maswe

OWASP Mobile Application Security Weakness Enumeration MASWE The OWASP Mobile Application Security Weakness Enumeration MASWE is a list of common security and privacy weaknesses in mobile applications. It is intended to be used as a reference for developers, security researchers, and security...

flawfinder

About This is "flawfinder" by David A. Wheeler. Flawfinder is a simple program that scans C/C++ source code and reports potential security flaws. It can be a useful tool for examining software for vulnerabilities, and it can also serve as a simple introduction to static source code analysis tools...

cve-2026-20833-rc4-kerberos

CVE-2026-20833 — Kerberos RC4 Hardening This repository consolidates technical documentation , PowerShell scripts , Power BI dashboards , and official Microsoft references related to the progressive deprecation of RC4 in Kerberos for Active Directory environments , as part of Microsoft's security...

festin

FestIN the powered S3 bucket finder and content discover What is FestIn Why Festin Install Using Python Using Docker Full options Usage Configure search domains Concurrency HTTP Crawling configuration Manage results Proxy usage DNS Options Full Text Support Running as a service or watching mode...

ble-cve2025-attack-new-version

ble-cve2025-attack-new-version android-ble-cve-2025-4866 🔐 PoC for CVE-2025-4866 — Android BLE Vulnerability public version 📡 Exploitation of BLE authorization weakness on Android devices public PoC only. 👨💻 Developed by BloodCode Labs — 2025...

Autorize

Autorize Autorize is an open-source automatic authorization and authentication enforcement detection extension for Burp Suite. It is designed to assist application security engineers and penetration testers in identifying authorization bypasses and authentication weaknesses in web applications—at...

JKS-private-key-cracker-hashcat

JKS private key cracker - Nail in the JKS coffin The Java Key Store JKS is the Java way of storing one or several cryptographic private and public keys for asymmetric cryptography in a file. While there are various key store formats, Java and Android still default to the JKS file format. JKS is o...

CVE-2020-9289

Decrypt FortiManager configuration secrets CVE-2020-9289 CVE-2020-9289 and CVE-2019-6693 are related to the same default and hardcoded key. The only differences on the decryption routine implemented in FortiManager/FortiAnalyzer are: The IV handling all the 16 bytes are provided before the...

pmkidcracker

PMKID WPA2 Cracker This program is a tool written in Python to recover the pre-shared key of a WPA2 WiFi network without any de-authentication or requiring any clients to be on the network. It targets the weakness of certain access points advertising the PMKID value in EAPOL message 1. Program...

cumulus

Application Weakness Monitoring Software What's Cumulus Cumulus is a service that helps you monitor and fix security weakness in realtime. The issues will be reported on web dashboard. It's very simple and powerful. Key features Just install SDK to web front, can be found security weakness on...

WP Directory Kit <= 1.4.4 - Authentication Bypass

The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism tha...

modoboa 2.0.4 - Admin TakeOver

Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. id: CVE-2023-0777 info: name: modoboa 2.0.4 - Admin TakeOver author: r3Y3r53 severity: critical description: | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to...

CVE-2019-6447

CVE-2019-6447 The above investigation of the ES file browser security weakness allows us to see the issue in its entirety...

wibu-codemeter-analysis

Cryptographic Analysis of WIBU CodeMeter DLL Independent security research on WIBU-Systems CodeMeter protection Responsible Disclosure Vendor notified: December 24, 2025 Disclosure period: 90 days Public release: March 24, 2026 Scope: WibuBz32.dll analysis only Summary Analysis of WIBU CodeMeter...

meshtastic-cve-2025-52464-poc

Meshtastic CVE-2025-52464 Proof of Concept Overview This project is a software-only proof of concept demonstrating CVE-2025-52464 , a vulnerability affecting Meshtastic firmware versions 2.5.0 to 2.6.10. The implementation reproduces the cryptographic behaviour of the vulnerable firmware and...

CVE-2022-25012

CVE-2022-25012 Argus Surveillance DVR v4.0 employs weak password encryption. Compilation gcc pocland.c -o pocland Usage Example ./pocland B4A1ECB4F539C48C7357F641C9C49083 References CVE-2022-25012 More PoCs available at: pocland...

CVE-2025-69821-Beat-XP-Vega-Smartwatch-Security-Assessment

CVE-2025-69821 : Beat-XP-Vega-Smartwatch-Security-Assessment A security assessment of the Beat XP VEGA Smartwatch Firmware RB303ATV006229 focused on Bluetooth Low Energy BLE connectivity revealed a design and implementation weakness that enables a nearby BLE central device to establish and retain...

CACredDecoder

C-Ark Credential Decoder Exploit tool for CVE-2021-31796 A Tool for decoding C-Ark Credential files By: Aaron Mizrachi - https://twitter.com/unmanarc/ Enrique Vaamonde - https://twitter.com/ejvm First release: 2/Sep/2019 Disclosure: 11/Oct/2021 References...

CVE-2026-98817: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pmruntime error handling in func probe Add a common error path in probe that balances the runtime PM reference...

CVE-2026-98674: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adi-axi-adc: Initialize state mutex The AXI ADC register access paths serialize transactions with st-lock, but probe does not initialize it. Initialize the mutex before registering the backend...