cs253.stanford.edu

It is an offensive tool for web application security education. The repository contains a collection of assignments and exercises for the CS 253 Web Security course at Stanford University. The assignments are designed to educate students on various web security topics, including client-side...

Exploit for Code Injection in Foxcms

Day06 — FoxCMS-style RCE CVE-2025-29306 — Educational lab T...

MSc-Cybersecurity-Capstone-Android-Exploitation

MSc Cybersecurity Capstone Project Title: Android Exploit...

Exploit for Use After Free in Microsoft

CVE Analysis & Detection — PoCs, Snort Detection, and Mitigati...

Exploit for Incorrect Authorization in Vercel Next.Js

CVE-2025-29927 Research and Safe Testing Framework This repos...

WordPress Lab Theme <= 1.0.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme Lab versions = 1.0.0...

WordPress Lab Theme <= 1.0.0 is vulnerable to Local File Inclusion

Software Lab Type Theme Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID a830ef2cbee5 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity Require...

SQL Injection

apachesuperset is vulnerable to SQL Injection. The vulnerability is due to improper enforcement of the DISALLOWEDSQLFUNCTIONS security feature, which allows an attacker with SQL Lab access to circumvent the denylist using a special inline block and execute restricted SQL functions...

Exploit for CVE-2025-23266

cve-2025-23266-migration-bypass cve...

Exploit for SQL Injection in Sangoma Freepbx

Work in Progress FreePBX CVE-2025-57819 Lab - Unauth SQLi →...

Exploit for Unrestricted Upload of File with Dangerous Type in Codedropz Drag_And_Drop_Multiple_File_Upload_-_Contact_Form_7

CVE-2025-3515 WordPress Lab Drag and Drop Multiple File Uploa...

CVE-2025-57778

There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid source address when parsing a DSB file with Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a...

I’m Spending the Year at the Munk School

This academic year, I am taking a sabbatical from the Kennedy School and Harvard University. It's not a real sabbatical--I'm just an adjunct--but it's the same idea. I will be spending the Fall 2025 and Spring 2026 semesters at the Munk School at the University of Toronto. I will be organizing a...

Citizen Lab Reports Hidden VPN Networks Sharing Ownership and Security Flaws

Citizen Lab's new report, Hidden Links, uncovers a network of VPN providers like Turbo VPN and VPN Monster…...

BIT-SUPERSET-2025-55674 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

A bypass of the DISALLOWEDSQLFUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leadi...

Exploit for CVE-2025-54253

CVE-2025-54253 Adobe AEM OGNL Injection Simulated PoC Lab !...

Malicious code in bigbank-ui-lab (npm)

The package bigbank-ui-lab was found to contain malicious code...

MAL-2025-25038 Malicious code in leadconduit-national-renewable-energy-lab (npm)

The package leadconduit-national-renewable-energy-lab was found to contain malicious code...

MAL-2025-15671 Malicious code in bigbank-ui-lab (npm)

The package bigbank-ui-lab was found to contain malicious code...

Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions

A bypass of the DISALLOWEDSQLFUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leadi...