ioctlance

IOCTLance Description Presented at CODE BLUE 2023, this project titled Enhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis introduces IOCTLance, a tool that enhances its capacity to detect various vulnerability types in Windows Driver Model WDM drivers. In a...

st2-046-poc

Struts2 Content-Disposition filename null-byte variant of CVE-2017-5638 Struts2 Security Bulletin S2-046 A null byte \x00 in a request¡¯s Content-Disposition header filename field can trigger a InvalidFileNameException with the same client controlled filename string in the exception message that ...

PHP_8.1.x_Exploit

🚀 PHP CVE Autopilot Automated detection & exploitation of critical PHP vulnerabilities CVE-2024-4577 bypass, CVE-2025-14177, CVE-2025-14180, CVE-2025-14178 PHP8.1.xExploit.sh is a single‑file, zero‑configuration security assessment tool that automatically discovers vulnerable PHP endpoints and...

ADZero

Description The vulnerable encryption protocol is implemented instead of the authentication mechanism in the Netlogon protocol. An unauthenticated attacker can use the Zerologon vulnerability to set the computer account password of the Domain Controller machine to null NT hash =...

micr0_shell

micr0 shell Micr0shell is a lightweight and efficient Python script designed for dynamically generating Windows X64 Position-Independent Code PIC Null-Free reverse shell shellcode. Depending on the options selected, the generated shellcode can be up to 27 bytes smaller than comparable shellcode...

CVE-2026-111373

FreeRDP versions before 3.32.0 are vulnerable to a NULL pointer dereference within the websocket transport component. A malicious gateway can trigger this by sending zero-length pings ; specifically, when the payload length is zero, the websocket_reply_pong function passes a nullptr stream to web...

EUVD-2026-102554

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an...

ridenum

RIDENUM - A simple open source method for performing null session brute forces Copyright 2018 TrustedSec Written by: David Kennedy ReL1K Twitter: @HackingDave and @TrustedSec Website: https://www.trustedsec.com . . . . . | \ | | | \ | || \ | | | | | | | / | | | | | | | .--. | | | | | | | | | | |...

CVE-2021-24086

CVE-2021-24086 This is a proof of concept for CVE-2021-24086 "Windows TCP/IP Denial of Service Vulnerability ", a NULL dereference in tcpip.sys patched by Microsoft in February 2021. According to this tweet, the vulnerability has been found by @piazzt. It is triggerable remotely by sending...

CVE-2024-55511

CVE-2024-55511 This repository has been archived and moved here A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially elevate their privileges via executing a specially crafted executable. I am currently creati...

SMBGhost-SMBleed-scanner

SMBGhost CVE-2020-0796 and SMBleed CVE-2020-1206 Scanner c 2020 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes Intended only for educational and testing in corporate environments. ZecOps takes no responsibility for the code, use at your own risk. Please contact...

THM-Steel_Mountain-CVE-2014-6287

THM-SteelMountain-CVE-2014-6287 A write up on the Steel Mountain box from TryHackMe.com and exploit for CVE-2014-6287 Credits I take no credit for the original discovery and exploitation of this vulnerability. Thank you to the following people! Discovery: Daniele Linguaglossa Metasploit Module...

CVE-2022-36804-POC

CVE-2022-36804-POC 🕷️ Bitbucket CVE-2022-36804 unauthenticated remote command execution Exploitation Find publicly visible repositories - example.com/repos?visibility=public...

EUVD-2023-59906

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CORStest

CORStest A simple CORS misconfiguration scanner Based on the research ofJames Kettle CORStest is a quick & dirty Python 3 tool to find Cross-Origin Resource Sharing CORS misconfigurations. It takes a text file as input which may contain a list of domain names or URLs. Currently, the following...

enum4linux-ng

enum4linux-ng A next generation version of enum4linux enum4linux-ng.py is a rewrite of Mark Lowe's former Portcullis Labs now Cisco CX Security Labs enum4linux.pl, a tool for enumerating information from Windows and Samba systems, aimed for security professionals and CTF players. The tool is main...

CVE-2026-34159-Vulnerability-Research-Analysis-Detection

CVE-2026-34159-Vulnerability-Research-Analysis-Detection Critical buffer validation bypass in deserializetensor llama.cpp b8492. Null tensor buffer skips bounds check, enabling unauthenticated arbitrary R/W via GRAPHCOMPUTE. ASLR bypass + RCE over TCP 50052. Contains: Technical analysis & exploit...

CVE-2026-31431

CVE-2026-31431 — From a NULL Pointer to Root: Exploiting AFALG AEAD in the Linux Kernel Bug class: Null pointer dereference → heap OOB write → credential overwrite Affected subsystem: net/alg/afalg.c Impact: Local Privilege Escalation unprivileged user → root Affected kernels: Linux 4.4 – 4.9...

cve-2026-23398-poc

Lab: CVE-2026-23398 ICMP / ipnopmtudisc=3 Reproducible lab for the Linux kernel bug in icmptagvalidation NULL dereference when net.ipv4.ipnopmtudisc = 3 and a Fragmentation Needed ICMP arrives whose quoted inner IPv4 header uses a protocol number with no handler in inetprotos. Authorized use only...

CVE-2026-111128

Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById to return...