tiandy-research

tiandy-research Этот репозиторий содержит результаты моего исследования прошивок IPC/NVR от Tiandy, проведённого в августе 2020 года эти устройства также продаются под брендом OMNY. Это «исследование» не было исчерпывающим, но я нашёл несколько способов удалённо восстановить пароль администратора...

ligolo-ng

Ligolo-ng : Tunneling comme un VPN Un outil de tunneling avancé, mais simple, qui utilise des interfaces TUN. 📑 Documentation Ligolo-ng Configuration/Démarrage rapide !TIP Ligolo-ng 0.8 a ajouté de nombreuses nouvelles fonctionnalités, notamment : 🌐 Une API et une magnifique interface web grâce à...

tiktok-scraper

TikTok Scraper & Downloader Scrape and download useful information from TikTok. No login or password are required. This is not an official API support and etc. This is just a scraper that is using TikTok Web API to scrape media. Features Scrape video posts from username, hashtag or trends Downloa...

ExternalC2

ExternalC2 Библиотека для интеграции каналов связи с сервером Cobalt Strike External C2 Эта библиотека предоставляет реализацию спецификации Cobalt Strike External C2, включая базовый веб-канал и канал WebSocket. Кодовая база задокументирована и спроектирована так, чтобы можно было легко добавлят...

yeti

Платформа Yeti Yeti стремится преодолеть разрыв между специалистами по CTI и DFIR, предоставляя платформу и конвейер криминалистической разведки для команд DFIR. Он родился из разочарования, связанного с необходимостью отвечать на вопросы: «Где я видел этот артефакт раньше?» или «Как мне искать...

API-attack-detection-with-AI

Detection of SQL/XSS Attacks on Web API with Artificial Intelligence / Machine Learning This project aims to detect SQL and XSS injections in API requests/params using machine learning. Project Overview This project aims to detect SQL and XSS injections in API requests and parameters using Machin...

Magento-CVE-2016-4010

Analyse et exploitation de la vulnérabilité d'exécution de code à distance non authentifiée dans Magento CVE-2016-4010 0x00 Introduction Le 17 mai, le chercheur en sécurité Netanel Rubin a divulgué une vulnérabilité d'exécution de code à distance non authentifiée dans Magento CVE-2016-4010. Cette...

CVE-2026-26418

CVE-2026-26418 Отсутствие аутентификации и авторизации в веб-API Сводка по уязвимости В слое веб-API продукта Tata Consultancy Services TCS – Cognix Recon Client v3.0 была выявлена уязвимость, связанная с отсутствием аутентификации и авторизации. Некоторые открытые конечные точки API не...

pgAdmin < 6.17 - Unauthenticated Remote Code Execution

pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication. id: CVE-2022-4223 info: name: pgAdmin 6.17 - Unauthenticated Remote Code Execution...

leonidas

Leonidas This is the repository containing Leonidas, a framework for executing attacker actions in the cloud. It provides a YAML-based format for defining cloud attacker tactics, techniques and procedures TTPs and their associated detection properties. These definitions can then be compiled into:...

tiktok-scraper

TikTok Scraper & Downloader Scrape and download useful information from TikTok. No login or password are required This is not an official API support and etc. This is just a scraper that is using TikTok Web API to scrape media and related meta information. Content Features To Do Contribution...

exist

EXIST EXternal Information aggregation System against cyber Threat ⚠️ This repository is unmaintained / archived. Security issues will not be fixed. EXIST is a web application for aggregating and analyzing CTI cyber threat intelligence. EXIST is written by the following software. Python 3 Django...

CVE-2026-1457

CVE-2026-1457: TP-Link VIGI C385 Esecuzione Remota di Codice Autenticata Panoramica CVE-2026-1457 è una vulnerabilità di buffer overflow autenticato nell'API web di TP-Link VIGI C385 V1. Questa vulnerabilità consente ad attaccanti autenticati di eseguire codice in remoto RCE. Punteggio CVSS v4.0:...

CVE-2026-74972

Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

EUVD-2026-54997

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

CVE-2026-16257

The CVE-2026-16257 entry concerns the Arvow AI SEO Writer WordPress plugin (pre-1.5.4). The NVD/CVE descriptions indicate an access control flaw in a REST endpoint that can be reached without authentication due to type juggling when the plugin is not configured. This allows unauthenticated users ...

CVE-2026-19352 mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery

A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...

CVE-2026-19113

Removed by vendor...

CVE-2026-6020 ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handleaction method passing user-supplied input directly to calluserfunc without an allowlist o...

CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...