공개: 이 취약점에 대한 공급업체의 공개 및 수정 사항은 여기에서 확인할 수 있습니다. CVE가 없는 이유는? 저와 공급업체 모두 이러한 취약점에 대해 CVE를 요청하지 않았습니다. 요구 사항: 이 취약점을 악용하려면 다음이 필요합니다: 합법적인 WSO2 사용자를 속여 악성 저장소를 추가하도록 유도 또는 유효한 사용자 자격 증명 개념 증명: 자세한 내용과 악용 절차는 ...

GLPI < 10.0.17 - Pre-Auth SQL Injection

A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the...

EUVD-2026-91138

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-103766

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

Uniview IP Cameras Improper Authentication (CVE-2023-0773)

Some Uniview IPC products have an access control vulnerability in their web-based management interface. A remote, unauthenticated attacker can send specially crafted HTTP requests to modify device user credentials. Successful exploitation of this vulnerability could allow the attacker to gain...

CVE-2026-103766 ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2025-70829

CVE-2025-70829: Datart의 정보 노출 中文文档 1. 취약점 개요 CVE ID : CVE-2025-70829 제품 : Datart 버전 : v1.0.0-rc.3 취약점 유형 : 정보 노출 Datart v1.0.0-rc.3의 정보 노출 취약점으로 인해 인증된 공격자가 사용자 정의 H2 JDBC 연결 문자열을 통해 민감한 데이터에 접근할 수 있습니다. 공격자가 애플리케이션을 자체 내부 데이터베이스 파일에 연결하도록 유도하면, 사용자 자격 증명과 구성 세부 정보가 포함된 시스템 테이블을 쿼리할 수 있습니다. 2. 재현...

PT-2026-95827

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Admin REST API of Keycloak. The endpoint used for deleting user credentials fails to correctly verify fine-grained reset-password permissions. This allows a delegated...

CVE-2026-94001: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...

CVE-2026-27548

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27551

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27559 Command Injection via GET in /api/status/data

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27551 Command Injection in /index.php/ajax/parameterManage

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27548 Command Injection in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27548 Command Injection in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27547 Command Injection in /index.php/ajax/get_iodd_menu_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...