CVE-2025-32375

Setup for the vulnerable version. Start the vulnerable container: docker compose up Create a listener e.g. ncat: ncat -klnv 1337 Run the exploit: python3 exploit.py You should receive an HTTP request in the ncat window with the contents of the OS command id by default if everything worked as...

Grassmarlin-CVE-2026-6807-XXE-POC

This is functional proof of concept code based on the CISA disclosure of a reported vulnerability in Grassmarlin posted on 4/28/2026. Looking at the code for Grassmarlin, I determined that the likely vulnerable parameters had to do with the XML files ingested when opening stored sessions. By...

POC-CVE-2025-54988

CVE-2025-54988 - POC Disclaimer: I am not the original discoverer of this vulnerability. This post documents my process of reproducing the issue in a controlled environment for educational purposes and to help others validate their own systems. The tests were conducted in an isolated lab with no...

Malicious code in simple-date-formatter-new-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f295d4208d67cbb14c8804b287109ad5ed7946e39f0256e601f846e485c6c54 [email protected] presents itself as a date-formatting utility but ships a trivial three-line stub while its package.json postinstal...

Malicious code in @osl-design/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a3237fada0f96b2160cb8adea5c7734951ca960f71f3f4bf788fec9446b6d3b The package declares "install": "node index.js" in package.json, so npm install automatically executes its top-level script. That script loads...

GHSA-35WR-X7V6-9FV2 Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`

Summary When dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to...

Exploit for CVE-2026-6807

This is functional proof of concept code based on the CISA discl...

CVE-2021-42560

An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are parsed in an unsafe manner and can be leveraged for XXE attacks e.g., File Exfiltration, Server Side Request Forgery, Out of Band...

Server side request forgery (ssrf)

An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are parsed in an unsafe manner and can be leveraged for XXE attacks e.g., File Exfiltration, Server Side Request Forgery, Out of Band...

CVE-2021-42560

CALDERA 2.9.0 Debrief plugin accepts base64-encoded SVG parameters when generating PDFs. The SVGs are parsed unsafely, enabling XXE-style attacks that can lead to file exfiltration, server-side requests, or out-of-band exfiltration. No explicit exploit details or affected subversions beyond CALDE...

CVE-2021-42560

An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are parsed in an unsafe manner and can be leveraged for XXE attacks e.g., File Exfiltration, Server Side Request Forgery, Out of Band...

Endpoint for Out-of-Band Exfiltration: Arecibo

In the process of identifying and exploiting vulnerabilities, it is sometimes necessary to resort to Out of Band OOB techniques in order to exfiltrate information through DNS resolutions or HTTP requests. To address this kind of situation the faster and simpler solution can be the use of a Burp...