CVE-2021-44906

CVE-2021-44906 Originally from: https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip Run npm run hack And you will see the any function's done property is changed to true. The explanation of command line node index.js --.concat.constructor.prototype.done true:...

dcipher

dcipher Decipher hashes using online rainbow & lookup table attack services. Install ❯❯❯ npm install dcipher Usage const dcipher = require'dcipher'; dcipher'21232f297a57a5a743894a0e4a801fc3'.thenplaintext = console.logplaintext; //= 'admin' ;...

cve-lite-cli

Most tools tell you what's wrong. CVE Lite CLI tells you what to run. CVE Lite CLI 🏆 Officially recognized as anOWASP Lab Project Vulnerability scanning that starts in your terminal and fits cleanly into CI. Scan your lockfile, get copy-and-run fix commands, and ship clean code. Scan. Understand...

PDFkit-CMD-Injection

PDFkit-CMD-Injection CVE-2022-25765 Detail Description The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized. PoC Start a HTTP server 1- python3 -m http.server 80 Start a netcat listener 2- nc -lnvp 'Target Port' Make a request 3-...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit A security research tool for detecting and testing the CVE-2025-12735 vulnerability in the expr-eval and expr-eval-fork npm packages. ⚠️ Disclaimer This tool is for authorized security testing and educational purposes only. Unauthorized access to computer...

CVE-2021-21315-PoC

CVE-2021-21315-systeminformation This is Proof of Concept for CVE-2021-21315 which affects The System Information Library for Node.JS npm package "systeminformation". npmjs.com/systeminformation "be sure to check or sanitize service parameters that are passed to si.inetLatency, si.inetChecksite,...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit A security research tool for detecting and testing the CVE-2025-12735 vulnerability in the expr-eval and expr-eval-fork npm packages. ⚠️ Disclaimer This tool is for authorized security testing and educational purposes only. Unauthorized access to computer...

node-ipc-malware-protestware-CVE-2022-23812

CVE-2022-23812 RIAEvangelist/node-ipc is malware / protestware The RIAEvangelist/node-ipc module contains protestware peacenotwar. Excerpt from RIAEvangelist/node-ipc: as of v11.0.0 & v9.2.2 this module uses the peacenotwar module. More importantly, commits 847047cf7f81ab08352038b2204f0e763344958...

CVE-2026-42089

CVE-2026-42089 A local package installation helper trusted caller-supplied package names too much. In yeoman-environment, missing generators could be installed without user confirmation, turning attacker-controlled project metadata into a package-install and code-execution path. Intro I found thi...

CVE-2026-11417-AWS-CDK-RCE

Supply Chain Command Injection in AWS CDK's NodejsFunction CVE-2026-11417 Author: Hesham Ashraf @HeshamASH Date: June 10, 2026 Severity: High CVSSv3.1: 7.3, CVSSv4: 7.0 CWE: CWE-78 — Improper Neutralization of Special Elements used in an OS Command OS Command Injection Affected Package: aws-cdk-l...

CVE-2022-24434_POC

CVE-2022-24434 – PoC for Dicer This repository contains a Proof-of-Concept PoC for CVE-2022-24434 , a vulnerability affecting the Dicer npm package. PoC target version: 0.3.1 ensure the dicer code used is exactly v0.3.1 📂 Project Structure Make sure the directory is structured like this: . ├──...

twifo-cli

T W I F O - C L I Get user information of a Twitter user! Install $ npm install --global twifo-cli OR $ sudo npm install --global twifo-cli Usage $ Usage: twifo Example: $ twifo 9gag Related twifo : API for this tool. quorafy: Get user information of a Quora user. License MIT © Rishi Giri...

CVE-2026-45321-Tanstack

Supply Chain Attack Simulation — CVE-2026-45321 TanStack Educational Lab for Understanding npm Supply Chain Attacks, CI/CD Abuse, and Install-Time Code Execution Disclaimer This project is created only for: cybersecurity learning, defensive security research, local lab simulation, understanding t...

CVE-2024-21532-PoC-ggit

CVE-2024-21532 Command Injection vulnerability in ggit ggit describes itself as: Local promise-returning git command wrappers Resources: Project's GitHub source code: https://github.com/bahmutov/ggit Project's npm package: https://www.npmjs.com/package/ggit Article write-up on this vulnerability:...

CVE-2024-21533-PoC-ggit

CVE-2024-21533 Argument Injection vulnerability in ggit ggit describes itself as: Local promise-returning git command wrappers Resources: Project's GitHub source code: https://github.com/bahmutov/ggit Project's npm package: https://www.npmjs.com/package/ggit Article write-up on this argument...

ReactNext2Shell

React-Next-Scanner Safe CLI scanner for CVE-2025-55182 and CVE-2025-66478 This tool provides a lightweight, non-exploitative vulnerability scanner focused on modern JavaScript stacks, specifically: API services affected by CVE-2025-55182 Next.js applications affected by CVE-2025-66478 It works on...

deephas-1.0.7-Prototype-Pollution-PoC-CVE-2026-25047-

deephas = 1.0.8. References: GitHub Advisory GHSA-2733-6c58-pf27 NVD CVE-2026-25047...

CVE-2026-29786

CVE-2026-29786 Research: Joshua van Rijswijk Description This repository contains a Proof of Concept PoC for CVE-2026-29786 , a vulnerability in the tar npm package that allows a crafted archive to create a hardlink pointing outside the intended extraction directory. The issue occurs when a tar...

CVE-2021-21315-exploit

CVE-2021-21315 Exploit Des: My python Script to exploit system Information Library for Node.JS npm package "systeminformation". npmjs.com/systeminformation I thought this POC will not show real world impact, But it'll be cool in CTF's...

CVE-2026-39983

References https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q https://github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1...