CVE-2026-31431

CVE-2026-31431 Proof of Concept PoC This repository contains a Proof of Concept PoC exploit for CVE-2026-31431 , demonstrating a local privilege escalation vulnerability. !WARNING This project is intended strictly for educational and security research purposes only. Use it only on systems you own...

youzer

youzer Fake User Generator for Active Directory Environments Introduction The goal of Youzer is to create information rich Active Directory environments. This uses the python3 library 'faker' to generate random accounts. pip3 install faker You can either supply a wordlist or have the passwords...

credmap

credmap: The Credential Mapper Credmap is an open source tool that was created to bring awareness to the dangers of credential reuse. It is capable of testing supplied user credentials on several known websites to test if the password has been reused on any of these. An official introductionary...

CVE-2024-1086

CVE-2024-1086 Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images...

CVE-2025-46818

CVE-2025-46818 – Redis Lua Sandbox Cross-User Escape Sandbox escape via deprecated Lua APIs and mutable metatables on Redis 8.2.1. Overview Redis 8.2.1 keeps deprecated Lua builtins getfenv, setfenv, newproxy exposed to scripts and fails to lock metatables for basic types. An attacker can inject...

CheeseTools

CheeseTools This repository has been made basing onto the already existing MiscTool1, so big shout-out to rasta-mouse for releasing them and for giving me the right motivation to work on them. CheeseExec Command Exec / Lateral movement via PsExec-like functionality. Must be running in the context...

telegram-osint-lib

Telegram OSINT scenario library Description A lot of Telegram API libraries around, but none of them demonstrates how to execute complex scenarios like draining all photos from channels, monitor users presence or register new account. This projects aims to correct situation: now you can easily...

CVE-2025-50565

CVE-2025-50565 Description Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker. Vulnerability Type SQL Injection Attack Type Remote Impact Information Disclosure true Has vendor confirmed true Discoverer...

osi.ig

Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...

CVE-2026-112868

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9...

CVE-2026-112868 WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9...

CVE-2026-105869

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...

EUVD-2026-107422

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...

SharpNamedPipePTH

SharpNamedPipePTH This project is a C tool to use Pass-the-Hash for authentication on a local Named Pipe for user Impersonation. You need a local administrator or SEImpersonate rights to use this. There is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily...

autovpn

!CAUTION This repository is no longer being maintained. No further updates, bug fixes, or support will be provided. Please use the new version https://github.com/ttlequals0/autowire Overview Script that allows the easy creation of OpenVPN endpoints in any AWS region. To create a VPN endpoint is...

sysbox

Introduction Sysbox is an open-source and free container runtime a specialized "runc", originally developed by Nestybox acquired by Dockerdocker-acquisition on 05/2022, that enhances containers in two key ways: Improves container isolation: Linux user-namespace on all containers i.e., root user i...

Nosql-MongoDB-injection-username-password-enumeration

Nosql injection username and password enumeration script Using this script, we can enumerate Usernames and passwords of Nosqlmongodb injecion vulnerable web applications. Exploit Title: Nosql injection username/password enumeration. Author: Kalana Sankalpa Anon LK. Website:...

pwndoc

PwnDoc PwnDoc is a pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. The main goal is to have more time to Pwn and less time to Doc by mutualizing data like vulnerabilities between users. Documentation Installation Data Roles...

linux

Linux kernel The Linux kernel is the core of any Linux operating system. It manages hardware, system resources, and provides the fundamental services for all other software. Quick Start Report a bug: See Documentation/admin-guide/reporting-issues.rst Get the latest kernel: https://kernel.org Buil...

apidetector

APIDetector is a powerful and efficient tool designed for testing exposed Swagger endpoints in various subdomains with unique smart capabilities to detect false-positives. It's particularly useful for security professionals and developers who are engaged in API testing and vulnerability scanning...