cve-2024-21626

CVE-2024-21626 Overview This repository contains code examples for an app vulnerable to CVE-2024-21626 as well as an eBPF gadget to detect exploitation attempts. This repoistory was created as part of this blog post. The gadget program used to detect this vulnerability is for demonstration purpos...

CVE-2022-47966_checker

CVE-2022-47966checker Quick and dirty powershell script to look for ManageEngine CVE-2022-47966 IOCs. The script will parse requests in ME HTTP access logs. If a characteristic SAML request is found, it will attempt to decode and extract the attacker's payload. Findings are written to...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 nuclei template Joomla CVE-2023-23752 - a request parameter breaks through the Rest API Affected version ​ Joomla roughly has three routing entries, which are 1. index.php in the root directory users access articles 2. administrator/index.php in the root directory...

fail2ban-log4j

fail2ban-log4j fail2ban filter that catches attacks against log4j CVE-2021-44228 Installation Copy this file to your fail2ban filter.d directory, which is usually something like /etc/fail2ban/filter.d or similar. Add an apache-jndi section to your jail.local or jail.conf: apache-jndi enabled = tr...

CVE-2024-3217-POC

CVE-2024-3217-POC Mitre Description The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attributevalue' and 'attributeid' parameters in all versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2020-10238

Made by HK CVE-2020-10238: Incorrect Access Control in comtemplates- RCE CVE-2020-10239: Incorrect Access Control in comfields SQL field- RCE Link https://developer.joomla.org/security-centre/804-20200303-core-incorrect-access-control-in-com-templates.html...

CVE-2024-21893.py

CVE-2024-21893 is server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication. run python CVE-2024-21893.py -u...

CVE-2026-31431-copy-fail

CVE-2026-31431 Copy Fail Exploit Part 1: Theoretical Concept How CVE-2026-31431 Works Instead of the system constantly fetching files directly from the slow physical hard disk—which wastes a lot of time the Linux system creates a temporary copy of the file inside RAM, known as the Page Cache. Thi...

remote-control

Remote Control for Laravel Grant remote access to user account without sharing credentials. Installation Configuration Usages Routing Creating Remote Access Using Generated Access Token Installation Remote Control can be installed via composer: composer require "katsana/remote-control"...

AndroidRAT

kaynak pdf: http://www.scribd.com/doc/158356704/Android-RAT Tasklist 1. Contacts 2. Sms Data 3. GPS Data 4. Browser Data...

PoC-for-CVE-2021-38540-

CVE-2021-38540 Proof of Concept Missing Authentication on Critical component Known as CVE-2021-38540 About this bug: The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, variables List Variables PoC Source: POST /variable/varimport HTTP/2 Host:...

CVE-2026-18366

CVE-2026-18366 Events Manager 7.4.1 - Unauthenticated Privilege Escalation to Administrator 🔗 Stay Updated For the latest zero-days, exploits, and security research 📋 Vulnerability Overview Attribute| Details ---|--- CVE ID| CVE-2026-18366 Severity| 🔴 CRITICAL CVSS 9.8 Plugin| Events Manager for...

CVE-2024-24402

Vulnerability Report CVE Disovered by: Jarod Jaslow MAWK Vulnerability Details: Endpoint: Nagios XI Version 2024R1.01 Vulnerability Type: Privilege Escalation from User "NAGIOS" Exploitation Result: Full root access on the target system Steps to Reproduce: 1. Create a Fresh Instance of Nagios XI...

CVE-2026-85972

Progress MarkLogic Server versions 12.x (before 12.1.0) and 11.x (before 11.3.7) are vulnerable to improper Kerberos server verification . In specific password-based authentication configurations, the software fails to sufficiently verify the identity of the Kerberos authentication service. A net...

EUVD-2026-97567

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication...

CVE-2026-85971

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are affected by a vulnerability where certain log files are assigned overly permissive operating-system permissions . This configuration flaw could allow a local user to read or alter log data, potentially impacting conf...

CVE-2020-24597

Made by HK CVE-2020-24597: Directory traversal in commedia to RCE Note: Because Joomla core 3.9.21 fixed improperly, therefore this bug has't patched improperly. I can bypass this patch eseaily. I want to keep this secret until this bug will have been fixed completely. Link...

WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by cazy in WordPress Plugin Paid Videochat Turnkey Site versions = 7.5.13...

CVE-2023-23752

CVE-2023-23752 Joomla Unauthorized Access Vulnerability CVE-2023–23752 This readme file provides information about the Joomla Unauthorized Access Vulnerability CVE-2023–23752 and how to detect. This vulnerability allows an attacker to bypass the Joomla access control system and gain unauthorized...

CVE-2024-36424

CVE-2024-36424 This vulnerability was discovered and disclosed by M. Akil Gündoğan from Secunnix Vulnerability Research Team. This repository will hold the proof-of concept and advisories. Details: Product: K7 Ultimate Security Affected versions: v17.0.2019 CVE ID: CVE-2024-36424 Operating System...