3647 matches found
EUVD-2023-60625
PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and...
Fortigate-SSL-VPN-Exploit-Kit
FortiGate SSL-VPN kit recovered in the wild Research archive. Recovered as found. I did not write these files. Released: 1 September 2026 This repository is the orchestrator, second-stage payloads, and operator listeners that sit on top of a per-SKU FortiGate SSL-VPN exploit catalog. The long-for...
horrors-log4shell
horrors-log4shell A micro lab playground? for CVE-2021-44228 log4j Can be used for executing payloads against multiple targets. Target-specific payloads are generated runtime. Adjustable configuration and bypasses. Installation Java-related requirements Development / Running example Gradle Maven ...
CVE-2021-44228-Log4j-Payloads
This repository does not have a README...
Root-My-Galaxy
Root My Galaxy Root My Galaxy is a one-click installer for explicitly supported Samsung model and kernel combinations. The application itself is kept separate from device offsets, native exploit payloads, and KernelSU build artifacts. Latest release The device feed and native payloads are...
mjet
mjet Mogwai Security Java Management Extensions JMX Exploitation Toolkit mjet is a tool that can be used to protect insecure configured JMX services. It is based on the blog post "Exploiting JMX-RMI" from Braden Thomas/Accuvant "http://www.accuvant.com/blog/exploiting-jmx-rmi" and can be used to...
JavaPayload
JavaPayload JavaPayload는 순수 Java 익스플로잇 또는 일반적인 잘못된 구성비밀번호로 보호되지 않는 Tomcat 매니저 또는 디버거 포트 등에서 포스트 익스플로잇post-exploitation에 사용하기 위한 순수 Java 페이로드 모음입니다. 구버전 문서는 다음에서 찾을 수 있습니다. http://schierlm.users.sourceforge.net/JavaPayload/ http://schierlm.users.sourceforge.net/J2EEPayload/...
XWiki < 4.10.20 - Remote code execution
XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user...
CVE-2025-55182POC
CVE-2025-55182 POC de RCE en React Server Components Este proyecto es una Prueba de Concepto PoC para CVE-2025-55182 - Ejecución Remota de Código RCE en React Server Components RSC , que demuestra cómo, bajo ciertas condiciones, se puede desencadenar ejecución remota de código mediante...
CVE-2025-24813-PoC
CVE-2025-24813-PoC CVE-2025-24813 afecta a Apache Tomcat - si es una versión vulnerable y está espectacularmente mal configurado, un atacante puede obtener RCE con un GET y un POST. Más información aquí Este es el script de Yiheng An, Jun Li, Qiang Liu, Haozhe Zhang, Qi Deng del reciente informe...
CVE-2025-55182-Scanner
CVE‑2025‑55182 – Escáner de RCE por Deserialización RSC en Next.js Esta herramienta verifica si un objetivo es vulnerable a CVE‑2025‑55182 , un fallo de Ejecución Remota de Código causado por el manejo inseguro de cargas útiles de modelo RSC React Server Components dentro de Next.js. La...
POC-CVE-2025-24813-Apache-Tomcat-Remote-Code-Execution
⚠️🚀 CVE-2025-24813 — Apache Tomcat RCE Exploitation Suite root@kitploit: ⚡ Версия: 1.0 🛡️ ID CVE: CVE-2025-24813 Apache Tomcat RCE 🧬 Полезные нагрузки: ysoserial / Java 🌐 Режим: Интерактивный + Скрытный 🔬 Использование: Этическое, исследовательское, образовательное 🌌 Обзор...
EUVD-2026-70802
MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction where dimension, piece, and degree counts from encoded BHVIPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted payloads with mismatched dimension values to...
Root-My-Device v0.0.7
Root My Device A fork of BuSung-dev/Root-My-Galaxy, under the Apache License 2.0 — see LICENSE and Credits. Root My Device is a one-click installer for explicitly supported firmware builds. The application itself is kept separate from device offsets, native exploit payloads, and KernelSU build...
grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads
A flaw in Grafana's API endpoints allows remote attackers to send excessively large request bodies without authentication. This exhausts server memory, resulting in a complete denial of service DoS...
CVE-2026-3416
CVE-2026-3416 affects the API Publisher component in multiple WSO2 products. The root cause is the use of a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. Because the PRNG lacks sufficient entropy, a sophisticated attacker with high at...
CVE-2026-84810
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE...
EUVD-2026-70225
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE...
CVE-2026-82797
A flaw was found in rlottie. This uncontrolled recursion vulnerability allows a local attacker to cause a denial of service DoS by providing specially crafted serialized data with nested payloads. Successful exploitation requires user interaction to process the malicious data. Mitigation Update...