cpanel-sessionscribe

SessionScribe - CVE-2026-41940 Critical unauthenticated RCE in cPanel & WHM. Four HTTP requests forge a root session via CRLF injection into the password field of a preauth session. No auth, no preconditions, every supported tier affected. Disclosed 2026-04-28 by Sina Kheirkhah / watchTowr Labs...

forbidden

Forbidden Bypass 4xx HTTP response status codes and more. The tool is based on Python Requests, PycURL, and HTTP Client. Tested on Kali Linux v2024.2 64-bit. Made for educational purposes. I hope it will help! Future plans: Add the silent option to suppress console output. Add the no color option...

CVE-2026-42533

CVE-2026-42533 — nginx Heap Buffer Overflow PoC Exploit Pre-Authentication Remote Code Execution via Two-Pass Capture Clobbering Public PoC released 2026-07-27 — Don't wait, patch now. | ---|--- CVE| CVE-2026-42533 CVSS 4.0| 9.2 Critical Type| Heap Buffer Overflow CWE-122 Affected| nginx 0.9.6 –...

Exploits

Exploits CVEs originales, PoCs de exploits y avisos de seguridad por @kmkz · boffsec-services.com · @kmkzsecurity 2026 Archivo| Objetivo| Tipo| CVSSv3 ---|---|---|--- CVE-2026-22191-SicuroWeb-ATI-chain.txt| SicuroWeb / Beghelli Sicuro24| Aviso cadena de 3 CVE| 9.3 CVE-2026-22191-POC.py| SicuroWeb...

CVE-2023-27524

CVE-2023-27524 Descripción - PoC para CVE-2023-27524: Vulnerabilidad de omisión de autenticación en Apache Superset. - creado por antx el 2023-04-27. Detalle - Ataques de validación de sesión en versiones de Apache Superset hasta 2.0.1 inclusive. Las instalaciones que no hayan alterado la...

sshpass-win32

sshpass-win32 Como https://linux.die.net/man/1/sshpass Requisitos previos Para ejecutar sshpass, debes instalar: Windows 10 Insider build 17733 o posterior Instalación Winget winget install xhcoding.sshpass-win32 Scoop scoop install sshpass Uso Uso: sshpass opciones argumentos de comando -h, --he...

CVE-2026-106488

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

CVE-2026-106457

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...

CVE-2026-106460

Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email...

CVE-2019-7192_QNAP_Exploit

QNAP Pre-Auth Root RCE CVE-2019-7192 CVE-2019-7195 Exploit for now, you can read system files /etc/shadow, ssh private key, etc. Usage: pip install -r requirements.txt or just pip install requests python3 gundy.py https://vulnerableurl:port Sample Output Vulnerability The vulnerabilities can be...

domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

Exploitarium-Detections

Cobertura de Detección KQL de Exploitarium Reglas de detección KQL para Microsoft Sentinel y Defender XDR que cubren la divulgación anónima bikini/exploitarium — un archivo de investigación personal de más de 15 objetivos de vulnerabilidad distintos en más de 109 archivos rastreados, publicado si...

CVE-2026-106488

The Backstage framework is vulnerable to improper authentication in the @backstage/plugin-auth-backend-module-oidc-provider package in versions prior to 0.4.20 . When using OIDC email-based identity resolution with a provider that allows unverified email addresses, an authenticated provider user ...

CVE-2022-26134

Confluence Pre-Auth Remote Code Execution via OGNL Injection CVE-2022-26134 Confluence Pre-Auth Remote Code Execution via OGNL Injection CVE-2022-26134 On June 02, 2022 Atlassian released a security advisory for their Confluence Server and Data Center applications, highlighting a critical severit...

warpgate

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...

CVE-2026-106460

The @backstage/plugin-auth-node package in the Backstage framework (versions 0.3.0 through 0.6.15 and 0.7.5) fails to consistently honor explicit negative email verification during shared OAuth profile normalization. Specifically, it may ignore verified: false or email_verified: false claims in c...

CVE-2023-27524

CVE-2023-27524: Apache Superset Auth Bypass Script to check if an Apache Superset server is running with an insecure default configuration CVE-2023-27524. The script checks if a Superset server's session cookies are signed with any well-known default Flask SECRETKEYs. The --validate flag can be...

CVE-2026-106457

The Backstage developer portal framework is vulnerable due to insufficient audience validation in the @backstage/plugin-auth-backend-module-cloudflare-access-provider package. Affected versions range from 0.1.0 until 0.5.0 . While the provider verifies the token's signature and team issuer, it fa...

CVE-2024-57376

CVE-2024-57376 Exploit de ejecución remota de código sin autenticación para D-Link DSR-250 y DSR-250N Aviso de seguridad: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10415 Uso $ python3 exploit.py usage: Ejemplo $ python3 exploit.py 192.168.1.1 443 id + fingerprint...

CVE-2026-60004-POC

CVE-2026-60004 — Gitea Pre-Auth Remote Code Execution CVSS 9.8 ┌──────────────────────────────────────────────────────────────┐ │ CVE-2026-60004 │ Gitea Pre-Auth RCE │ CVSS 9.8 CRIT │ │ diffpatch → git hook injection │ v1.17–1.27.0 affected │...