PhantomFS

PhantomFS ProjFS provider. Projects files where the content depends on which process reads them. Payload is stored AES-256-CBC encrypted on disk, decrypted only in memory at runtime. This shouldnt bypass any EDR as the payload will be written to disk when allowed processes try to read it...

AnonX

NOTE AnonX script was based on we-transfer public API and has stopped working after three weeks from its release. “All good things must come to an end, so it’s with a heavy heart and through held-back tears that we must announce that we’ll be retiring our Public API. Sad times.” says Stephen. For...

Hollow

Hollow hollow is a shellcode loader generator. You give it a raw shellcode binary and a profile, and it spits out a compiled Windows PE loader with your shellcode encrypted inside. Getting Started Binaries are available on the releases page, or build from source: go build -o hollow . Requires...

steganography

Image Steganography Tool Simple C++ Encryption and Steganography tool that uses Password-Protected-Encryption to secure a file's contents, and then proceeds to embed it insde an image's pixel-data using Least-Significant-Bit encoding. For Linux, MacOS, and Windows systems. Encoding $...

CVE-2026-33032-nginx-ui-vuln-lab

CVE-2026-27944 + CVE-2026-33032 — nginx-ui Zero-Credential RCE Lab Disclaimer: This repository is intended for educational and authorised security research purposes only. All techniques demonstrated here should only be used against systems you own or have explicit written permission to test. The...

reyee_decrypt

reyeedecrypt Adaptive decryption of Ruijie ReyeeOS firmware and configuration backups, and recovery of plaintext passwords from configurations. Usage python3 reyeedecrypt.py output directory is auto-detected, supporting the following types: Input| Example ---|--- Firmware tar package|...

Cve-2026-27944-Tools-Exploit

🚀 CVE-2026-27944: Nginx UI Unauthenticated Backup Exploit 📌 Description 27944.py is an exploitation tool for CVE-2026-27944 that allows an attacker to download and decrypt Nginx UI backups without authentication. This vulnerability exists in Nginx UI versions 2.3.2 and allows access to: · User...

CVE-2025-55182-RCE-shell

CVE-2025-55182-RCE-shell Burp Suite/antsword - Interactive shell HTTP hijack + POST + AES-256-CBC/BASE64 Detection -dnslog DNSLog No-Output Detection Nuclei -poc Vulnerability Echo Detection Exploitation -exp Interactive shell base64 echo -exp2 Interactive shell HTTP hijack + POST + Base64 -exp3...

Malicious code in imgbundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350 The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypt...

MAL-2026-17330 Malicious code in imgbundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350 The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypt...

Malicious code in stestenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee35b23a60484ee1d468154734cc7cdbc8c7d3cbc81901ab680cb67e46a8c2b6 On require of the package's main entry, dispatchAnalytics reads a payload hidden in the JPEG APP13 marker 0xFFED segment of the bundled dist/stest.jp...

MAL-2026-17309 Malicious code in stestenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee35b23a60484ee1d468154734cc7cdbc8c7d3cbc81901ab680cb67e46a8c2b6 On require of the package's main entry, dispatchAnalytics reads a payload hidden in the JPEG APP13 marker 0xFFED segment of the bundled dist/stest.jp...

cryptr v4.0.0

cryptr A simple shell utility for encrypting and decrypting files using OpenSSL. Installation git clone https://github.com/nodesocket/cryptr.git ln -s "$PWD"/cryptr/cryptr.bash /usr/local/bin/cryptr Requirements shred if optionally deleting original file. Bash tab completion Add...

CVE-2026-19806

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...

EUVD-2026-68969

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...

CVE-2026-19806: Improper Authentication

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...

PT-2026-84106

Name of the Vulnerable Software and Affected Versions Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System versions prior to 1.4.53 Description An authentication bypass exists that allows for administrator account takeover. The issue resides in the guest ticket...

CVE-2026-82645

AVideo current commit e01e41ecc and earlier exposes stream credentials through the plugin/Live/view/Liverestreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream access gate and the restream ownership check, causing the endpoint to return any...

CVE-2026-82645 AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token

AVideo current commit e01e41ecc and earlier exposes stream credentials through the plugin/Live/view/Liverestreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream access gate and the restream ownership check, causing the endpoint to return any...

CVE-2026-82645

AVideo current commit e01e41ecc and earlier exposes stream credentials through the plugin/Live/view/Liverestreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream access gate and the restream ownership check, causing the endpoint to return any...