6513 matches found
CVE-2026-76581-Detector
CVE-2026-76581 - WPMU DEV Dashboard Vulnerability Detector A safe, passive Python detector for identifying WordPress installations running a version of WPMU DEV Dashboard affected by CVE-2026-76581. The detector does not exploit the authentication bypass, request or replay HMAC values, or create ...
ida-pro-mcp
IDA Pro MCP !IMPORTANT I recommend using theOfficial Hex-Rays IDA MCP Server instead! See the announcement blog post for more information. Simple MCP Server to allow vibe reversing in IDA Pro. https://github.com/user-attachments/assets/6ebeaa92-a9db-43fa-b756-eececce2aca0 The binaries and prompt...
CVE-2024-45440
Enumeration tool for CVE-2024-45440 by DividesByZer0 & c0d3Ninja CVE-2024-45440 - Drupal 11.x-dev Full Path Disclosure PoC options: -h, --help show this help message and exit -u URL, --url URL Single URL to scan. -f FILE, --file FILE File containing URLs to scan one per line. -t THREADS, --thread...
CVE-2025-11953-PoC
Description The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and r...
CVE-2025-30208
CVE-2025-30208 β Vite Arbitrary File Read Β· v5 CVE: CVE-2025-30208 GHSA: GHSA-x574-m823-4x7w Severity: CVSS 5.3 Medium network-accessible dev server β For authorized security engagements only. Unauthorized use against systems you do not own or have explicit written permission to test is illegal...
invoker
Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...
php-8.1.0-dev-exploit
php-8.1-dev-Exploit β οΈ Important read first This repository contains a Java proof-of-concept PoC intended for CTF / lab use only. Do not run this code against systems you do not own or do not have explicit written permission to test. Unauthorized exploitation is illegal. Use only in isolated...
astroid
ASTROID v 1.2 Author: Mascerano Bachir dev-labs Legal Disclamer: The author does not hold any responsibility for the bad use of this tool, remember this is only for educational purpose. Description: This tool Generate Shellcodes with metasploit,Decoded By Avet & compiled to EXE's Screenshot:...
cryptodev-linux
cryptodev-linux This is a /dev/crypto device driver, equivalent to those in OpenBSD or FreeBSD. The main idea is to access existing ciphers in kernel space from userspace, thus enabling the re-use of a hardware implementation of a cipher. For questions and suggestions, please use the homepage at...
EUVD-2026-105143
Vitest: Servers misapply server.fs.deny, serving .env, private keys, .git, and the API token file...
GHSA-9JRQ-W75R-8GCW Vite: Cross origin script execution through Vite custom middleware
Summary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to...
Vite: Cross origin script execution through Vite custom middleware
Summary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to...
GHSA-RQ7H-C2JC-7F22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
Summary The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references /etc/hosts, the content of /etc/hosts was possible to be returned. The content of files outside the...
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
Summary The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references /etc/hosts, the content of /etc/hosts was possible to be returned. The content of files outside the...
GHSA-VFPM-58RQ-9QCG Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Summary The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the...
CVE-2025-30208-EXP
CVE-2025-30208-EXP Vite development server arbitrary file read vulnerability CVE-2025-30208, with wide coverage, simple exploitation, and no restrictions, posing a huge threat! Fofa search syntax: body="/@vite/client" Hunter search syntax: web.body="/@vite/client" Exp script usage -u to check -p...
php-8.1.0-dev-backdoor-rce
PHP 8.1.0-dev Backdoor Remote Code Execution PHP 8.1.0-dev Backdoor System Shell Script PHP verion 8.1.0-dev was released with a backdoor on March 28th 2021, but the backdoor was quickly discovered and removed. If this version of PHP runs on a server, an attacker can execute arbitrary code by...
PHP-8.1.0-dev_WebShell-RCE
PHP 8.1.0-dev WebShell RCE Unauthenticated Exploit Code for PHP 8.1.0-dev WebShell RCE Unauthenticated Expected outcome: Exploiting backdoor installed on PHP 8.1.0-dev server thereby obtaining WebShell to execute commands remotely. Intended only for educational and testing in corporate...
CVE-2026-39363
CVE-2026-39363 β Vite Dev Server WebSocket Arbitrary File Read Batch Detection Disclaimer: This tool is intended for authorized security testing and educational research only. Users must comply with local laws and regulations; unauthorized scanning or attacking others' systems is illegal. The...
EUVD-2026-106704
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: E1 Dev Platform Tech - UNIX. Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edward...