CVE-2021-24891-Simulation

A hands-on, containerized lab environment to simulate and exploit a DOM-based Cross-Site Scripting XSS vulnerability in the Elementor Website Builder WordPress plugin, identified as CVE-2021-24891. 📖 About The Vulnerability This lab demonstrates a DOM-based Cross-Site Scripting XSS vulnerability ...

cs-get-last-error

cs-get-last-error Obtain error messages from GetLastError codes directly inside the Cobalt Strike client without the help of Google search, net helpmsg, or Microsoft Error Lookup Tool. The error messages are included in the aggressor script, and no interaction with the beacon is required. The...

JQueryingU

JQueryingU NOTES: Base client side detection code created by Christian Ludwig https://jsfiddle.net/ChristianL/AVyND/, and used by APT 29 in 2016. APT 29 modified the popup to be a POST request and used it during a conference shadowing campaign to profile user systems and who clicked before sendin...

beef

Copyright c 2006-2026 Wade Alcorn - [email protected] Browser Exploitation Framework BeEF - https://beefproject.com Vedi il file 'doc/COPYING' per i permessi di copia =============================================================================== Cos'è BeEF? BeEF è l'acronimo di The Browser...

ppfuzz

ppfuzz Fuzzer de Contaminación de Prototipos Una herramienta rápida para escanear vulnerabilidades de contaminación de prototipos del lado del cliente escrita en Rust. 🦀 Instalación Binario Fuente Dependencias Demostración Uso Básico Opciones Uso Materiales de apoyo Contribuciones Atribución...

CVE-2024-57175

CVE-2024-57175: Stored Cross-Site Scripting XSS in PHPGURUKUL Online Birth Certificate System v1.0 Description A stored Cross-Site Scripting XSS vulnerability was identified in PHPGURUKUL Online Birth Certificate System v1.0 in the /user/certificate-form.php page. This vulnerability allows...

CVE-2024-41290

CVE-2024-41290 FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data Additional Information: FlatPress CMS version 1.3.1 insecurely stores authentication-related data, including usernames and hashed passwords, directly in client-side cookies. This practice...

CVE-2025-45620

Detalles del problema La cámara modelo PTC310UV2 ejecuta la versión de firmware 0.1.0000.59. La vulnerabilidad se encuentra en la interfaz web que se utiliza para acceder a la cámara. La vulnerabilidad se descubrió durante una prueba de penetración, por lo que cierta información en las capturas d...

CVE-2022-29361_Werkzeug_Client-Side-Desync-to-XSS

Credits to @kevin-mizu https://github.com/kevin-mizu/Werkzeug-CVE-2022-29361-PoC/tree/main for details read: https://mizu.re/post/abusing-client-side-desync-on-werkzeug Tested On Chromium 119.0.6045.123 built on Debian trixie/sid, running on Debian kali-rolling...

CVE-2025-1910-WatchGuard-Privilege-Escalation

WatchGuard Mobile VPN with SSL Client Privilege Escalation CVE-2025-1910 A privilege escalation vulnerability in WatchGuard's Mobile VPN with SSL MD5SUM Pack into a .wgssl file tar -czf ../clientexploit.wgssl client.ovpn MD5SUM run.bat cd .. 5. Serve the malicious client.wgssl file via flask: Sta...

EUVD-2026-95893

Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. Hayat Hospital Hayat Mobile allows Authentication Bypass. This issue affects Hayat Mobile: from 3.3.0 before 3.4.0...

Rogue-MySql-Server

Rogue-MySql-Server Edit script and change file to read and server port if you want. Run script and connect to your server for read file from client side. Read mysql.log for readed file content...

CVE-2021-41579-LCDS-LAquis-SCADA-4.3.1.1085-Arbitrary-File-Write

LAquis SCADA Arbitrary File Write 👨‍💻 Author Mohammed Idrees Banyamer 🐦 Instagram: @banyamersecurity Proof-of-Concept exploit for CVE-2021-41579 - Arbitrary file write via malicious .els project file in LCDS LAquis SCADA ≤ 4.3.1.1085. 🚨 Vulnerability Description CVE-2021-41579 is a client-side...

CVE-2025-56800

CVE-2025-56800 Local Authentication Bypass Vulnerability in Reolink Desktop Application 1. Overview Name : Reolink Desktop Application Version : 8.18.12 Vendor : Reolink CWE : CWE-290: Authentication Bypass by Spoofing CVSS : 5.1 MEDIUM Vector String : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N...

JS-Secret-Hunter

JS Secret Hunter V2 🕵️‍♂️ JS Secret Hunter is an advanced Python tool designed for security researchers to automate the detection of hardcoded secrets in client-side JavaScript. Unlike simple scanners, V2 includes a dynamic crawler that parses the HTML of the target website to extract all loaded...

cve-2024-26229

cve-2024-26229 A nim version of the now outdated Windows LPE vulnerability abusing CSC. This is for educational purposes only, and refer to the patch list to determine whether or not your system/your target is vulnerable. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26229 Usage...

OmniSec-Hex

🛡️ OmniSec-Hex OmniSec-Hex is an advanced, high-impact cybersecurity monorepo consolidating six powerhouse client-side security and sovereign intelligence workbanks. Operating entirely within browser-local memory environments with absolute data lockdown, this ecosystem delivers cross-vertical...

GHSA-89VP-X45C-52CQ Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

Summary A DOM Clobbering vulnerability exists in Quasar's openURL utility when handling the iOS SafariViewController bridge. The vulnerable implementation only checks whether window.SafariViewController exists before invoking it as a native bridge object. An attacker who can inject HTML content...

Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

Summary A DOM Clobbering vulnerability exists in Quasar's openURL utility when handling the iOS SafariViewController bridge. The vulnerable implementation only checks whether window.SafariViewController exists before invoking it as a native bridge object. An attacker who can inject HTML content...

NPM: Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

NPM: Quasar Framework: DOM Clobbering in Quasar openURL SafariViewController Integration Causes Client-Side Denial of Service vulnerability discovered by ? in WordPress Npm quasar versions = 2.32.1...