cve-2022-23636-poc

CVE-2022-23626 - m1k1o's Blog Authenticated RCE Authenticated Remote Code Execution via file upload vulnerability in m1k1o's Blog v1.3 and below. Description The ajax.php?action=uploadimage endpoint does not properly validate uploaded file types, allowing an authenticated user to upload a PHP...

Ivy

THIS REPOSITORY HAS BEEN ARCHIVED To view the latest version of Ivy or to submit an issue, reference https://github.com/Tylous/Ivy. More Information If you want to learn more about the techniques utilized in this framework as well as the defensive measure to help defend against it, please take a...

CVE-2025-49132-PoC

CVE-2025-49132-PoC Proof-of-Concept for CVE-2025-49132 for Remote Code Execution in Pterodactyl Panel -m check Do something funny python3 poc.py -u -m exploit -p -t Technical Details Analyzing the git diff of LocaleController.php between v1.11.10 and v1.11.11 link, we can see that the controller...

PHP_8.1.x_Exploit

🚀 PHP CVE Autopilot Automated detection & exploitation of critical PHP vulnerabilities CVE-2024-4577 bypass, CVE-2025-14177, CVE-2025-14180, CVE-2025-14178 PHP8.1.xExploit.sh is a single‑file, zero‑configuration security assessment tool that automatically discovers vulnerable PHP endpoints and...

poc-graphql

Table Of Content Table Of Content Research on GraphQL Objective Labs Deploying on Docker Security weaknesses Authorization Issue Reco Injection Issue Reco Resource exhaustion Issue Reco Exposure of private data Issue Reco Exposure of technical information in case of unexpected error Issue Reco...

CVE-2003-0264

🐞 CVE-2003-0264: SLMail 5.5 - Stack-Based Buffer Overflow Classic stack-based buffer overflow in SLMail 5.5 showing how early mail servers could be compromised through oversized SMTP and POP3 commands. 📑 Table of Contents Why this repository exists Why this vulnerability is interesting Context an...

CVE-2026-32136_exploit

CVE-2026-32136exploit - AdGuard Home h2c Upgrade Auth Bypass Unauthenticated authentication bypass in AdGuard Home 0.107.73 via HTTP/2 cleartext h2c upgrade. | ---|--- CVE| CVE-2026-32136 CVSS| 9.8 Critical — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-287 Improper Authentication Affected| AdGua...

hookchain

Hookchain Abstract - EN In the current digital security ecosystem, where threats evolve rapidly and with complexity, companies developing Endpoint Detection and Response EDR solutions are in constant search for innovations that not only keep up but also anticipate emerging attack vectors. In this...

createdump

Windows App LSASS Dump - Proof of Concept This project demonstrates how to dump the LSASS process using the createdump.exe tool, a Microsoft signed executable, from the Windows App, leveraging a custom hook to enable process access to LSASS. Get-AuthentiCodeSignature -FilePath Join-Path -Path...

CVE-2026-25049

🚨 CVE-2026-25049 – n8n Unauthenticated Settings Disclosure 📌 Overview CVE ID: CVE-2026-25049 Affected Software: n8n Severity: Critical Category: Improper Access Control / Information Disclosure This vulnerability allows unauthenticated access to internal configuration data via a REST API endpoint...

HTB-Pterodactyl-Writeup

HackTheBox — Pterodactyl Writeup Difficulty: Medium | OS: Linux openSUSE Leap 15.6 | Season: 10 Summary Pterodactyl is a medium-difficulty Linux machine running the Pterodactyl game server panel. The attack chain involves an unauthenticated LFI-to-RCE vulnerability in the panel, credential...

RemoteMonologue

RemoteMonologue RemoteMonologue is a Windows credential harvesting technique that enables remote user compromise by leveraging the Interactive User RunAs key and coercing NTLM authentications via DCOM. Read X-Force Red's RemoteMonologue: Weaponizing DCOM for NTLM Authentication Coercions for...

CVE-2025-12137

1 Helper to call the plugin’s REST API with current nonce async function iwpFetchpath, method='GET', body const nonce = window?.wpApiSettings?.nonce || jQuery?.ajaxSettings?.headers?.'X-WP-Nonce'; const res = await fetch$location.origin/wordpress/wp-json/iwp/v1$path, method, headers:...

CVE-2025-59528-POC

CVE-2025-59528 - FlowiseAI CustomMCP Remote Code Execution CVSS 10.0 Critical | Blind RCE | FlowiseAI Flowise = 2.2.7-patch.1 and = 2.2.7-pa...

dcshadow

!WARNING DO NOT RUN IN PRODUCTION. This is meant for lab testing, for blue teams to work on identifying IoCs, event types, and behavior. Also, this tool is provided as-is. No support is planned apart from standard review on pull requests you may want to create. Don't run this from a Windows host...

MOVEit Transfer - SQL Injection

In Progress MOVEit Transfer before 2021.0.8 13.0.8, 2021.1.6 13.1.6, 2022.0.6 14.0.6, 2022.1.7 14.1.7, and 2023.0.3 15.0.3, a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit...

ChatGPT-Next-Web - SSRF/XSS

Full-Read SSRF/XSS in NextChat, aka ChatGPT-Next-Web id: CVE-2023-49785 info: name: ChatGPT-Next-Web - SSRF/XSS author: high severity: critical description: | Full-Read SSRF/XSS in NextChat, aka ChatGPT-Next-Web impact: | Unauthenticated attackers can exploit SSRF vulnerabilities through the...

CVE-2025-29927-Proof-of-Concept

Walkthrough Step 1 5 min Hint Which network services are exposed by the target? — — — Solution kali@kali:$ nmap kali@kali:$ nmap -sC -sV -p Step 2 5 min Hint 1 The landing page only reveals a login page, but web servers often expose additional paths. Hint 2 Try using a directory brute-forcing too...

seclab-taskflows-fuzzing

Seclab Taskflows Fuzzing An LLM-driven, OSS-Fuzz-style fuzzing pipeline for native C/C++ projects. AFL++ for execution, clang+lcov for coverage, an LLM agent for harness writing, coverage-feedback decisions, triage, and reporting. Fully autonomous: give it a GitHub repo and it handles everything...

CVE-2023-49070

ofbiz-xmlrpc-rce CVE-2023-49070 PoC for the Apache OFBiz XML-RPC pre-auth deserialization RCE tracked as CVE-2023-49070: an authentication-bypass path unlocks the legacy /webtools/control/xmlrpc endpoint, which deserializes an attacker- controlled Java object smuggled inside an XML-RPC parameter...