meshtastic-cve-2025-52464-poc

Meshtastic CVE-2025-52464 Proof of Concept Overview This project is a software-only proof of concept demonstrating CVE-2025-52464 , a vulnerability affecting Meshtastic firmware versions 2.5.0 to 2.6.10. The implementation reproduces the cryptographic behaviour of the vulnerable firmware and...

heartbleed

Heartbleed Bug Description of the scenario The Heartbleed bug is an example of a cybersecurity attack that exploits a vulnerability in the OpenSSL library. Briefly, a missing validation step in the OpenSSL library could allow a hacker to access sensitive information on a server that is using the...

CVE-2021-29349

CVE-2021-29349 CVE-2021-29349 CSRF to remove all messages in Mahara 20.10 Payload and Credit https://github.com/0xBaz...

CVE-2026-70481

CVE-2026-70481 Open WebUI, affected 0.5.0 through 0.10.2, patched in 0.11.0. Moderate, CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-284 and CWE-862. In backend/openwebui/routers/channels.py the message update and delete handlers branch on the channel type, and the two branches ask...

SAMLRaider

SAML Raider - SAML2 Burp Extension Description SAML Raider is a Burp Suite extension for testing SAML infrastructures. It contains two core functionalities: Manipulating SAML Messages and manage X.509 certificates. This software was originally created by Roland Bischofberger and Emanuel Duss...

CVE-2025-56764

CVE-2025-56764 — Trivision NC-227WF Summary Trivision NC-227WF firmware 5.80 build 20141010 login mechanism reveals whether a username exists or not by returning different error messages "Unknown user" vs. "Wrong password", allowing an attacker to enumerate valid usernames. Referenced CVE record...

CVE-2026-84243

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid ATSECURE. An attacker who can set LANGUAGE in the environment of a program that uses gettext c...

CVE-2018-7747

CVE-2018-7747 CalderaForms 1.5.9.1 XSS WordPress plugin - tutorial CalderaForm is a WordPress plugin that makes it easy to create forms via drag and drop. During a recent engagement I happened to test some portals, one of which hosted a contact form created with this plugin. The custom...

CVE-2026-11110-AES-GCM-Nonce-Reuse-Leading-to-Key-Recovery

CVE-2026-11110 – AES-GCM Nonce Reuse Leading to Key Recovery Program Code Python aesgcmnoncereusesim.py - Simulated encryption oracle with fixed nonce from Crypto.Cipher import AES import os key = os.urandom16 nonce = b'\x00' 12 ALWAYS SAME NONCE def encryptplaintext: cipher = AES.newkey,...

EUVD-2026-114247

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid ATSECURE. An attacker who can set LANGUAGE in the environment of a program that uses gettext c...

CVE-2025-32433

CVE-2025-32433 A critical vulnerability in Erlang/OTP SSH server allows unauthenticated remote code execution RCE. The flaw exists in the SSH protocol message handling mechanism, enabling attackers to execute arbitrary commands without requiring authentication credentials. Impact Critical severit...

launchd-portrep

launchd-portrep launchd-portrep is an exploit for a port replacement vulnerability in launchd, the initial userspace process and service management daemon on macOS. By sending a crafted Mach message to the bootstrap port, launchd can be coerced into deallocating its send right for any Mach port t...

mallet

Mallet, a framework for creating proxies Mallet is a tool for creating proxies for arbitrary protocols, along similar lines to the familiar intercepting web proxies, just more generic. It is built upon the Netty framework, and relies heavily on the Netty pipeline concept, which allows the graphic...

BinProxy

Overview BinProxy is a proxy for arbitrary TCP connections. You can define custom message formats using the BinData gem. Installation Prerequisites Ruby 2.3 or later A C compiler, Ruby headers, etc., are needed to compile several dependencies. On Ubuntu, sudo apt install build-essential ruby-dev...

CVE-2026-23003-Cross-Chain-Bridge-Message-Forging-via-Missing-Origin-Chain-ID

CVE-2026-23003 – Cross‑Chain Bridge Message Forging via Missing Origin Chain ID Program Code Solidity + Python exploit // Bridge.sol - Vulnerable bridge contract contract Bridge mappingbytes32 = bool public processed; event Depositedaddress from, address to, uint256 amount, uint256 chainId;...

CVE-2023-21554-PoC

CVE-2023-21554 — QueueJumper PoC Proof of concept for CVE-2023-21554 , also known as QueueJumper , affecting Microsoft Message Queuing MSMQ. The PoC implements the MSMQ/SRMP protocol interaction associated with the vulnerability and can be used to investigate the behavior of an MSMQ service over...

toothfairy

toothfairy Related to brokentooth linked below. Unlike brokentooth, toothfairy does not require pressing buttons on the bluetooth menu. Both CVE's were revealed by @SparkZheng but with no POC so I decided to make a POC for the learning experience. The code is not perfect but it does the job. Test...

CVE-2023-27587-PoC

CVE-2023-27587-PoC The simple PoC of CVE-2023-27587 What is ReadToMyShoe? ReadtoMyShoe RTMS is a web application rust, yew and axum that lets you upload articles via URL or via directly pasting and listen to them later. Impact If an error occurs when adding an article, the website shows the user ...

CVE-2026-84600

CVE-2026-84600 Shortcuts Impact: A malicious shortcut may be able to send messages without user confirmation. Description: An authorization issue was addressed with improved state management. Products: iOS and iPadOS, macOS, tvOS, visionOS, watchOS Fixed In: iOS 27 and iPadOS 27 macOS Golden Gate...

CVE-2026-11117-WPA2-4-Way-Handshake-Reinstallation-KRACK-Sim-

CVE-2026-11117 – WPA2 4‑Way Handshake Reinstallation KRACK Sim Program Code Python kracksim.py - Simulates reinstallation of an already-used PTK import hashlib, os class AccessPoint: def initself: self.anonce = os.urandom32 self.ptk = None def sendmsg3self, snonce: Normally would install PTK, but...