CVE-2026-11110-AES-GCM-Nonce-Reuse-Leading-to-Key-Recovery

CVE-2026-11110 – AES-GCM Nonce Reuse Leading to Key Recovery Program Code Python aesgcmnoncereusesim.py - Simulated encryption oracle with fixed nonce from Crypto.Cipher import AES import os key = os.urandom16 nonce = b'\x00' 12 ALWAYS SAME NONCE def encryptplaintext: cipher = AES.newkey,...

CVE-2015-9235_JWT_key_confusion

ENGLISH Description This application allows you to replace a value in a JSON Web Token JWT using the HMAC-SHA256 method to recalculate the signature. It takes as input a token, a key to replace, and the new value associated with that key. Usage Clone or download the application's source code. git...

RAMnesia-Attack

This research presents a comprehensive analysis of two critical classes of attacks on the hardware memory of modern computer systems using DDR5 memory: Phoenix Rowhammer Attack CVE-2025-6202 and RAMnesia Attack CVE-2023-39910 . Both attacks demonstrate fundamental vulnerabilities in the processin...

sadcloud

Sadcloud sadcloud is a tool for spinning up insecure AWS infrastructure with Terraform. It supports approx. 84 misconfigurations across 22 AWS Services. The inital set of misconfigurations were drawn from ScoutSuite, NCCGroup's Multi-cloud auditing tool. sadcloud was created to easily allow...

CVE-2021-40444

CVE-2021-40444 CVE-2021-40444 POC -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAu0enjPUx4R0+zWyY4FEI 0LUeiAJecPz6iDPdMRiIQHBPZBxKH7A+losAu7DB9IoY1GnGvFJzA1G4UkK6n/rg 2r65Ym3SloHoov/IxC2qcyz1UBftD0HBR8KE9Yy84k1sYIdNzKeWPQETY9UqEEy/...

database-druid

druid encode java -cp druid-1.1.19.jar com.alibaba.druid.filter.config.ConfigTools 密码 Example: java -cp druid-1.1.19.jar com.alibaba.druid.filter.config.ConfigTools jas502n...

CVE-2019-6693

CVE-2019-6693 Decrypt FortiGate configuration secrets Original advisory Vendor advisory For Fortigate VM/appliances below versions 6.2.0, 6.0.0 to 6.0.6, 5.6.10 configuration secrets are stored encrypted with a unique key. For versions above the non-default private-data-encryption parameter lets...

CVE-2025-10294

Exploit: Authentication Bypass via Empty ownidsharedsecret JWT Forgery 1 Forge a valid JWT using an empty HMAC key SUB= SUB="$SUB" python3 - /tmp/jwt.txt import base64, hmac, hashlib, json, time, os b64u = lambda b: base64.urlsafeb64encodeb.rstripb'='.decode header =...

CVE-2025-53770-Scanner

CVE-2025-53770 SharePoint Vulnerability Scanner 100% hacked together with all the tweets floating around with payloads and different attacks, so comes with zero warranty etc. The scanner is designed to identify vulnerable instances and has a config with known uses in the wild of exploitation, it'...

CVE-2026-115408

In github.com/eclipse-keypont/crypto11/v2 versions = 2.0.0-rc3, = 2.0.0-rc8, the ML-KEM key-pair lookup functions FindMLKEMKeyPair, FindMLKEMKeyPairs, FindMLKEMKeyPairsWithAttributes locate the public half of an ML-KEM key pair by CKAID/CKALABEL and never verify it against the private key. In...

CVE-2026-75431_PowerJob_jwt_key_predictable

PowerJob JWT Signing Key Predictable Key Derived from Default JDBC URL → Token Forgery 1. Summary The PowerJob Server's JWT HS256 signing key is derived by BASE64-decoding a hardcoded constant concatenated with the MD5 of the default JDBC URL DefaultSecretProvider / JwtServiceImpl. The JDBC URL i...

EUVD-2026-110816

In github.com/eclipse-keypont/crypto11/v2 versions = 2.0.0-rc3, = 2.0.0-rc8, the ML-KEM key-pair lookup functions FindMLKEMKeyPair, FindMLKEMKeyPairs, FindMLKEMKeyPairsWithAttributes locate the public half of an ML-KEM key pair by CKAID/CKALABEL and never verify it against the private key. In...

CVE-2026-21009-ECDSA-Nonce-Reuse-in-IoT-Firmware-Signing

CVE-2026-21009 – ECDSA Nonce Reuse in IoT Firmware Signing Program Code Python ecdsanoncereusesim.py - Signing firmware with repeated nonce k import ecdsa, hashlib sk = ecdsa.SigningKey.generatecurve=ecdsa.NIST256p vk = sk.getverifyingkey Sign two different firmware images with same nonce due to...

reposcanner

Reposcanner Reposcanner is a python script to search through the commit history of Git repositories looking for interesting strings such as API keys, inspired by truffleHog. Installation The python Git module is required python3-git on Debian. Docker docker build -t reposcanner . docker run -it...

whatsapp-media-decrypt

WhatsApp Media Decrypt A recent high-profile forensic investigation reported that “due to end-to-end encryption employed by WhatsApp, it is virtually impossible to decrypt the contents of the downloader .enc file to determine if it contained any malicious code in addition to the delivered video.”...

CVE_2021_27850_POC

Usage git clone https://github.com/Ovi3/CVE202127850POC.git cd CVE202127850POC/ gradlew runnbaleJar java -jar ./build/libs/CVE202127850POC-1.0-SNAPSHOT.jar Usage: java TapestryExploit Tapestry Key DNS URL java TapestryExploit Tapestry Key CB2 Command Assuming the HMAC key is change this immediate...

terrapod-PoC

Terrapod: security advisory CVE status: requested, pending assignment. This finding is published as GHSA-6qrc-597p-mrp9. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-terrapod-PoC and this banner is replaced with the CVE link. | ---|--- Researcher| Dostxodjayev Abdullox @squeeze440...

CVE-2024-51378

CVE-2024-51378 — Summary, Mitigation, and Documentation Safe Repository ⚠️ Ethical & legal warning All materials in this repository are for educational purposes, legitimate security research, and testing on environments you own or have explicit permission. Do not run these tools or scripts against...

GrafXploit

Automated Exploit Tool for Grafana CVE-2021-43798 Overview This project is an automated exploit tool designed to scan for and extract sensitive information from compromised Grafana instances vulnerable to CVE-2021-43798. The tool identifies vulnerable plugins and extracts SSH keys from compromise...

CVE-2026-11109-Bluetooth-Classic-KNOB-Attack-Key-Negotiation-of-Bluetooth-

CVE-2026-11109 – Bluetooth Classic KNOB Attack Key Negotiation of Bluetooth Program Code Python Simulated knobattacksim.py - Simulates negotiation of encryption key size to 1 byte import random, hashlib class BluetoothDevice: def negotiatekeysizeself, proposedsize: Vulnerable: accepts any key siz...