CVE-2019-19393

Rittal CMC PU III – Stored XSS PoC Application: Rittal CMC PU III Web management Devices: CMC PU III 7030.000 Software Revision: From V3.11.002 to V3.15.704 Hardware Revision: From V3.00 to V6.01 Attack type: Stored XSS Solution: Update to Software Revision V3.17.10 or later Summary: Web...

islechat

isle.chat A ssh powered chat server with public and private invite-only channels Each channel has an owner who can change its banner and invite users anyone can join if its public Demo it with ssh [email protected] This project is very new right now so don't rely on it for anything critical...

CVE-2024-36842-Backdooring-Oncord-Android-Sterio-

CVE-2024-36842 Backdooring-Oncord+ Android-Sterio We have conducted vulnerablity assessment on one of the most selling after marrket car infotainment unit. Creating Persistent Backdoor on Oncord+ android/ios car infotainment unit using malicious script! About Device: Android version : 12 Kernel...

CVE-2019-17427

CVE-2019-17427 CVE-2019-17427 Persistent XSS POC In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors. The vulnerability essentially exists on any wiki page which by default uses textile formatting. You can take advantage of it by using pre...

CVE-2017-16567

CVE-2017-16567 1. Exploit Title: Logitech Media Server : Persistent Cross Site ScriptingXSS 2. Shodan Dork: Search Logitech Media Server 3. Date: 11/03/2017 4. Exploit Author: Dewank Pant 5. Vendor Homepage: www.logitech.com 6. Version: 7.9.0 7. Tested on: Windows 10, Linux POC: 1. Access and go ...

CVE-2019-13633

CVE-2019-13633 Suggested description : Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. Additional Information : Blinger.io - is a platform which used by global clients such as FxPro, Alfa Bank, OneTwoTrip, Ivi, KupiVIP Group, Belavia, Wargaming, Yandex, OZON, TCS Group Holding and...

android-locdump

Following the latest days internet outrage/overreaction to the revelation that iPhone has a cache for its location service, I decided to have look what my Android devices caches for the same function. This is a quick dumper I threw together to parse the files from the Android location provider. T...

CVE-2022-38691_38692

CVE-2022-38691/38692 persistently boot FDL1/SPL without signature NOTE: first remove sign check of Boot Chain images in FDL1/SPL ​ fdl1 use genfdl1-dl sourcecode ​ spl android 9/10, use genspl-unlock-legacy sourcecode ​ spl android 11+, use genspl-unlock sourcecode ​ windows prebuilt tools can be...

BlackLotus-Detection

CVE-2022-21894 Public repo for anything CVE-2022-21894 Main page https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ Windows Defender now capable of removing this threat "Possible vulnerable EFI bootloader " Bas...

CVE-2026-1122-IoT-Firmware-Update-Signature-Bypass-via-Low-Order-Point-Injection

5. CVE-2026-1122 – IoT Firmware Update Signature Bypass via Low‑Order Point Injection Overview An IoT device’s OTA firmware verification uses a flawed Ed25519 implementation that does not reject public keys with small‑order components, allowing an attacker to forge a valid signature for malicious...

CVE-2026-3227-TP-Link-authenticated-RCE

CVE-2026-3227: TP-Link Router OS Command Injection For more Information see https://vulners.com/cve/CVE-2026-3227 A persistent, authenticated OS Command Injection vulnerability in TP-Link router firmware leading to device bricking or potential LAN takeover. Disclaimer : This repository contains...

CVE-2023-28467

MyBB 1.8.33 User CP email persistent XSS - MyBB 1.8.33 User CP email persistent XSS - Mybb version "@cve.com Solution Upgrade MyBB version 1.8.34 or higher...

CVE-2021-30146

CVE-2021-30146 Seafile 7.0.5 Persistent XSS Suggested description: Application Server Version: 7.0.5 Seafile is vulnerable to Persistent XSS via share library functionality. Additional Information: Seafile is an open source, self-hosted file sync and share solution with high performance and...

CVE-2017-16568

CVE-2017-16568 1. Exploit Title: Logitech Media Server : HTML code injection and execution. 2. Shodan Dork: Search Logitech Media Server 3. Date: 11/03/2017 4. Exploit Author: Dewank Pant 5. Vendor Homepage: www.logitech.com 6. Version: 7.9.0 7. Tested on: Windows 10, Linux POC: 1. Access and go ...

root-sonim-xp3800

Root Sonim XP3800 Root access for the Sonim XP3800. Two methods are available — choose whichever fits your situation. Root Manager App The Root Manager app exploits CVE-2019-2215 a binder use-after-free kernel vulnerability to gain root directly on the device. No computer, no bootloader unlock, n...

Metamorph

Metamorph Introduction This tool is a command-line utility for Windows written in C that creates and configures persistent Event Tracing for Windows ETW AutoLogger sessions. AutoLoggers automatically start tracing specific ETW providers upon system boot, making them useful for capturing events th...

CcmMessagingBackdoor

CcmMessagingBackdoor Proof of Concept tooling to build and install a rogue CcmMessaging service to maintain access on a Management Point Usage Compile and install the rogue COM service on the Management Point Compile PS C:\ C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe /t:library...

iOS18.6.2-Persistent-Automation-Exploit-in-Siri-Shortcuts-and-Apple-SWC

Improper Input Validation in Siri Shortcuts and Shared Web Credentials Discovered by: Joseph Goydish II Date Discovered: August 20, 2025 Severity: High Executive Summary This report outlines a high-severity vulnerability chain affecting Apple’s Siri Shortcuts and Shared Web Credentials SWC...

IoT-Vulnerability-Research-Public

Hardware Security & Vulnerability Research This repository serves as a centralized public archive for my independent vulnerability research, hardware audits, and Coordinated Vulnerability Disclosures CVD. All proof-of-concept scripts, firmware extractions, and hardware teardowns are published her...

CVE-2026-12948

CVE-2026-12948 Vulnerability Summary A stored cross-site scripting XSS vulnerability was identified in the web management interface of the Digi PortServer TS 4 H MEI. A specially crafted, authenticated request allows a script payload to be permanently written to device configuration storage. The...