tfsec

📣 tfsec to Trivy Migration As part of our goal to provide a comprehensive open source security solution for all, we have been consolidating all of our scanning-related efforts in one place, and that is Trivy. Over the past year, tfsec has laid the foundations to Trivy's IaC & misconfigurations...

CVE-2021-21972-vCenter-6.5-7.0-RCE-POC

CVE-2021-21972-vCenter-6.5-7.0-RCE-POC poc Just verify the return status of someone's path POC For testing only, NO EXP module is added POC仅用于测试，未加入exp模块...

Email-Vulnerability-Checker

Email Vulnerability Checker v2.1 Verify whether the domain is vulnerable to spoofing by Email-vulnerablity-checker Features of Version 2.1 Added Support to save output on a file using -o flag Added more checks that will accurately tell you the Vulnerability Status. Updated the code completely wit...

jboss-_CVE-2017-12149

jboss-CVE-2017-12149 verifyCVE-2017-12149.jar provides a command-line mode to verify the vulnerability. If the vulnerability exists, it returns a characteristic string. Simply execute the command: $ java -jar verifyCVE-2017-12149.jar http://xxx:8080 成功返回: vuln6581362514513155613jboss...

nogotofail

nogotofail Nogotofail is a network security testing tool designed to help developers and security researchers spot and fix weak TLS/SSL connections and sensitive cleartext traffic on devices and applications in a flexible, scalable, powerful way. It includes testing for common SSL certificate...

pentest-ai

Website · Quick start · Bug bounty · Verification · Documentation · Issues Pentest-AI is an open-source AI penetration testing and bug-bounty tool that proves every finding. It connects an AI client or model to a real pentest workflow — investigating web applications, discovering and reproducing...

CVE-2021-2109_poc

weblogicCVE-2021-2109poc weblogic CVE-2021-2109 batch verification POC Usage: First, download JNDIExploit.jar on another server and run java -jar JNDIExploit.jar -i ip Then put the IPs to be checked in urls.txt, and run this script...

WordPress Plugin Age Verification v0.4 - Open Redirect

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirectto parameter. id: CVE-2012-6499 info: name: WordPress Plugin Age...

Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation

Zoom WordPress plugin 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key. id: CVE-2026-1368 info: name: Video Conferencing with Zoom API 4.6.6 -...

AVTECH DVR - Login Verification Code Bypass

AVTECH DVR products are vulnerable to verification code bypass just by entering the "login=quick" parameter to bypass verification code. id: CVE-2013-4982 info: name: AVTECH DVR - Login Verification Code Bypass author: ritikchaddha severity: low description: | AVTECH DVR products are vulnerable t...

SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass

SimpleHelp = 5.5.15 and 6.0 pre-release contain an authentication bypass caused by lack of cryptographic signature verification in OIDC tokens, letting remote unauthenticated attackers gain technician sessions, exploit requires OIDC authentication configured. id: CVE-2026-48558 info: name:...

DataEase v2.10.2 - JWT Signature Verification Bypass

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions, the lack of signature verification of JWT tokens allows attackers to forge JWTs, which then allow access to any interface. The...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

rollback_car_attack_proverif

Rollback attack formal verif ProVerif proof of concept of the Rollback attack on car keyfob CVE-2022-37418, CVE-2022-36945 and CVE-2022-37305, presented in1 Disclaimer I have no connection with the authors of 1. I am grateful to them for making their paper open access. ProVerif installation...

p5-ssl-tools

Collection of SSL Tools This repository contains various tools, which are intended to debug or analyze problems related to SSL/TLS. Analyzing state of TLS analyze-ssl.pl check support for various SSL/TLS version check which ciphers are support verfiy certificate check OCSP state check if SNI is...

kit

kit Tool registry manager -- manages developer toolchains from git-based registries, layered on top of mise. What it is kit resolves tool versions across multiple registries, generates mise configuration, verifies SHA-256 checksums against publisher release artifacts, verifies cosign signatures...

EUVD-2026-102523

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

PT-2026-115997

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router...

AAMVA-PDF417-Vulnerability-Research

PDF417 ID Validation Vulnerability Research Overview This repository contains comprehensive security research documenting critical vulnerabilities in AAMVA-standard PDF417 barcode validation systems affecting government IDs, enterprise solutions, and consumer applications. The research includes a...

CVE-2024-7479

CVE-2024-7479 TeamViewer Improper signature verification of driver installation Author: Marcos Accossatto For demonstration purposes only. Complete exploit works on vulnerable version on Team Viewer for Windows. Introduction This exploit PoC is a python implementation of Pedro Gabaldon's PoC for...