CVE-2023-20198

CVE 2023-20198 Introduction The web UI component of Cisco IOS XE Software has a previously undiscovered vulnerability that, when exposed to the internet or untrusted networks, is already being actively exploited, according to Cisco. Due to this vulnerability, a remote, unauthenticated attacker is...

Pentagram-exploit-tester

Pentagram-exploit-tester A test app to check if your device is vulnerable to CVE-2021-30955. This tool incorporates @b1n4r1b01's kernel exploit based on CVE-2021-30955 and will run it on your device to test if the device is compatible. Exploit is known to work with iOS 15.0 to 15.1.1 and 15.2 BET...

realme-c53-unlock-root

Realme C53 RMX3760 — Bootloader Unlock & Root Toolkit English | Bahasa Indonesia Unlock bootloader and root your Realme C53 and other Realme devices. Supports KernelSU, Magisk, or a hybrid of both. ⚠️ RMX3760 Unisoc T612 : Bootloader unlock + Magisk root are verified working on BOTH Android 15 and...

omae-wa-cheese-da

omae-wa-cheese-da Image GPU arbitrary physical R/W CVE-2025-21479 - KASLR leak - SELinux permissive - RKP-safe init-hook root server & DEFEX bypass custom binary exec LDPRELOAD It takes about 6 mins.. Be patient. I'll optimize it later. Tested devices Galaxy Z Flip 5 SM-F731N Firmware:...

CVE-2026-43499-OnePlus15

CVE-2026-43499 — OnePlus 15 LPE Educational PoC WARNING: This repository is provided for educational and research purposes only. No pre-built binaries or releases are distributed. You must build everything from source. Android 16 local privilege escalation for OnePlus 15. Fork of...

Cisco-IOS-XE-CVE-2023-20198

Cisco-IOS-XE-CVE-2023-20198 Exploit PoC for CVE-2023-20198 Vulnerability information and exploit usage offered by smokeintheshell See references Endpoint, http content type and headers management have been modified from other existing POCs to work in situations in which other exploits fail...

vivo_iqoo_neo_9_root_research_on_CVE-2025-21479

vivo iQOO Neo 9 Root Research CVE-2025-21479 This project is the result of local privilege escalation research based on CVE-2025-21479 a Qualcomm Adreno A7xx GPU firmware logic vulnerability, the target device is the vivo iQOO Neo 9 Snapdragon 8 Gen 2 / Adreno 740 / A7xx series GPU. The repositor...

KTO

KTO - Kick Them Out https://github.com/user-attachments/assets/0ebf61af-c306-4825-b836-95df59052c27 Point it at an SSID and it disconnects the devices on that network, including ones that reconnect. You give it the network name; it finds the access point, finds the clients, and picks a...

ExploiteameEsta

ExploiteameEsta CVE-2021-30937 vulnerability checking app What is this? This project is an application for iOS devices dedicated to iOS 15.0-15.1.1. You will be able to test whether the vulnerability mentioned above is compatible with your device or not. You will be shown several alerts and pop-u...

CVE-2023-20198

CVE-2023-20198 Exploit PoC for CVE-2023-20198 Description CVE-2023-20198 is characterized by improper path validation to bypass Nginx filtering to reach the webuiwsmahttp web endpoint without requiring authentication. By bypassing authentication to the endpoint, an attacker can execute arbitrary...

IonStack-S22U

CVE-2026-43499 - Samsung 5.10 Kernel Devices IonStack https://github.com/user-attachments/assets/f3d0858d-f8f5-444f-8ae5-541c2bc744c3 | ---|--- | While this repository originated as a device-specific port for the Galaxy S22 Ultra, the project has since shifted and expanded to support all Samsung...

android-workprofile-exploit

Android Work Profile Security Research Controlled lab research on Android work-profile provisioning behavior, policy timing, and enterprise isolation boundaries. This repository documents academic security research performed in a controlled environment. It is not intended for unauthorized access,...

lab-cve-2025-57819

Work in Progress FreePBX CVE-2025-57819 Lab - Unauth SQLi → RCE Chain Nuclei POC Spin up a reproducible FreePBX 15 lab Docker to validate CVE-2025-57819 — a critical unauthenticated SQL injection in userman AJAX endpoints that can be chained to RCE. Includes a working Nuclei template...

CVE-2025-55182

Vulnerable React Application CVE-2025-55182 This application is a Proof of Concept PoC for CVE-2025-55182 , a critical Remote Code Execution RCE vulnerability in React Server Components. Vulnerability Details CVE ID : CVE-2025-55182 Severity : Critical CVSS 10.0 Affected Components : React Server...

CVE-2023-20198

🔍 Cisco IOS XE Web UI Vulnerability Scanner - CVE-2023-20198 🚨 🚫 Critical Risk | CVSS: 10.0 | 📅 Updated: Oct 17, 2023 Overview: A swift and powerful scanner for detecting critical vulnerabilities in the web UI of Cisco IOS XE Software. Protect your system from unauthorized level 15 access, puttin...

Fugu15

Fugu15 Fugu15 is a semi-untethered permasigned jailbreak for iOS 15. It contains a code-signing bypass, kernel exploit, kernel PAC bypass and PPL bypass. Additionally, it can be installed via Safari, i.e. a computer is not required, except for a Web Server that hosts Fugu15. Please note that Fugu...

Security update for trivy (important)

openSUSE Security Update: Security update for trivy Announcement ID: openSUSE-SU-2026:0353-1 Rating: important References: 1284829 1285541 Cross-References: CVE-2026-19585 CVE-2026-78669 CVE-2026-85091 CVSS scores: CVE-2026-19585 SUSE: 7.1...

XStream <1.4.15 - Server-Side Request Forgery

XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorize...

CVE-2026-114074

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed...

CVE-2026-114074 Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed...