sshelf

sshelf Fuzzy-search your SSH hosts and connect in two keystrokes. sshelf keeps its own host list, builds the ssh command for you, and then gets out of the way. It hands the terminal to real OpenSSH and never touches /.ssh/config. Install macOS and Linux, x8664 and arm64. The prebuilt packages nee...

Parsero

¿Qué es Parsero? Parsero es un script gratuito escrito en Python que lee el archivo Robots.txt de un servidor web y examina las entradas Disallow. Las entradas Disallow le indican a los motores de búsqueda qué directorios o archivos alojados en un servidor web no deben ser indexados. Por ejemplo,...

cve-2022-42889-text4shell-docker

Install maven - maven-linux 1. Maven install to create the fat jar mvn clean install 2. Docker build docker build --tag=text4shell . 3. Docker run docker run -p 80:8080 text4shell 4. Test the app http://localhost/text4shell/attack?search= 5. Attack can be performed by passing a string...

poc_monitor

pocmonitor A short scraper looking for a POC of CVE-2024-49112 Setting a cron job to run the script every 4 hours will keep the updates in place. The alerting can be customized but used Discord webhook to alert a Discord channel. 0 /4 cd /root/monitorscript && /usr/bin/python3 pocmonitor.py...

CVE-2023-5561-POC-Updated

CVE-2023-5561-POC-Updated This repository contains a modified version of the original Proof-of-Concept PoC for CVE-2023-5561. The original PoC, which can be found here, sends a high volume of requests in parallel, which may trigger Web Application Firewalls WAFs or cause the server to block the...

CVE-2026-104968

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/entity-search/?querytype=usermention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The...

EUVD-2026-92490

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/entity-search/?querytype=usermention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The...

CVE-2026-104968 Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/entity-search/?querytype=usermention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The...

CVE-2026-104968

The project management tool Plane is vulnerable to cross-workspace member enumeration in versions prior to 1.4.0 . The issue exists in the SearchEndpoint located in apps/api/plane/app/views/search/base.py, which inherits BaseAPIView with only an IsAuthenticated permission class. Because it fails ...

CVE-2026-104968 Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/entity-search/?querytype=usermention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The...

CVE-2026-59785

A flaw was found in Zabbix. The host search functionality in the web frontend allows filtering against fields that are not displayed, including stored Intelligent Platform Management Interface IPMI and Pre-Shared Key PSK credentials. An authenticated attacker with read access can exploit this by...

CVE-2021-26084

CVE-2021-26084 CVE-2021-26084 Remote Code Execution on Confluence Servers. Dork Fofa: app="ATLASSIAN-Confluence" Usage Show help information. python PoC.py Vulnerability verification for individual websites. python PoC.py -u https://1.1.1.1 Command execution. python PoC.py -u https://1.1.1.1 -e...

CVE-2024-9796

CVE-2024-9796 WP-Advanced-Search 3.3.9.2 - Unauthenticated SQL Injection Description The PoC SQL injection will dump WordPress users and hashes. Disclaimer: This script is for educational use only. Do not use it for illegal purposes. If you do, it’s entirely your responsibility; I am not liable f...

CVE-2025-24893

CVE-2025-24893 Exploit Title: XWiki 15.10.10 - Unauthenticated Remote Code Execution Date: 09/08/2025 Exploit Author: D3Ext Vendor Homepage: https://www.xwiki.org/ Software Link: https://github.com/xwiki/xwiki-platform Version: 15.10.10 Tested on: Kali Linux 2025 CVE: CVE-2025-24893 Explanation...

CVE-2024-32019-POC

⚠️ CVE-2024-32019 - PoC 📌 Affected Versions = v1.45.0, = v1.44.0-60, v1.45.0-169 🛠️ Proof of Concept CVE-2024-32019 — ndsudo local privilege escalation via untrusted search path. 🔧 Compile the Exploit x8664-linux-gnu-gcc -o nvme exploit.c -static 📤 Deploy on Target Machine 1. Transfer the compiled...

liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934

Authenticated Stored XSS in LifeRay 7.2.1 GA2 via MyAccountPortlet executed by Search Results In LifeRay version 7.1.0 through 7.2.1 GA2 the First Name, Middle Name, and Last Name fields for user accounts are all vulnerable to a Stored XSS issue. Any user can modify these fields with a particular...

CVE-2020-35545

CVE-2020-35545 Spotweb 1.4.9 - 'search' SQL Injection...

DLL-Planting-Slack-4.33.73-CVE-2023-38820

DLL-Planting-Slack-4.33.73-CVE-2023-38820 DLL Planting in the Slack 4.33.73 - CVE-2023-38820 Discoverer: Idan Malihi Description An issue in Slack Slack v.4.33.73 allows a local attacker to execute arbitrary code via the DLL loading mechanism in profapi.dll, CRYPTBASE.dll, KBDUS.DLL, DPAPI.dll,...

CVE-2026-59785

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it...

CVE-2026-105291

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...