CVE-2026-100694

A flaw was found in Hugo. When processing content files mapped to the Org Mode media type, Hugo renders raw HTML export blocks and snippets without proper escaping. An attacker who can influence or supply content files can exploit this vulnerability to conduct cross-site scripting XSS, executing...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416: Un QWORD de más en el montón del escritorio En la compilación Insider de Windows 11 10.0.28020.2149, la asignación en modo usuario del montón del escritorio de Win32k exponía un puntero sin procesar del grupo del kernel de sesión en el desplazamiento 0x100. La lectura en sí es cas...

kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released

A use-after-free vulnerability was identified in the Linux kernel framebuffer console fbcon subsystem. During framebuffer unregistration, the kernel freed the memory for a display mode but did not clear the corresponding fbdisplayi-mode pointer. Subsequent framebuffer ioctl operations could then...

CVE-2024-56426

Exynos 990 / Exynos9830 Unified BootROM Exploit Unified CVE-2024-56426 tooling for the Exynos 990 Galaxy S20, S20 FE, and Note20 families. The exploit accepts all ten model names and maps them onto six verified stock bootloader families. !CAUTION The tracked key bundle and generated images are...

TospoVirus

Compilación de TospoVirus para distribución: ./build.sh Distribución a un pineapple funcional con la versión 2.3: ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null [email protected] "mkdir /tospo" scp -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null dist/tv...

FullscreenBrowserPhishing

Phishing mediante el modo de pantalla completa en el navegador Para empezar, me gustaría señalar que el phishing es ilegal y este proyecto es solo con fines educativos. El proyecto en este repositorio es solo una PoC para mostrar cómo se puede hacer y por eso la versión pública tiene fallos : Dem...

vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling

A vulnerability in Vim's shell script plugins sh.vim, zsh.vim, ps1.vim allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters...

CVE-2018-13379

CVE-2018-13379 CVE-2018-13379 https://blog.orange.tw/2019/08/attacking-ssl-vpn-part-2-breaking-the-fortigate-ssl-vpn.html https://fortiguard.com/psirt/FG-IR-18-384 Las siguientes versiones de FortiOS eran vulnerables. FortiOS 5.6.3 to 5.6.7 FortiOS 6.0.0 to 6.0.4 ONLY if the SSL VPN service...

WiseDelete

Wrapper del Controlador WiseDelfile Una utilidad ligera de Windows que carga el controlador de kernel WiseDelfile64.sys , realiza el handshake de dispositivo requerido y envía solicitudes IOCTL para eliminar archivos que no pueden eliminarse mediante las API estándar de Windows. Este proyecto...

wyze-bulb-color-pwned

wyze-bulb-color-pwned Wireless exploit for the Wyze WLPA19CV2 color bulb Overview The Wyze Color WLPA19CV2 bulbs have a factory test mode which allows a custom OTA image to be flashed wirelessly through a specific sequence of power cycling. This project provides An implementation and guide to...

shadowhammer

Batch-mode shadowhammer MAC address checker Kaspersky recently discovered and analysed the 'Shadowhammer' attack https://securelist.com/operation-shadowhammer/89992. They did some great analysis and released a tool for sysadmins to use to determine if their systems were targetted. The released...

pentest-a2p2v-core

README Automated Attack Path Planning and Validation A2P2V is a planning and cyber-attack tool that provides the capability for users to determine a set of ranked attack sequences given a specific attacker goal. The aim of the tool is to simplify process so that non-security experts can generate...

CVE-2021-3129

CVE-2021-3129 CVE-2021-3129-Laravel Debug mode 远程代码执行漏洞 影响版本及条件 Laravel = 8.4.2 Ignition 2.5.2 环境搭建 docker pull vulhub/laravel:8.4.2 exp使用 在exploit.py同目录下下载执行 git clone https://github.com/ambionics/phpggc.git python3 exploit.py http://127.0.0.1:80 "whoami"...

Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865

¡Bienvenido a React Router! Una plantilla moderna y lista para producción para construir aplicaciones React completas usando React Router. Características 🚀 Renderizado del lado del servidor ⚡️ Reemplazo de Módulos en Caliente HMR 📦 Empaquetado y optimización de recursos 🔄 Carga y mutaciones de...

smuggler

root@kitploit: / | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler An HTTP Request Smuggling / Desync testing tool written in Python 3 Acknowledgements A special thanks to James Kettle for his research and methods into HTTP desyncs And a special thanks to...

Mini_httpd-CVE-2018-18778

minihttpd任意文件读取漏洞（CVE-2018-18778） Minihttpd是一个微型的Http服务器，在占用系统资源较小的情况下可以保持一定程度的性能（约为Apache的90%），因此广泛被各类IOT（路由器，交换器，摄像头等）作为嵌入式服务器。而包括华为，zyxel，海康威视，树莓派等在内的厂商的旗下设备都曾采用Minihttpd组件。 在minihttpd开启虚拟主机模式的情况下，用户请求http://HOST/FILE将会访问到当前目录下的HOST/FILE文件。 void snprintf vfile, sizeofvfile, "%s/%s", reqhostnam...

CVE-2026-59969

A flaw was found in Apache ZooKeeper. When operating in FIPS Federal Information Processing Standards mode with specific Transport Layer Security TLS settings enabled, ZooKeeper's quorum communication fails to properly verify the hostname of peer certificates. This vulnerability allows a maliciou...

PixelDump_CVE-2016-8462

PixelDump - CVE-2016-8462 PixelDump CVE-2016-8462 was one of Pixel bootloader vulnerabilities found/worked out by beaups and Jon 'jcase' Sawyer. Disclaimer This is a dirty POC that was never intended to be released, I just copied another project, spent a few minutes adding a few lines, and sent i...

CVE-2026-47883

CVE-2026-47883: PoC de Open Redirect en UrlHandlerFilter de Spring Framework Este repositorio es un PoC de reproducción mínima de CVE-2026-47883, publicado a través del aviso de seguridad oficial de Spring. Aviso oficial: https://spring.io/security/cve-2026-47883/ Título oficial: Spring Framework...

libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process

A flaw was found in Libreswan. An unauthenticated remote attacker can send a specially crafted X.509 certificate payload during an IKEv1 or IKEv2 exchange. This flaw occurs when Libreswan is operating in FIPS Federal Information Processing Standards mode and processing a certificate with an inval...