t14m4t

t14m4t t14m4t es una herramienta automatizada de ataque de fuerza bruta, envoltorio de THC-Hydra y Nmap Security Scanner. t14m4t escanea un objetivo definido por el usuario o un documento que contenga objetivos en busca de puertos abiertos de servicios compatibles con t14m4t , y luego inicia un...

cve-2025-9933

🔒 관리자 패널 자격 증명 Username: admin Password: Test@123 Username: [email protected] Password: Test@123 또는 새 사용자 등록. 설명 PHPGurukul Beauty Parlour Management System 1.1에서 취약점이 발견되었습니다. 이 문제는 파일 /admin/view-appointment.php의 알려지지 않은 기능에 영향을 미칩니다. viewid 인수를 조작하면 SQL 인젝션이 발생합니다. 공격은 원격으로 시작될 수 있습니다...

opac-fast-automation

CVE-2025-65862 — दस्तावेज़ीकरण, विश्लेषण और ऑटोमेशन टूल केवल अनुसंधान उद्देश्यों के लिए ⚠️ नैतिक एवं कानूनी चेतावनी इस रिपॉजिटरी की सभी सामग्री केवल निम्नलिखित उद्देश्यों के लिए प्रदान की गई है: सुरक्षा अनुसंधान, शिक्षा, भेद्यता विश्लेषण, और अपने स्वामित्व या स्पष्ट अनुमति वाले वातावरण में परीक्षण...

iPwn

iPwn Ein Framework zur Ausnutzung von iOS-Geräten. DENKEN SIE DARAN: DAS IPHONE, IN DAS SIE MIT DIESEM TOOL EINDRINGEN WOLLEN, MUSS GEJAILBREAKT SEIN Status - ❌ Dieses Projekt wird noch bearbeitet. Ich füge weitere Erweiterungen und Optionen für die Post-Exploitation hinzu, um Geräteinformationen...

LabS4U2Self

Labor S4U2Self Abuse Dieses Labor zielt darauf ab, eine sichere Umgebung zum Testen des S4U2Self abuse-Exploits bereitzustellen. Bereitstellung Das Projekt stellt Folgendes bereit: 1 DC mit einem einzelnen domain admin hpotter 1 MSSQL mit einem schwachen sa-Passwort Die Bereitstellung erfolgt übe...

EUVD-2026-53123

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing...

CVE-2026-49004

CVE-2026-49004 describes misconfiguration and command injection in the built-in PostgreSQL service on the mobile device (ZTE NX799J/Red Magic 11 Air). The service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGR...

CVE-2026-49004 PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing...

PYSEC-2026-681 Unrestricted Upload of File with Dangerous Type in motionEye

motionEye = 0.42.1 and motioneEyeOS = 20200606 allow a remote attacker to upload a configuration backup file containing a malicious python pickle file. This is possible when an installation is accessible over the Internet and uses no or poor authentication credentials. The GitHub repositories for...

The Gentlemen are knocking: сustom backdoors and evolving tactics

Introduction This year saw the emergence of The Gentlemen, a prominent example of a group operating under the ransomware-as-a-service RaaS model. Although our initial assessment suggested the group first appeared in mid-2025, it actually started ramping up its activities at the beginning of 2026...

⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More

It’s Monday again. This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and mobile malware asking for way too much control. The annoying part is how little of this feels new. Weak credentials,...

Systems-and-Cyber-Security-Coursework

CSI6SCS2526 — Systems and Cyber Security Coursework Gr...

CVE-2026-8076

Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication. The system supports the use of PIN-based credentials, maintaining compatibility with POS software integrations deployed since 2012. This coul...

Separating Secrets from Placeholders: A Hybrid CNN-CodeBERT Framework for Three-Class Credential Leakage Detection

Credential leakage in public source code repositories poses a critical security threat, with over 23.8 million secrets exposed in 2024 alone. Existing detection tools suffer from high false-positive rates because rigid pattern matching and binary classification schemes fail to distinguish genuine...

CVE-2026-35089

Slican telephone exchanges expose admin credentials because the secure key is generated predictably from exchange properties without authentication. CVE-2026-35089 (and CVE-2026-35087) describe an unauthenticated path to deduce the secure key and gain admin access. Remediations (per affected entr...

CVE-2026-35089 Use of Weak Credentials in Slican telephone exchanges

In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authentication. An unauthenticated attacker can deduce the secure key and obtain admin credentials. This issue was fixed in versions below: - IPx...

CVE-2026-35089 Use of Weak Credentials in Slican telephone exchanges

In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authentication. An unauthenticated attacker can deduce the secure key and obtain admin credentials. This issue was fixed in versions below: - IPx...

CVE-2025-13477 OTP Bypass in Digital Operation Services' WifiBurada

Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiBurada allows Authentication Bypass. This issue affects WifiBurada: through 21052026. NOTE: The vendor was contacted early about this...

Digital Operation Services WiFiBurada 安全漏洞

Digital Operation Services WiFiBurada is an application developed by Digital Operation Services. Versions of Digital Operation Services WiFiBurada dated before May 20, 2026, have security vulnerabilities. These vulnerabilities stem from the exposure of private personal information to unauthorized...

CVE-2026-8077 Weak credentials vulnerability in the CashDro 3 web administration panel

Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26. The backend lacks authorization controls, leaving security entirely to the frontend. By modifying the binary string in the ‘Permissions’ field of the JSON response, an attacker could escala...