cve-2025-9933

🔒 管理员面板的凭据 用户名: admin 密码: Test@123 用户名: [email protected] 密码: Test@123 或注册新用户。 描述 在 PHPGurukul Beauty Parlour Management System 1.1 中发现一个漏洞。受此影响的是文件 /admin/view-appointment.php 中某些未知功能。对参数 viewid 的篡改导致 SQL 注入。攻击可能远程发起。该利用方式已公开披露，可能被使用。 访问 MySQL（终端） docker compose exec db mysql -uuser -p...

t14m4t

t14m4t t14m4t 是一款自动化暴力破解攻击工具，是 THC-Hydra 和 Nmap Security Scanner 的封装工具。 t14m4t 会扫描用户定义的目标（或包含目标的文件）上由 t14m4t 支持的服务的开放端口，然后使用最常用的弱凭证列表对发现端口上运行的服务发起暴力破解攻击。 安装： 安装过程包括克隆仓库、运行一个用于安装依赖的脚本（仅限 Debian 和 Arch）或手动安装依赖，并将 t14m4t 设置为可执行。运行 t14m4t 需要 THC-Hydra 和 Nmap Security Scanner。 root@kitploit: git clone...

iPwn

iPwn Ein Framework zur Ausnutzung von iOS-Geräten. DENKEN SIE DARAN: DAS IPHONE, IN DAS SIE MIT DIESEM TOOL EINDRINGEN WOLLEN, MUSS GEJAILBREAKT SEIN Status - ❌ Dieses Projekt wird noch bearbeitet. Ich füge weitere Erweiterungen und Optionen für die Post-Exploitation hinzu, um Geräteinformationen...

LabS4U2Self

Laboratorio S4U2Self Abuse Questo laboratorio ha lo scopo di fornire un ambiente sicuro per testare l'exploit S4U2Self abuse Distribuzione Il progetto distribuirà : 1 DC con un singolo domain admin hpotter 1 MSSQL con una password sa debole La distribuzione viene eseguita tramite terraform e...

opac-fast-automation

CVE-2025-65862 — Dokumentation, Analyse und Automatisierungstool Nur zu Forschungszwecken ⚠️ Ethische und rechtliche Warnung Das gesamte Material in diesem Repository wird nur bereitgestellt für: Sicherheitsforschung, Lernen, Schwachstellenanalyse, und Tests in Umgebungen, die einem gehören oder...

EUVD-2026-53123

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing...

CVE-2026-49004

CVE-2026-49004 describes misconfiguration and command injection in the built-in PostgreSQL service on the mobile device (ZTE NX799J/Red Magic 11 Air). The service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGR...

CVE-2026-49004 PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing...

PYSEC-2026-681 Unrestricted Upload of File with Dangerous Type in motionEye

motionEye = 0.42.1 and motioneEyeOS = 20200606 allow a remote attacker to upload a configuration backup file containing a malicious python pickle file. This is possible when an installation is accessible over the Internet and uses no or poor authentication credentials. The GitHub repositories for...

The Gentlemen are knocking: сustom backdoors and evolving tactics

Introduction This year saw the emergence of The Gentlemen, a prominent example of a group operating under the ransomware-as-a-service RaaS model. Although our initial assessment suggested the group first appeared in mid-2025, it actually started ramping up its activities at the beginning of 2026...

⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More

It’s Monday again. This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and mobile malware asking for way too much control. The annoying part is how little of this feels new. Weak credentials,...

Systems-and-Cyber-Security-Coursework

CSI6SCS2526 — Systems and Cyber Security Coursework Gr...

CVE-2026-8076

Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication. The system supports the use of PIN-based credentials, maintaining compatibility with POS software integrations deployed since 2012. This coul...

Separating Secrets from Placeholders: A Hybrid CNN-CodeBERT Framework for Three-Class Credential Leakage Detection

Credential leakage in public source code repositories poses a critical security threat, with over 23.8 million secrets exposed in 2024 alone. Existing detection tools suffer from high false-positive rates because rigid pattern matching and binary classification schemes fail to distinguish genuine...

CVE-2026-35089

Slican telephone exchanges expose admin credentials because the secure key is generated predictably from exchange properties without authentication. CVE-2026-35089 (and CVE-2026-35087) describe an unauthenticated path to deduce the secure key and gain admin access. Remediations (per affected entr...

CVE-2026-35089 Use of Weak Credentials in Slican telephone exchanges

In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authentication. An unauthenticated attacker can deduce the secure key and obtain admin credentials. This issue was fixed in versions below: - IPx...

CVE-2026-35089 Use of Weak Credentials in Slican telephone exchanges

In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authentication. An unauthenticated attacker can deduce the secure key and obtain admin credentials. This issue was fixed in versions below: - IPx...

CVE-2025-13477 OTP Bypass in Digital Operation Services' WifiBurada

Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiBurada allows Authentication Bypass. This issue affects WifiBurada: through 21052026. NOTE: The vendor was contacted early about this...

Digital Operation Services WiFiBurada 安全漏洞

Digital Operation Services WiFiBurada is an application developed by Digital Operation Services. Versions of Digital Operation Services WiFiBurada dated before May 20, 2026, have security vulnerabilities. These vulnerabilities stem from the exposure of private personal information to unauthorized...

CVE-2026-8077 Weak credentials vulnerability in the CashDro 3 web administration panel

Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26. The backend lacks authorization controls, leaving security entirely to the frontend. By modifying the binary string in the ‘Permissions’ field of the JSON response, an attacker could escala...