EUVD-2026-102601

Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct...

CVE-2026-111448

Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct...

novahot

novahot novahot is a webshell framework for penetration testers. It implements a JSON-based API that can communicate with trojans written in any language. By default, it ships with trojans written in PHP, ruby, and python. Beyond executing system commands, novahot is able to emulate interactive...

TeleShadow3

TeleShadow3 Teleshadow3- Advanced Telegram Desktop Session Hijacker! Download Click HERE to download the latest version! Screenshot Stealing desktop telegrams has never been so easy ! Set the email and sender details of the sender and recipient or use Telegram API! and send it to the victim after...

CVE-2026-104769

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.3.0 . The flaw exists in the 's' parameter and allows an unauthenticated visitor to read arbitrary files on the server, potentially exposing sensitive infor...

sub404

Sub404: A Fast Tool To Check Subdomain Takeover Vulnerability What is Sub 404 Sub 404 is a tool written in python which is used to check possibility of subdomain takeover vulnerability and it is fast as it is asynchronous. Why During recon process you might get a lot of subdomainse.g more than 10...

exploit-grafana-CVE-2021-43798

CVE-2021-43798 – Grafana Exploit About This is a proof-of-concept exploit for Grafana's Unauthorized Arbitrary File Read Vulnerability CVE-2021-43798. This vulnerability affects Grafana 8.0.0-beta1 to 8.3.0. According to Shodan data, there are just over 2,000 Grafana servers exposed online, with...

SharpML

SharpML SharpML is a proof of concept file share data mining tool using Machine Learning in Python and C. The tool is discussed in more detail on our blog here, but is summarised below also: SharpML is C and Python based tool that performs a number of operations with a view to mining file shares,...

rip_raw

Rip Raw Rip Raw is a small tool to analyse the memory of compromised Linux systems. It is similar in purpose to Bulk Extractor, but particularly focused on extracting system Logs from memory dumps from Linux systems. This enables you to analyse systems without needing to generate a profile. This ...

columbus-server

Columbus server This repository is deprecated! ‼️ The server component is moved to https://github.com/elmasy-com/columbus. Columbus Project is an API first subdomain discovery service, blazingly fast subdomain enumeration service with advanced features. Subdomain Lookup Columbus returned 638...

tscopy

TScopy Updated 2022-03-31 Introducing TScopy It is a requirement during an Incident Response IR engagement to have the ability to analyze files on the filesystem. Sometimes these files are locked by the operating system OS because they are in use, which is particularly frustrating with event logs...

S2-045-EXP-POC-TOOLS

CNVD-ID CNVD-2017-02474 Release Date 2017-03-07 Hazard Level High AV:N/AC:L/Au:N/C:C/I:C/A:C Affected Products Apache Struts =2.3.5, =2.5, CVE Identifier CVE-2017-5638 Problem It is possible to perform a RCE attack with a malicious Content-Type value. If the Content-Type value...

CVE-2024-50379

Manual exploitation is troublesome, so I whipped up an exp.. Usage: shell.jsp is the shell file, ggsl.jsp is the name/path saved to the target server. ./CVE-2024-50379 -u http://192.168.2.245:8080 -f shell.jsp -p ggsl.jsp Disclaimer This tool is only intended for legally authorized enterprise...

PSRansom

PSRansom PSRansom is a PowerShell Ransomware Simulator with C2 Server capabilities. This tool helps you simulate encryption process of a generic ransomware in any system on any system with PowerShell installed on it. Thanks to the integrated C2 server, you can exfiltrate files and receive client...

TeleShadow2

TeleShadow 2 Teleshadow2- Advanced Telegram Desktop Session Hijacker! Stealing desktop telegrams has never been so easy ! Set the email and sender details of the sender and recipient or use Telegram API! and send it to the victim after compiling. How do I use the session file? Delete everything...

atomic-operator

license atomic-operator This python package is used to execute Atomic Red Team tests Atomics across multiple operating system environments. What's new? Why? atomic-operator enables security professionals to test their detection and defensive capabilities against prescribed techniques defined with...

Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read

Gitea versions 1.22.1 through 1.27.0 initialize the go-org markup renderer without replacing its default ReadFile callback. An unauthenticated attacker can submit Org-mode markup containing an +INCLUDE directive with an absolute path to the repository markup endpoint of any public repository,...

Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read

Atlassian products including Jira, Confluence, and Bitbucket Data Center contain a pre-authentication arbitrary file read vulnerability in the shared atlassian-plugins-webresource library. The library improperly handles double colons :: as path separators in the resource routing, allowing...

Request Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload

Request a Quote for WooCommerce plugin for WordPress = 2.9.2 contains an unrestricted file upload vulnerability caused by missing file extension and MIME type validation in afrfqsubmitquoteviapopup, letting unauthenticated attackers upload executable files, exploit requires enabled public quote...

scavenger

scavenger scavenger : is a multi-threaded post-exploitation scanning tool for scavenging systems, finding most frequently used files and folders as well as "interesting" files containing sensitive information. Problem Definition: Scavenger confronts a challenging issue typically faced by...