-vercel-application-is-vulnerable-to-CVE-2025-66478.

-vercel-application-is-vulnerable-to-CVE-2025-66478. bug bounty...

InjuredAndroid

InjuredAndroid - CTF A vulnerable Android application with ctf examples based on bug bounty findings, exploitation concepts, and pure creativity. Now available on Google Play! https://play.google.com/store/apps/details?id=b3nac.injuredandroid Setup for a physical device 1. Download the latest...

CVE-2022-22947

CVE-2022-22947 Exp This bug seems to be not recurrent everytime。 python3 requests...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust: cargo-1.99.1-1.1.hum1 aarch64, s390x, x8664 clippy-1.99.1-1.1.hum1 aarch64, s390x, x8664 rust-1.99.1-1.1.hum1 aarch64, s390x, x8664 rust-analyzer-1.99.1-1.1.hum1 aarch64, s390x, x8664...

patch-diffing-in-the-dark

Patch Diffing In The Dark A series of blog posts leveraging CVE analysis and patch diffing to discover new vulnerabilities. As revealed in the blog posts, 4 CVEs came from the in-depth study of CVE-2021-1657. TOC Results from CVE-2021-1657: Part 1 - Patch Diffing In The Dark Part 2 - Down the...

auto-repeater

AutoRepeater: Automated HTTP Request Repeating With Burp Suite tl;dr Within extender import AutoRepeater.jar Some Brief Instructions AutoRepeater will only resend requests which are changed by a defined replacement. When AutoRepeater receives a request that matches the conditions set for a given...

CVE-2026-9973-exploit

CVE-2026-9973 Bug fix https://chromium-review.googlesource.com/c/v8/v8/+/7822799 wasmturboshaft Fix Phi handling in Load Elimination some more Multiple Phis can depend on each other, so we have to clear all their replacements up front. Fixed: 509268941 Change-Id:...

Bug-Bounty

Here Are Some Bug Bounty Resource From Twitter Contents List : Common Vulnerabilities and Exposures | SQL injection | Cross-Site Scripting ---|---|--- CVE-2022-40684 | SQLiDetector | XSS CVE-2022-41040 | SQLI Payload | XSS Payload | | | | | | Support:...

Bug-Bounty-Wordlists

Bug-Bounty-Wordlists A repository that includes all the important wordlists used while bug hunting. Wordlists will be updated regularly Also you are welcome to contribute in this project and upload your own wordlists. Highly Appreactiable. Note : This repository contains some public available...

domained

domained archived A domain name enumeration tool This project is no longer maintained. Thank you to @ccsplit and @mzfr for their work on domained. Gist: Some terrible continually updated python code leveraging some awesome tools that I use for bug bounty reconnaissance. The tools contained in...

reternal-quickstart

RE:TERNAL Note: Still under development, only use for testing and do not expose interfaces! Current compose doesn't work yet, only try when you know what you're doing RE:TERNAL is a centralised purple team orchestration service to manage third-party C2 frameworks. Agents are installed on endpoint...

socialhunter

socialhunter !IMPORTANT This tool is no longer working, and we won't be able to fix it as it has become difficult to bypass social media protections. Crawls the given URL and finds broken social media links that can be hijacked. Broken social links may allow an attacker to conduct phishing attack...

SubMon

SubMon Some say bug bounty isn't just about finding bugs, but being the "first" to find them. I'm building this tool to notify hunters when new subdomains appear. Features You can add your favorite target: name + domain. Then you can either click scan or schedule a scan. When the scan finishes, y...

probable_subdomains

Probable subdomains Online tool: https://weakpass.com/generate/domains TL;DR During bug bounties, penetrations tests, red teams exercises, and other great activities, there is always a room when you need to launch amass, subfinder, sublister, or any other tool to find subdomains you can use to...

nodesub

NODESUB Nodesub is a command-line tool for finding subdomains in bug bounty programs. It supports various subdomain enumeration techniques and provides flexible options for customization. Features Perform subdomain enumeration using CIDR notation Support input list. Perform subdomain enumeration...

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

AMFDSer-ngng

AMFDSer-ngng A Burp Extender plugin, that will take deserialized AMF objects and encode them in XML using the Xtream library. Based on the original work of Khai Tran, all hail https://blog.netspi.com/ AMFDSer-ngng also utilizes part of Kenneth Hill's Jmeter source code for custom AMF...

SUSE CVE-2026-86563

A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access...

Important: Red Hat Security Advisory: MTV RHEL9 Images

Updated Release packages that fix several bugs and add various enhancements are now available. Migration Toolkit for Virtualization Images...

bug-bounty-domains

BUG BOUNTY DOMAINS Domains belonging to the most reputed public bug bounty programs. NOT FOR NON-MONETARY OR PRIVATE PROGRAMS !https://assets.kitploit.com/production/public/readmes/6941/7164554a880fd0545e5dc196593b59979d6603d1462460...