CVE-2023-51764

CVE-2023-51764 Postfix SMTP Smuggling - Expect Script POC send an email that is legitimate, but inside the email there is many others emails different senders, recipients, subjet, etc. The initial email is check for SPF/DKIM/DMARC, the others inside are not ! usage: ./cve-2023-51764.sh mx.fqdn po...

EUVD-2026-112299

MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every leve...

CVE-2025-67733

RESP Protocol Injection PoC Proof-of-concept demonstrating RESP Protocol Injection vulnerability via Lua script error messages in Valkey/Redis. Files backend.py Flask backend simulating a web application with shared Valkey connection connection pooling. Endpoints: Method| Endpoint| Description...

CVE-2026-116267

The MIME::Parser module for Perl (versions before 5.521 ) is vulnerable to memory exhaustion due to an inefficient algorithmic complexity issue (CWE-407 ). The parser indents stored diagnostics by three spaces per nesting level. When a message nested $N$ levels deep is truncated without closing b...

EvilSlackbot

EvilSlackbot A Slack Attack Framework for conducting Red Team and phishing exercises within Slack workspaces. Disclaimer This tool is intended for Security Professionals only. Do not use this tool against any Slack workspace without explicit permission to test. Use at your own risk. Background...

CVE-2023-31902

CVE-2023-31902 — Mobile Mouse 3.6.0.4 Remote Code Execution Summary: Mobile Mouse is a Windows application that turns your phone into a mouse/keyboard over the network. It listens on port 9099 TCP and 35913 WebSocket with no authentication by default. The vulnerability allows an unauthenticated...

FOQUZ Platform Information Disclosure

The vulnerability of the FOQUZ platform is related to the disclosure of information in debugging messages. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality of the protected information...

TLS-Attacker

TLS-Attacker TLS-Attacker is a Java-based framework for analyzing TLS libraries. It is able to send arbitrary protocol messages in an arbitrary order to the TLS peer, and define their modifications using a provided interface. This gives the developer an opportunity to easily define a custom TLS...

cve-2016-1764

PoC Exploit Code for CVE-2016-1764 Recovery of Plaintext iMessage Data Without Breaking Crypto Authors Shubham Shah from Bishop Fox Joe DeMesy from Bishop Fox Matthew Bryant CVE-2016-1764 Vendor: Apple Release Date: April 8, 2016 Patch Date: March 21, 2016 Systems Affected: Messages on OSX Mounta...

CVE-2026-31281

CVE-2026-31281 Description Totara LMS is vulnerable to HTLM Injection. An attacker can inject malicious HTLM code in a message and send it to all the users in the application, resulting in executing the code and may lead to session hijacking and executing commands on the victim's browser CVSS 3...

twittor

Twittor A stealthy Python based backdoor that uses Twitter Direct Messages as a command and control server This project has been inspired by Gcat which does the same but using a Gmail account. Setup For this to work you need: A Twitter account Use a dedicated account! Do not use your personal one...

CVE-2025-51400

Exploit Title: LiveHelperChat 4. Save the changes. 5. Try to use the personal canned message, the cross site scripting xss will execute. !...

libtaxii

libtaxii A Python library for handling Trusted Automated eXchange of Indicator Information TAXII™ v1.x Messages and invoking TAXII Services. :Source: https://github.com/TAXIIProject/libtaxii/ :Documentation: https://libtaxii.readthedocs.io/ :Information: https://taxiiproject.github.io/ :Download:...

spring-boot-log4j-cve-2021-44228-docker-lab

Spring Boot Log4j - CVE-2021-44228 The Log4Shell vulnerability CVE-2021-44228 ultimately is a quite simple JNDI Injection flaw, but in a really really bad place. Log4J will perform a JNDI lookup while expanding placeholders in logging messages or indirectly as parameters for formatted messages...

Copy-Fail-CVE-2026-31431-Statically-PoC

Copy-Fail CVE-2026-31431 Static Go PoC This repository contains a Go port of the public Python proof of concept from theori-io/copy-fail-CVE-2026-31431. The program is Linux-only. It uses the Linux AFALG interface, AEAD control messages, and splice2 to preserve the behavior of the original PoC...

CFB

What is it? !CAUTION CFB is meant for research and debug purposes, it should never be used on production systems. Also BSoD may happen. You've been warned. Canadian Furious Beaver is a ProcMon-style tool designed only for capturing IRPs sent to any Windows driver. It operates in 2 parts: 1. the...

CVE-2020-17008

CVE-2020-17008 splWOW64 Elevation of Privilege C:\Windows\splwow64.exe Poc From: https://bugs.chromium.org/p/project-zero/issues/detail?id=2096 0x01 set splwow64poc.exe Low cd splwow64poc\x64\Release icacls splwow64poc.exe /setintegritylevel L /setintegritylevel CIOI级别将完整性 ACE 显式...

Wildfire

CVE-2026-39154 · Stored XSS in CometChat group messages JS SDK 3.0.12 This directory holds an honest, self-contained reproduction of the render sink behind CVE-2026-39154: a stored cross-site scripting defect in the CometChat JavaScript SDK 3.0.12, where a group message's data.text field is...

CVE-2026-118175

The Thunderbird email client is vulnerable to a flaw where replying to, forwarding, or editing a crafted email message as new can cause the application to embed parts of a different message stored in the same folder into the new message. This occurs without displaying a blocked content warning. I...

Malware in @tableau__catalog-messages/database_lower

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...