frameless-bitb

Frameless BITB Un nuevo enfoque para el Navegador en el Navegador BITB sin el uso de iframes, permitiendo eludir los framebusters tradicionales implementados por páginas de inicio de sesión como Microsoft. Este código POC está diseñado para usar este nuevo BITB con Evilginx y un phishlet de...

CVE-2025-0108-Authentication-Bypass-checker

This tool tests whether a target PAN-OS device is vulnerable to the CVE-2025-0108 authentication bypass vulnerability . It sends a crafted HTTP request to the target and analyzes the response to determine if the device is exploitable. Usage single ip python authbypasscve20250108.py -u...

CVE-2025-66039_CVE-2025-61675_CVE-2025-61678_reePBX

FreePBX CVE-2025 Vulnerability Scanner ⚠️ DISCLAIMER FOR EDUCATIONAL AND AUTHORIZED TESTING ONLY This tool is provided "AS IS" for educational and research purposes only Authors are NOT responsible for any misuse or illegal activities Unauthorized access to computer systems is ILLEGAL Only use on...

CVE-2025-48703

CVE-2025-48703 CVE-2025-48703 is a critical vulnerability in CentOS Web Panel CWP that allows unauthenticated attackers to perform remote code execution RCE by bypassing authentication and executing system commands. The vulnerability affects CWP versions 0.9.8.1204 and earlier, and has been patch...

Fireaway

FireAway - Herramienta de Bypass para Cortafuegos de Nueva Generación v0.2 FireAway es una herramienta para auditar, eludir y extraer datos contra reglas de inspección de capa 7/AppID en cortafuegos de nueva generación, así como otros mecanismos de defensa de inspección profunda de paquetes, como...

CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture cross-origin information leak. Safari Red/Green/Blue/White Fixed version = 26.5.2: PATCHED importExternalTexture blocked: SecurityError Principle GPUDevice.importExternalTexturesource: HTMLVideoElement imports a video into a GPU-samplable...

CVE-2025-48827

CVE-2025-48827 - vBulletin Authentication Bypass Exploit Overview This repository contains a proof-of-concept exploit for CVE-2025-48827, a critical authentication bypass vulnerability affecting vBulletin 5.0.0–5.7.5 and 6.0.0–6.0.3 when running on PHP 8.1 or later. The vulnerability allows...

CVE-2021-3560

Polkit D-Bus Authentication Bypass Exploit A vulnerability exists within the polkit system service that can be leveraged by a local, unprivileged attacker to perform privileged operations. In order to leverage the vulnerability, the attacker invokes a method over D-Bus and kills the client proces...

batchql

BatchQL BatchQL es un script de auditoría de seguridad de GraphQL centrado en realizar consultas y mutaciones GraphQL por lotes. Este script no es complejo y agradecemos las mejoras. Al explorar el espacio problemático de los ataques de batching en GraphQL, encontramos que hay algunas publicacion...

CVE-2022-21894

baton drop CVE-2022-21894: Vulnerabilidad de omisión de la característica de seguridad de Secure Boot Las aplicaciones de arranque de Windows permiten que la configuración truncatememory elimine bloques de memoria que contienen rangos "persistentes" de datos serializados del mapa de memoria, lo q...

SSRF-Testing

I'm grateful for the support received by Tuta SSRF Server Side Request Forgery testing resources Quick URL based bypasses: http://google.com:80+&@127.88.23.245:22/[email protected]:80/ http://127.88.23.245:22/+&@google.com:[email protected]:80/...

CVE-2023-44770_ZenarioCMS--Reflected-XSS---Organizer-Alias

ZenarioCMS Reflected XSS v.9.4.59197 Author: Sergio Description: Cross Site Scripting vulnerability in ZenarioCMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias. Attack Vectors: Scripting a vulnerability in the sanitization of the...

CVE-2026-61424

CVE-2026-61424 — DJ-Classifieds = 3.11.1 imageupload Task → No Auth → 3-String Filter Bypass Overview Unauthenticated arbitrary file upload in DJ-Classifieds for Joomla. The imageupload task endpoint processes file uploads without authentication and relies on a 3-string blocklist ?php, eval, base...

recollapse

REcollapse REcollapse es una herramienta auxiliar para el fuzzing de expresiones regulares en caja negra con el fin de evitar validaciones y descubrir normalizaciones en aplicaciones web. También puede ser útil para evadir WAF y mitigaciones débiles de vulnerabilidades. Para más información, echa...

CVE-2022-43704

CVE-2022-43704 - Channel Accessible by Non-Endpoint/Authentication Bypass by Capture-replay Sinilink XY-WFTX Wifi Remote Thermostat Module Temperature Controller Title Product Documentation Application User Manual Hardware Datasheets ESP8285 Buck Converter Firmware Product Description Overview WI...

CitrixBleedCVE-2026-8452-2025-5777

CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing. https://satoshi-box.com/pay/CSHeT8...

trape

trape estable v2.0 Rastreador de personas en Internet: Aprende a rastrear el mundo para evitar ser rastreado. Trape es una herramienta de análisis e investigación OSINT que permite a las personas rastrear y ejecutar ataques inteligentes de ingeniería social en tiempo real. Fue creada con el...

webrtc-ips

Richieste di indirizzi IP STUN per WebRTC Demo: https://diafygi.github.io/webrtc-ips/ Cosa fa Firefox e Chrome hanno implementato WebRTC, che consente di effettuare richieste a server STUN che restituiscono gli indirizzi IP locali e pubblici dell'utente. I risultati di queste richieste sono...

Popup-Maker < 1.8.12 - Broken Authentication

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the doaction function to invoke certain popmake or pum methods, as demonstrated by controlling content and delivery of popmake-system-info.txt aka the...

Apache ShenYu Admin JWT - Authentication Bypass

Apache ShenYu 2.3.0 and 2.4.0 allow Admin access without proper authentication. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. id: CVE-2021-37580 info: name: Apache ShenYu Admin JWT - Authentication Bypass author: pdteam severity: critical descriptio...