NXLoader

NXLoader Launch Fusée Gelée payloads from stock Android. Get APK file here Heavily based on Fusée Gelée and ShofEL2. fusee.bin is bundled as a default payload Note: Any proprietary payloads are neither tested nor supported by this software. Does it work on your device? Please make it everyone kno...

django-connector-CVE-2025-64459-testbed

Django-CVE-2025-64459-Testbed A self-contained testbed for Django CVE-2025-64459. Demonstrates QuerySet.filter parameter injection via dictionary expansion using Docker. About the Vulnerability CVE-2025-64459 is a high-severity vulnerability in Django specifically versions 5.1.14 that allows...

CVE-2026-1492

CVE-2026-1492 User Registration & Membership = 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration 🔴 Vulnerability Overview CVE-2026-1492 — Unauthenticated Privilege Escalation via Membership Registration Description: The User Registration & Membership plugin for WordPress is...

Agent-Tesla-APC-Injection-Token-Manipulation-Registry-Persistence-Analysis

1. Native API & APC Injection The x64dbg memory dump reveals that Agent Tesla uses Native API NT API calls for low-level operations, including APC Asynchronous Procedure Call injection. Key Functions Observed: NtQueueApcThread – Injects code into a target thread via APC. NtReadVirtualMemory –...

CVE-2026-24061

GNU InetUtils telnetd Authentication Bypass via Argument Injection - CVE-2026-24061 📚 Introduction A recently identified argument injection vulnerability in GNU InetUtils telnetd allows attackers to circumvent authentication by setting the USER environment variable to the value “-f root”. As a...

Weblate-CVE-2026-24126

Weblate — قراءة ملفات تعسفية عبر حقن وسيط أمر SSH اكتشفه: Alejandro Baño · يناير 2026 اعترف به: ملاحظات إصدار Weblate 5.16 نظرة عامة تمرر نقطة نهاية إدارة مفاتيح SSH في Weblate معامل host المقدم من مسؤول مصادق مباشرة إلىssh-keyscan دون أي تنقية أو تحقق من الوسائط. نظرًا لأن ssh-keyscan يقبل علامة...

CVE-2026-32127_SqlInjectionVulnerabilityOpenEMR8.0.0

CVE-2026-32127 - SQL Injection Vulnerability in OpenEMR 8.0.0 Weakness CWE-89 Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not...

Fortinet-FortiWeb-Fabric-Connector-CVE-2025-25257-Detection

CVE-2025-25257 Detection Engineering Repository Overview This repository provides production-ready detection engineering content for CVE-2025-25257 , a pre-authentication SQL Injection vulnerability in Fortinet FortiWeb Fabric Connector versions 7.0 through 7.6.x. Successful exploitation can lead...

CVE-2026-33917_SqlInjectionVulnerabilityOpenEMR8.0.0

CVE-2026-33917 - ثغرة حقن SQL في OpenEMR الضعف CWE-89 تحييد غير سليم للعناصر الخاصة المستخدمة في أمر SQL حقن SQL يبني المنتج كل أمر SQL أو جزءًا منه باستخدام مدخلات متأثرة خارجيًا من مكوّن علوي upstream component، لكنه لا يحيد العناصر الخاصة أو يحيدها بشكل غير صحيح، وهي العناصر التي قد تعدّل أمر...

CVE-2024-25081_2025-47273

CVE-2024-25081 and CVE-2025-47273 Proof of Concept FontForge ≤ 20230101 version and Setuptools library Proof of concept for elevating privileges to the user running a task that uses Font Forge. The second CVE elevates privileges to root, provided you have write permissions to sensitive directorie...

CVE-2025-34037

CVE-2025-34037 Python port of the Linksys tmUnblock.cgi RCE exploit For educational use only. Run against your own devices. Vulnerability The tmUnblock.cgi endpoint on several Linksys router models accept POST requests without validating the Authorization header. the ttcpip parameter is passed...

GHSA-GCR2-9V8M-GQ45 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

Summary @dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of t...

EUVD-2026-63657

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core and fontSize/fontWeight in @dicebear/initials...

CVE-2025-8110

Gogs RCE एक्सप्लॉइट CVE-2025-8110 CVE-2025-8110 के लिए प्रूफ ऑफ कॉन्सेप्ट - सिमलिंक बायपास और sshCommand इंजेक्शन के माध्यम से Gogs में रिमोट कोड एक्ज़ीक्यूशन। विवरण यह एक्सप्लॉइट Gogs API में सिमलिंक बायपास का दुरुपयोग करके .git/config को ओवरराइट करता है और दुर्भावनापूर्ण sshCommand इंजेक्ट करता...

RocketChat-NoSQLi-Chain-CVE-2021-22911

Rocket.Chat NoSQLi Token Leak & Password Reset An automated exploit script for Rocket.Chat and Meteor-based applications that leverages a NoSQL Injection via the $where clause to leak password reset tokens through server-side exceptions. Once the token is leaked, the script performs an...

CVE-2014-4688-pfsense

CVE-2014-4688 – pfSense कमांड इंजेक्शन CVE-2014-4688 के लिए संशोधित Exploit-DB प्रूफ-ऑफ-कॉन्सेप्ट pfSense statusrrdgraphimg.php कमांड इंजेक्शन अवलोकन इस रिपॉजिटरी में CVE-2014-4688 के लिए मूल Exploit-DB प्रूफ-ऑफ-कॉन्सेप्ट का एक संशोधित संस्करण है, जो pfSense संस्करण ≤ 2.1.3 को प्रभावित करता है। य...

CVE-2025-54123

CVE-2025-54123 - Hoverfly Command Injection RCE PoC CVE-2025-54123 - Middleware Command Injection in Hoverfly 📌 CVE Details ID : CVE-2025-54123 Type : Command Injection / Remote Code Execution RCE Vendor : Hoverfly Impact : Allows authenticated attackers to execute arbitrary system commands via t...

EXPLOIT-CVE-2021-44228

CVE-2021-44228 — Log4Shell PoC Lab DISCLAIMER This lab was created exclusively for educational and security research purposes. All traffic occurs within an isolated Docker network. Do not use this material on real systems or without explicit authorization. Misuse may be a crime. Use responsibly...

-CTT-PAN-OS-EXPLOIT-CVE-2024-340

-CTT-PAN-OS-EXPLOIT-CVE-2024-340 CTT-PAN-OS-Exploit – Convergent Time Theory संवर्धन के साथ CVE-2024-3400 CVSS 10.0। Palo Alto GlobalProtect कमांड इंजेक्शन का शोषण करने के लिए α = 0.0302011 temporal dispersion, 33-परत phase resonance कैस्केड और 11 ns temporal wedge फ़िल्टरिंग का उपयोग करता है।...

CVE-2019-15107

Unauthenticated RCE via Webmin Backdoor CVE-2019–15107 Summary CVE: CVE-2019–15107 Affected Version: Webmin it will open an shell for you . Note: For versions 1.900–1.920, the “expired password changing” feature must be enabled for the backdoor to trigger. Version 1.890 is vulnerable in its defau...