tiktok-scraper

TikTok Scraper & Downloader Scrape and download useful information from TikTok. No login or password are required This is not an official API support and etc. This is just a scraper that is using TikTok Web API to scrape media and related meta information. Content Features To Do Contribution...

Magento-CVE-2016-4010

Analysis and Exploitation of Magento Unauthenticated Remote Code Execution Vulnerability CVE-2016-4010 0x00 Preface On May 17, foreign security researcher Netanel Rubin publicly disclosed an unauthenticated remote code execution vulnerability in Magento CVE-2016-4010. This vulnerability actually...

pgAdmin < 6.17 - Unauthenticated Remote Code Execution

pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication. id: CVE-2022-4223 info: name: pgAdmin 6.17 - Unauthenticated Remote Code Execution...

yeti

Yeti 平台 Yeti 旨在弥补 CTI 与 DFIR 从业人员之间的差距，为 DFIR 团队提供一个取证情报平台和流水线。它的诞生源于不得不回答“我之前在哪里见过这个工件？”或“如何在我的时间线上搜索与此威胁（或所有威胁）相关的 IOCs？”这类问题的无奈。 文档链接： 主站：https://yeti-platform.io/ 文档 指南 什么是 Yeti？ 简而言之，Yeti 允许你： 批量搜索可观测对象，并对其威胁性质以及如何在系统中找到它做出良好的判断。 反过来，聚焦于某个威胁，快速列出所有 TTP、恶意软件以及相关的 DFIR 工件。 让 CTI...

ligolo-ng

Ligolo-ng : 像 VPN 一样隧道 一款先进却又简单的隧道工具，使用 TUN 接口。 📑 Ligolo-ng 文档（设置/快速开始） !TIP Ligolo-ng 0.8 添加了许多新功能，包括： 🌐 API 和一个漂亮的 Web 界面，感谢 L'ami du Raisin，支持多人协作 ！ ⚙️ 简单的配置文件，用于保留你的隧道/代理设置 🚦 守护进程模式 ，将 Ligolo-ng 作为服务运行 🔗 自动绑定，在特定 agent 连接时自动配置隧道 📶 在 Windows、Linux、MacOS 和 BSD 上轻松且自动（autoroute）地管理路由和接口！ 💀 Agent...

tiktok-scraper

TikTok Scraper & Downloader Scrape and download useful information from TikTok. No login or password are required. This is not an official API support and etc. This is just a scraper that is using TikTok Web API to scrape media. Features Scrape video posts from username, hashtag or trends Downloa...

leonidas

Leonidas 本仓库包含 Leonidas，一个用于在云中执行攻击者行为的框架。它提供了一种基于 YAML 的格式，用于定义云攻击者的战术、技术和过程（TTP）及其相关的检测属性。这些定义可以编译为： 一个将每个测试用例暴露为独立端点的 Web API 用于检测的 Sigma 规则 https://github.com/Neo23x0/sigma 文档——示例请参见 http://detectioninthe.cloud/ 该项目最初设计用于 AWS 环境，其架构如下： 2024 年，Leonidas 扩展为支持 Kubernetes 环境。其资源可以部署到目标集群中，架构如下： 部...

ExternalC2

ExternalC2 Una librería para integrar canales de comunicación con el servidor External C2 de Cobalt Strike Esta librería proporciona una implementación de la especificación External C2 de Cobalt Strike, incluyendo un canal web básico y un canal websocket. La base de código ha sido documentada y...

API-attack-detection-with-AI

Detection of SQL/XSS Attacks on Web API with Artificial Intelligence / Machine Learning This project aims to detect SQL and XSS injections in API requests/params using machine learning. Project Overview This project aims to detect SQL and XSS injections in API requests and parameters using Machin...

exist

EXIST EXternal Information aggregation System against cyber Threat ⚠️ This repository is unmaintained / archived. Security issues will not be fixed. EXIST is a web application for aggregating and analyzing CTI cyber threat intelligence. EXIST is written by the following software. Python 3 Django...

tiandy-research

tiandy-research Este repositorio contiene los resultados de mi investigación de agosto de 2020 sobre el firmware de IPC/NVR de Tiandy estos dispositivos también se venden como OMNY. Esta "investigación" no fue exhaustiva, pero encontré múltiples métodos para recuperar la contraseña del...

CVE-2026-1457

CVE-2026-1457: Ejecución Remota de Código Autenticada en TP-Link VIGI C385 Resumen CVE-2026-1457 es una vulnerabilidad de desbordamiento de búfer autenticada en la API web de TP-Link VIGI C385 V1. Esta vulnerabilidad permite a atacantes autenticados ejecutar código de forma remota RCE. Puntuación...

CVE-2026-26418

CVE-2026-26418 Autenticación y Autorización Faltantes en la API Web Resumen de la Vulnerabilidad Se identificó una vulnerabilidad de autenticación y autorización faltantes en la capa de API Web de Tata Consultancy Services TCS – Cognix Recon Client v3.0. Ciertos endpoints de API expuestos no...

CVE-2026-74972

Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

EUVD-2026-54997

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

CVE-2026-16257

The CVE-2026-16257 entry concerns the Arvow AI SEO Writer WordPress plugin (pre-1.5.4). The NVD/CVE descriptions indicate an access control flaw in a REST endpoint that can be reached without authentication due to type juggling when the plugin is not configured. This allows unauthenticated users ...

CVE-2026-19352 mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery

A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...

CVE-2026-19113

Removed by vendor...

CVE-2026-6020 ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handleaction method passing user-supplied input directly to calluserfunc without an allowlist o...

CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...