CVE-2024-55060

CVE-2024-55060 Rafed CMS Website v1.44 - Cross Site Scripting XSS Título del Exploit: Rafed CMS Website v1.44 - Cross Site Scripting XSS Fecha: 2024-03-12 CVE: CVE-2024-55060 Autor del Exploit: Abdulaziz Saad @b4zb0z Página del proveedor: https://www.rafed-system.org/ Enlace del software: N/A...

CVE-2022-27414

CVE-2022-27414 - Inyección SQL College Website CMS v1.0 - CVE-2022-27414 - Inyección SQL URL del CVE root@kitploit: https://vulners.com/cve/CVE-2022-27414 PoC a continuación Código vulnerable comienza en la línea 9 de "cwms\departments\index.php" root@kitploit: query"SELECT FROM departmentlist...

CVE-2023-40297

CVE-2023-40297 Stakater Forecastle = v1.0.144 permite recorrido de directorios en el componente del sitio web Vulnerability Type Directory Traversal Vendor of Product Stakater Affected Product Code Base Forecastle = v1.0.144 Affected Component Componentes afectados: URL -...

onionshare

OnionShare OnionShare 是一款开源工具，让你能够通过 Tor 网络安全且匿名地分享文件、托管网站以及与朋友聊天。 安装 OnionShare 你可以从 OnionShare 网站 下载适用于 Windows 和 macOS 的 OnionShare。 在 macOS 上，你也可以使用 Homebrew： root@kitploit: brew install --cask onionshare 请参阅 这些说明 以在 Linux 上以 Flatpak 或 Snap 包形式安装 OnionShare。 文档 要了解 OnionShare...

trevorc2

trevorc2 TrevorC2 - Command and Control via Legitimate Behavior over HTTP Written by: Dave Kennedy @HackingDave Website: https://www.trustedsec.com Note that this is a very early release - heavy randomization and encryption to be added soon. TrevorC2 is a client/server model for masking command a...

CVE-2017-0108

Microsoft Office 2007 SP3、2010 SP2、Word Viewer、Skype for Business 2016、Lync 2013 SP1、Lync 2010、Live Meeting 2007、Silverlight 5、Windows Vista SP2、Windows Server 2008 SP2 及 R2 SP1、Windows 7 SP1 中的 Windows 图形组件允许远程攻击者通过精心构造的网站执行任意代码，此漏洞又名“图形组件远程代码执行漏洞”。此漏洞与 CVE-2017-0014 描述的不同。 此漏洞编号为 MS17-011 来自利比亚...

protections-artifacts

Protections Artifacts Elastic Security prevents ransomware and malware, detects advanced threats, and arms responders with vital context. It’s free and open, ready for every endpoint. Protections-Artifacts is the home of our detection logic rules, yara, etc for Elastic Security for endpoint. At...

struts-pwn

struts-pwn An exploit for Apache Struts CVE-2017-5638 Usage Testing a single URL. python struts-pwn.py --url 'http://example.com/struts2-showcase/index.action' -c 'id' Testing a list of URLs. python struts-pwn.py --list 'urls.txt' -c 'id' Checking if the vulnerability exists against a single URL...

OSINT-Framework

OSINT Framework http://osintframework.com Notes OSINT framework focused on gathering information from free tools or resources. The intention is to help people find free OSINT resources. Some of the sites included might require registration or offer more data for $$$, but you should be able to get...

CyberClass

CyberClass 此仓库包含 Class'Code CyberClass 的教学资源。 文件树 root@kitploit: 📦CyberClass ------------------------------------ Root directory ┣ 📂docs --------------------------------------- Website sources ┃ ┣ 📂assets ----------------------------------- General assets logo, favicon, etc ┃ ┣ 📂Partie1...

xsssniper

XSSSNIPER xsssniper is an handy xss discovery tool with mass scanning functionalities. Usage: root@kitploit: Usage: xsssniper.py options Options: -h, --help show this help message and exit -u URL, --url=URL target URL --post try a post request to target url --data=POSTDATA post data to use...

Artemis

Artemis是一个模块化漏洞扫描器。它通过检查网站安全的各个方面和构建易于阅读的消息，准备发送给被扫描的组织来支持CERT PL的扫描活动。 快速开始 🔨 | 文档 📚 如果您想使用因非BSD兼容许可证而未包含在此处的其他模块，请访问Artemis-modules-extra仓库。 如果您想修改/开发Artemis，请先阅读开发。 Artemis是实验性软件，正在积极开发中——使用风险自负。 要讨论Artemis，加入Discord服务器！ 合作与会议 Artemis已在拉斯维加斯的BlackHat USA 2024和伦敦的BlackHat Europe...

Rawsec-website

RawSec 托管在 GitLab Pages 上的静态网站 主题与标签 : 安全（网络安全）、Linux、新闻、系统、虚拟化、…… 开发 使用 nodenv 安装所需版本的 nodejs。 然后安装 hexo 命令行工具： root@kitploit: $ npm install -g hexo-cli 然后安装依赖： root@kitploit: $ npm i 然后构建并启动服务： root@kitploit: $ hexo g && hexo s...

killshot

This project is no longer maintained ! KILLSHOT A Penetration Testing Framework, Information gathering tool & Website Vulnerability Scanner Why KillShot? You can use this tool to spider your website, gather important information, and automate data collection using tools such as WhatWeb, Host,...

censys-python

Censys Python Library !WARNING DEPRECATION NOTICE : The Censys Search v1 and v2 APIs will be deprecated soon. Please migrate to the new Censys Platform. 📖 New API Documentation : https://docs.censys.com/reference/get-started 📦 New Python SDK : censys/censys-sdk-python 🖥️ New CLI Tool cencli:...

Brafton WordPress Plugin < 3.4.8 - Cross-Site Scripting

The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php. id: CVE-2016-10973 info: name: Brafton WordPress Plugin 3.4.8 - Cross-Site Scripting author: Harsh severity: medium description: | The Brafton plugin...

Feedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export

The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handleexport' function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to export all feedback data in CSV or...

Tiempo.com <= 0.1.2 - Cross-Site Scripting

Tiempo.com before 0.1.2 is susceptible to cross-site scripting via the page parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to stea...

PHPJabbers Food Delivery Script - SQL Injection

PHPJabbers Food Delivery Script 3.0 has a SQL injection SQLi vulnerability in the "q" parameter of index.php. id: CVE-2023-40748 info: name: PHPJabbers Food Delivery Script - SQL Injection author: ritikchaddha severity: critical description: | PHPJabbers Food Delivery Script 3.0 has a SQL injecti...

WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting

WordPress MF Gig Calendar plugin 1.1 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize or escape the id GET parameter before outputting back in the admin dashboard when editing an event. id: CVE-2021-24510 info: name: WordPress MF Gig Calendar =1.2 which...