31948 matches found
CVE-2025-54769
CVE-2025-54769 – LPAR2RRD RCE Description : This repository contains a Proof‑of‑Concept PoC exploit for CVE-2025-54769, a vulnerability found in lpar2rrd. The vulnerability allows remote code execution RCE and directory traversal by abusing the /lpar2rrd-cgi/upgrade.sh endpoint. The exploit...
CVE-2025-54589
CVE-2025-54589 – Copyparty Reflected XSS Author: Byte Reaper Description : This repository provides a Proof-of-Concept PoC and simple exploit for CVE-2025-54589 , a reflected Cross-Site Scripting XSS vulnerability in Copyparty ≤ 1.18.6. By injecting crafted JavaScript payloads into the filter...
L4J-Vuln-Patch
NOTICE This tool is no longer necessary mojang has released its own patch which should cover everyone who is affected https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition WARNING THIS EXPLOIT EFFECTS BOTH CLIENTS AND SERVERS There is currently a exploit...
sample-ldap-exploit
sample-ldap-exploit Une courte démonstration de CVE-2021-44228 Construction $ mvn clean verify Exécuter l'attaquant $ java \ -cp 'attacker/target/sample-attacker.jar:attacker/target/lib/' \ sample.attacker.Attacker localhost 1389 sample.payload.Payload 8080 payload/target/sample-payload.jar URLs:...
scan4log4j
scan4log4j Python script that sends CVE-2021-44228 log4j payload requests to url list VERY BETA using Supply your url list to urls.txt Put your payloads in payloads.txt Optional add more headers in headers.txt Run ./scan4log4j.py...
ysonet
YSoNet generates .NET deserialization payloads for authorized security research, with an interactive wizard and a command line for repeatable work. Interactive configuration: choose a gadget or plugin, get help for each setting, and copy the equivalent command. Searchable discovery: filter gadget...
DroppedConnection
DroppedConnection Emulates a Cisco ASA Anyconnect VPN service, accepting any credentials and logging them before serving VBS to the client that gets executed in the context of the user. Blog post:...
metasploitavevasion
Metasploit AV Evasion Генератор полезных нагрузок Metasploit, который обходит большинство антивирусных продуктов. Выпущено как open source компанией NCC Group Plc - http://www.nccgroup.com/ Разработано Дэниелом Кэмптоном Daniel Compton, daniel dot compton at nccgroup dot com...
bash-bunny-payloads
Bash Bunny Payloads A personal repository of payloads I've created for the Bash Bunny. References https://shop.hak5.org/products/bash-bunny https://www.youtube.com/watch?v=-UmvZdDxCiI Disclaimer Please proceed with caution and ensure that you only utilise these scripts on systems where you have t...
astrolock
Astrolock A purposely vulnerable application in order to demonstrate PHP payload smuggling techniques for PNG files...
pyobfuscate
pyobfuscate A simple and efficent script to obfuscate python payloads to make it completely FUD Note: 1. Don't Upload Any Payloads To VirusTotal.com Bcz This tool will not work with Time. 2. Virustotal Share Signatures With AV Comapnies. 3. Again Don't be an Idiot! How To Install: 1. git clone...
fudcrypt
fudcrypt Обфускатор на Python3, который может легко обойти любой антивирус. Важно: 1. Убедитесь, что ваш файл с полезной нагрузкой содержит все импорты библиотек и является корректным файлом полезной нагрузки. 2. Если ваша полезная нагрузка будет обнаружена, сообщите мне — я обновлю заглушку. 3...
msdt-follina
MS-MSDT "Follina" Attack Vector John Hammond | May 30, 2022 Create a "Follina" MS-MSDT attack with a malicious Microsoft Word document and stage a payload with an HTTP server. Usage usage: follina.py -h --command COMMAND --output OUTPUT --interface INTERFACE --port PORT options: -h, --help show...
WhatsRCE
WhatsRCE This is a Automated Generate Payload for CVE-2019-11932 WhatsApp Remote Code Execution 1. Auto install GCC no harm command, you can see this is open-source 2. Saving to .GIF file How To Use ? sudo apt install git git clone https://github.com/KeepWannabe/WhatsRCE cd WhatsRCE && bash...
play-go-copy-fail-cve-2026-31431
Play Go Copy Fail CVE-2026-31431 Purpose Learn linux syscall low-level Port python and c into golang Craft own payload then exploit as newbie Auto upgrade pty manually Inspiration tgies/copy-fail-c painoob/Copy-Fail-Exploit-CVE-2026-31431 Resource Linux Source Crypto...
CVE-2025-57926
Sink: According to the mechanism of WordPress Core, XSS is prevented in post content, but with this plugin, the content is encoded and then decoded when rendered, unintentionally creating an XSS vulnerability." PoC: The base64 encoded payload is PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==...
CVE-2025-8088-WinRAR-builder
CVE-2025-8088-WinRAR-builder A POC exploit for WinRAR vulnerability CVE-2025-8088 affecting versions 7.12 and lower 🚀 How It Works 1. Creates a Rar embed with other payloads 2. Using Multiple ADS Streams 🔄 - Attaches payload streams with different path traversal depths 3. Manipulates RAR Headers ...
CVE-2021-4034
CVE-2021-4034 CVE-2021-4034 statically linked implementation based on Blasty's that doesn't need gcc. payload.so is encoded from payload.h and written to the disk. Statically compiled binary included for convenience. Original PoC and author https://twitter.com/bl4sty/status/1486092552755466242?s=...
CVE-2026-1306
CVE-2026-1306 — midi-Synth WordPress A Python-based, multi-target executable PoC / list runner for CVE-2026-1306 in the WordPress midi-Synth plugin. What does it do? Collects the midiSynthnonce value via HTTP from pages where the midiSynth shortcode is loaded on target sites. Sends an action=expo...