awesome-security

Awesome Security A collection of awesome software, libraries, documents, books, resources and cool stuff about security. Inspired by awesome-php, awesome-python. Thanks to all contributors, you're awesome and wouldn't be possible without you! The goal is to build a categorized community-driven...

CVE-2026-113490

The GeoDirectory WordPress plugin versions prior to 2.8.194 is vulnerable to an unauthorized information disclosure. The application fails to perform adequate status or ownership checks when rendering a listing's map-popup via its single-item REST routes . This allows unauthenticated users to acc...

CVE-2025-69985

CVE-2025-69985: Exploit for Authentication Bypass to RCE in FUXA ≤1.2.8 📌 General Description This repository contains a Proof of Concept PoC and detailed technical documentation about the vulnerability CVE-2025-69985 , which affects FUXA versions ≤1.2.8. The vulnerability allows an unauthenticat...

JSScanner

JSScanner You can find the article related to this script here https://securityjunky.com/scanning-js-files-for-endpoint-and-secrets/ To install the required tools use bash install.sh Change the alive.txt with the domains you need to test. These should be in below format http://example.com...

CVE-2023-23752-Docker

CVE-2023-23752 Joomla Unauthorized Access Vulnerability CVE-2023-23752 Dockerized Installation Recommended automatic 1. Clone this repo git clone https://github.com/karthikuj/CVE-2023-23752-Docker.git 2. Change directory cd CVE-2023-23752-Docker 3. Run ./setup.sh 4. Open your browser and go to...

EDRception

See: https://malwaretech.com/2023/12/silly-edr-bypasses-and-where-to-find-them.html...

cve-2026-60004

CVE-2026-60004 — Gitea = 1.27.0 Pre-Auth Remote Code Execution Description CVE-2026-60004 is a critical vulnerability CVSS 9.8 in Gitea that allows unauthenticated remote code execution via the /api/v1/repos/owner/repo/diffpatch endpoint. Tools 1. Detector detector.py Detects whether a Gitea...

Prommetrix

Info: Prommetrix is a free software tool to obtain relevant information from the instances of 'Node Exporter' executed by 'Prometheus'. Prometheus is an open-source, metrics-based event monitoring and alerting solution for cloud applications. It is used by nearly 800 cloud-native organizations...

CVE-2024-54679

CVE-2024-54679 CVE-2024-54679 - CyberPanel aka Cyber Panel Denial of Service Description A denial of service DoS vulnerability was discovered in Cyber Panel that allows any authenticated user to restart the database by sending requests to the /dataBases/restartMySQL endpoint. This vulnerability...

Mass-CVE-2025-3248

Langflow CVE-2025-3248 Exploit Tool Overview This tool exploits the critical Remote Code Execution RCE vulnerability CVE-2025-3248 found in Langflow versions prior to 1.3.0. The vulnerability exists in the /api/v1/validate/code endpoint which improperly executes user-supplied code without...

CVE-2024-2389

Progress Kemp Flowmon CVE-2024-2389 Description This repository contains a Python script to exploit a vulnerability in Flowmon that allows for gaining a reverse shell on the target system. The exploit leverages a flaw in the service.pdfs/confluence endpoint to execute arbitrary commands on the...

CVE-2021-21234

CVE-2021-21234 CVE-2021-21234 Spring Boot Directory Traversal spring-boot-actuator-logview adds a simple log file viewer as a spring boot actuator endpoint in a library. It is the maven package "eu.hinsch:spring-boot-actuator-logview". A directory traversal vulnerability exists in...

cve-2019-12750

Symantec Local Privilege Escalation - CVE-2019-12750 Based on the excellent writeup by Kyriakos Economou: https://labs.nettitude.com/blog/cve-2019-12750-symantec-endpoint-protection-local-privilege-escalation-part-1/ Only x64 and older Windows versions are supported for now...

CVE-2020-14179

CVE-2020-14179 Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint Priority: High Affects Version/s: 8.6.0 | 8.8.0 | 8.5.5 | 8.9.0 | 8.10.0 | 8.11.0 Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names a...

CVE-2026-38526-PoC-htb-nexus

CVE-2026-38526-PoC-htb-nexus A PoC script for CVE-2026-38526, RCE via a file upload vulnerability in the /admin/tinymce/upload endpoint of webkul krayin 2.2.x built for htb-nexus 🛠 Quick start and Usage 1. Clone the repository: git clone https://github.com/Resolvdd/CVE-2026-38526-PoC-htb-nexus.gi...

CVE-2022-22947-POC

Spring-Cloud-Gateway-CVE-2022-22947 Security advisory for a remote code execution vulnerability in Spring Cloud Gateway. When Spring Cloud Gateway is enabled and the Gateway Actuator endpoint is exposed, applications using Spring Cloud Gateway are susceptible to code injection attacks. An attacke...

changedetection.io

Detect Website Changes Automatically — Monitor Web Page Changes in Real Time Monitor websites for updates — get notified via Discord, Email, Slack, Telegram, Webhook and many more. Detect web page content changes and get instant alerts. Ideal for monitoring price changes, content edits, condition...

gundog

gundog gundog - PowerShell based guided hunting in Microsoft 365 Defender Gundog provides you with guided hunting in Microsoft 365 Defender. Especially if not only for Email and Endpoint Alerts at the moment. Functionality You provide an AlertID you might received via Email notification and gundo...

CVE-2019-2615

CVE-2019-2615 GET /beawlsmanagementinternal2/wlmanagement HTTP/1.1 Host: 192.168.5.137:7001 User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64; rv:66.0 Gecko/20100101 Firefox/66.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/ ;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encodin...

CVE-2026-44596

CVE-2026-44596 — YAMCS No Rate Limiting on Authentication Endpoint Summary The authentication endpoint POST /auth/token in yamcs-core lacks any form of rate limiting, account lockout, or failed attempt throttling. An unauthenticated remote attacker can perform unlimited password guessing attempts...