Footprinting & Enumeration Cheatsheet
Tổng hợp lệnh enumeration theo từng giao thức: FTP, SMB, NFS, DNS, SMTP, SNMP, MySQL, MSSQL, SSH, RDP, WinRM và các Dangerous Settings cần nhớ.
Kevin
Hashcat Cheatsheet
Tổng hợp hash types, attack modes, rules và workflow crack password thực tế với Hashcat.
Nmap Cheatsheet
Tổng hợp workflow, scan types, NSE scripts, evasion techniques và performance tuning cho Nmap.
CVE-2025-70146 - Online Time Table Generator 1.0: Unauthenticated Broken Access Control Allows Arbitrary Deletion
Unauthenticated attackers can delete arbitrary records (students, teachers, courses, semesters) via unprotected /admin/delete*.php endpoints in ProjectWorlds Online Time Table Generator.
CVE-2025-70148 - CodeAstro Membership Management System 1.0: Unauthenticated IDOR Leads to PII Disclosure
Unauthenticated IDOR in print_membership_card.php allows attackers to access membership card data of arbitrary members in CodeAstro Membership Management System.
CVE-2025-70150 - CodeAstro Membership Management System 1.0: Unauthenticated Broken Access Control + SQL Injection via delete_members.php
Unauthenticated attackers can delete arbitrary members and inject SQL via /delete_members.php?id in CodeAstro Membership Management System.
CVE-2025-70149 - CodeAstro Membership Management System 1.0: Unauthenticated SQL Injection via print_membership_card.php
Unauthenticated SQL Injection in print_membership_card.php allows remote attackers to extract credentials and sensitive data from CodeAstro Membership Management System 1.0.
CVE-2025-70151 - Scholars Tracking System 1.0: Authenticated Unrestricted File Upload Leads to Remote Code Execution
Authenticated attackers can upload PHP files via profile picture endpoints and achieve Remote Code Execution in Scholars Tracking System due to missing file type validation.
CVE-2025-70147 - Online Time Table Generator 1.0: Unauthenticated Sensitive Information Disclosure (Plaintext Passwords)
Unauthenticated attackers can access /admin/student.php and /admin/teacher.php to obtain plaintext passwords and PII without any session in ProjectWorlds Online Time Table Generator.
CVE-2025-70152 - Scholars Tracking System 1.0: Unauthenticated SQL Injection via /admin/save_user.php and /admin/update_user.php
Critical unauthenticated SQL injection in admin user management endpoints allows credential extraction and data manipulation in Scholars Tracking System.