CFB

What is it? !CAUTION CFB is meant for research and debug purposes, it should never be used on production systems. Also BSoD may happen. You've been warned. Canadian Furious Beaver is a ProcMon-style tool designed only for capturing IRPs sent to any Windows driver. It operates in 2 parts: 1. the...

EvilSlackbot

EvilSlackbot A Slack Attack Framework for conducting Red Team and phishing exercises within Slack workspaces. Disclaimer This tool is intended for Security Professionals only. Do not use this tool against any Slack workspace without explicit permission to test. Use at your own risk. Background...

TLS-Attacker

TLS-Attacker TLS-Attacker is a Java-based framework for analyzing TLS libraries. It is able to send arbitrary protocol messages in an arbitrary order to the TLS peer, and define their modifications using a provided interface. This gives the developer an opportunity to easily define a custom TLS...

CVE-2024-12139

The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application. By exploiting this vulnerability, malicious actors can inject...

EUVD-2024-55841

The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application. By exploiting this vulnerability, malicious actors can inject...

CVE-2026-120425

Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify. via POST...

FOQUZ Platform Information Disclosure

The vulnerability of the FOQUZ platform is related to the disclosure of information in debugging messages. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality of the protected information...

CVE-2026-120425 Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint

Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify. via POST...

CVE-2026-120425

Chatify versions before 1.6.4 are vulnerable to an authorization bypass in the Pusher channel authorization endpoint. An authenticated attacker can subscribe to another user's private channels by supplying arbitrary channel names via a POST request to /chat/auth. This flaw allows the attacker to ...

EUVD-2026-115234

Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify. via POST...

twittor

Twittor A stealthy Python based backdoor that uses Twitter Direct Messages as a command and control server This project has been inspired by Gcat which does the same but using a Gmail account. Setup For this to work you need: A Twitter account Use a dedicated account! Do not use your personal one...

WordPress User Messages <= 1.2.4 - Reflected XSS

WordPress User Messages plugin = 1.2.4 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires victim to load a...

bind9.18 security update

An update is available for bind9.18. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Na...

CVE-2025-51400

Exploit Title: LiveHelperChat 4. Save the changes. 5. Try to use the personal canned message, the cross site scripting xss will execute. !...

CVE-2025-14847-MongoBleed-Exploit

CVE-2025-14847 - MongoBleed 👨‍💻 Author: Furkan KAYAPINAR @FurkanKAYAPINAR ⚠️ EDUCATIONAL PURPOSE ONLY Lab environment and exploit script for the critical unauthenticated memory-leak vulnerability in MongoDB Server. 📋 Table of Contents Vulnerability Overview Affected Versions Installation Lab...

cve-2016-1764

PoC Exploit Code for CVE-2016-1764 Recovery of Plaintext iMessage Data Without Breaking Crypto Authors Shubham Shah from Bishop Fox Joe DeMesy from Bishop Fox Matthew Bryant CVE-2016-1764 Vendor: Apple Release Date: April 8, 2016 Patch Date: March 21, 2016 Systems Affected: Messages on OSX Mounta...

CVE-2026-28956-jxl-messages-surface

JPEG XL auto-decodes in the iOS Messages preview path A delivery-surface finding for CVE-2026-28956 AppleJPEGXL, plus the patch-diff attribution and a reliability reality-check on the public PoC. TL;DR — Conventional wisdom and our own prior measurement with EXR is that iOS Messages renders...

libtaxii

libtaxii A Python library for handling Trusted Automated eXchange of Indicator Information TAXII™ v1.x Messages and invoking TAXII Services. :Source: https://github.com/TAXIIProject/libtaxii/ :Documentation: https://libtaxii.readthedocs.io/ :Information: https://taxiiproject.github.io/ :Download:...

Ghost CMS - User Enumeration

Ghost CMS 5.9.4 contains a user enumeration vulnerability in the login functionality. The application reveals whether a user account exists through different error messages, allowing attackers to enumerate valid user accounts via specially-crafted HTTP requests. id: CVE-2022-41697 info: name: Gho...

Log4Shell-CVE-2021-44228

Exploiting Log4Shell CVE-2021-44228: A Complete, Modern Demonstration Lab Log4Shell CVE-2021-44228 is one of the most impactful remote code execution vulnerabilities ever disclosed. It affects Apache Log4j 2 , a widely used Java logging framework, and allows attackers to execute arbitrary code by...