CVE-2026-82692

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsimgr.cgi. Performing a manipulation of the argument alias/username/password/volumelocation results in os command injection. It is possible to initiate the attack remotely...

AwesomeXSS

AwesomeXSS This repository is a collection of Awesome XSS resources. Contributions are welcome and should be submitted via an issue. Awesome contents Challenges Reads & Presentations Tools Mind maps DOM XSS Payloads Polyglots Tags and event handlers Context breaking HTML context Attribute context...

CVE-2026-82692

D-Link DNS-340L and DNS-345 (versions up to 20260717 ) are vulnerable to an OS command injection in the CGI script /cgi-bin/iscsi_mgr.cgi . By manipulating the arguments alias , username , password , or volume_location , an attacker can inject and execute arbitrary OS commands. The attack can be ...

CVE-2026-82692 D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsimgr.cgi. Performing a manipulation of the argument alias/username/password/volumelocation results in os command injection. It is possible to initiate the attack remotely...

signature-base

Signature-Base Signature-Base is the YARA signature and IOC database for our scanners LOKI and THOR Lite Focus of Signature-Base 1. High quality YARA rules and IOCs with minimal false positives 2. Clear structure 3. Consistent rule format Directory Structure iocs - Simple IOC files CSV yara - YAR...

insect

insect — Обнаружение веб-путей Текущий релиз: v1.4 22.09.2022 Продвинутый инструмент командной строки, предназначенный для подбора директорий и файлов на веб-серверах, также известный как сканер веб-путей. Идея @maurosoria и @shelld3v Разработка 2022 года активно ведётся @nu11secur1ty Содержание...

CVE-2026-5076

☠️ CVE-2026-5076 ARMember Premium = 7.3.1 Ненадёжный механизм сброса пароля → Полный захват учётной записи администратора Ключи сброса пароля в открытом виде хранятся в базе данных + SQL-инъекция = Полный захват администратора 📋 Информация об уязвимости Связанные CVE та же рекомендация CVE| Тип|...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

assetfinder

assetfinder Find domains and subdomains potentially related to a given domain. Install If you have Go installed and configured i.e. with $GOPATH/bin in your $PATH: root@kitploit: go get -u github.com/tomnomnom/assetfinder Otherwise download a release for your platform. To make it easier to execut...

cve-2020-5902-ioc-bigip-checker

CVE-2020-5902 IoC 탐지 도구 이 스크립트는 root 권한을 가진 사용자가 F5 BIG-IP의 Advanced Shellbash에서 로컬로 실행하도록 설계되었으며, 다른 환경에서 실행하기 위한 것이 아닙니다. 참고: Appliance Mode에서는 Advanced Shell에 접근할 수 없으므로 이 도구는 해당 시스템에서 실행할 수 없습니다. 이 스크립트는 작성 당시 F5 Networks에 알려진 CVE-2020-5902와 관련된 침해 지표IoCs에 대해 BIG-IP를 검사합니다. 스크립트는 이러한 IoC를 수집하...

kit-policy

kit-policy A flexible, composable authorization framework for Kit, inspired by Ruby's Action Policy. TOC Files File| Description ---|--- .editorconfig| Editor formatting configuration .gitignore| Git ignore rules for build artifacts and dependencies .tool-versions| asdf tool versions Zig, Kit...

SharpWMI

SharpWMI SharpWMI — это реализация различных функций WMI на C. Она включает локальные/удалённые WMI-запросы, удалённое создание процессов через win32process и удалённое выполнение произвольного VBS-кода через подписки на события WMI. Также поддерживаются альтернативные учётные данные для удалённы...

credactor

Credactor Find the secret. Fix it. Commit clean. Secret scanners are good at sounding the alarm and not much help putting it out. They hand you a list of leaked credentials and leave the cleanup to you. Credactor closes the loop: it finds a hardcoded secret and rewrites it in place, so a leak goe...

CVE-2026-82865

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite uses jackson-databind-2.21.2.jar, dompurify-3.4.11.tgz, requests-2.32.5-py3-none-any.whl, dompurify-3.4.2.tgz, pyjwt-2.12.1-py3-none-any.whl, and js-yaml-3.14.2.tgz which is vulnerable to CVE-2026-59888, CVE-2026-59889, CVE-2026-66010, CVE-2026-25645,...

SharpUp

SharpUp SharpUp — это C-порт различных функций PowerUp. На данный момент портированы только самые распространённые проверки; функции для атак пока не реализованы. @harmj0y — основной автор. SharpUp распространяется по лицензии BSD 3-Clause. Использование root@kitploit: SharpUp.exe audit check1...

EUVD-2026-68400

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

CVE-2026-82865 pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

CVE-2026-82865

pdfme schemas versions prior to 5.5.10 are affected by a cross-site scripting (XSS) vulnerability in the multiVariableText property panel . The root cause is the assignment of unsanitized i18n label values to innerHTML , allowing an attacker who controls label overrides via options.labels to inje...

recon

O.G. AUTO-RECON Возможности Цель O.G. Auto-Recon — автоматизировать начальный этап сбора информации, а затем провести как можно более полную перечислительную разведку на основе полученных результатов. Этот инструмент предназначен для CTF и может быть довольно шумным. Не самый скрытный инструмент...