Exploit for Improper Input Validation in Ivanti Endpoint_Manager

CVE-2023-28324 POC for CVE-2023-28324 affecting Ivanti EPM...

Exploit for Deserialization of Untrusted Data in Ivanti Endpoint_Manager

CVE-2023-28324 POC for CVE-2023-28324 affecting Ivanti EPM...

Progress WhatsUp Gold Exploited Just Hours After PoC Release for Critical Flaw

Malicious actors are likely leveraging publicly available proof-of-concept PoC exploits for recently disclosed security flaws in Progress Software WhatsUp Gold to conduct opportunistic attacks. The activity is said to have commenced on August 30, 2024, a mere five hours after a PoC was released f...

3DSecure 2.0 3DS Method Authentication Cross Site Scripting

Product: 3DSecure 2.0 Manufacturer: Redsys Affected Versions: 3DSecure 2.0 3DS Method Authentication Tested Versions: 3DSecure 2.0 3DS Method Authentication Vulnerability Type: Cross-Site Scripting XSS Risk Level: Medium Solution Status: Not yet fixed Manufacturer Notification: 2024-01-17 Solutio...

Exploit for Code Injection in Vmware Spring_Cloud_Data_Flow

CVE-2024-37084-Poc Setup ,Analysis , Demo exploit and poc abou...

Exploit for Use After Free in Debian Debian_Linux

CVE-2024-26581 Vulnerability Checker for BGN Internal Re...

pyload-ng vulnerable to RCE with js2py sandbox escape

Summary Any pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately. Details js2py has a vulnerability of sandbox escape assigned as CVE-2024-28397, which is used by the...

External Secrets Operator vulnerable to privilege escalation

Details The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets...

Malicious code in ori-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b71bf5ca700406e224508f08266da2a443693d48eb216c3854de6be0d1451346 The OpenSSF Package Analysis project identified 'ori-poc' @ 1.0.3 npm as malicious. It is considered malicious because: - The package executes o...

MAL-2024-10226 Malicious code in ori-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b71bf5ca700406e224508f08266da2a443693d48eb216c3854de6be0d1451346 The OpenSSF Package Analysis project identified 'ori-poc' @ 1.0.3 npm as malicious. It is considered malicious because: - The package executes o...

GHSA-M8RP-VV92-46C7 gix-path improperly resolves configuration path reported by Git

Summary gix-path runs git to find the path of a configuration file associated with the git installation, but improperly resolves paths containing unusual or non-ASCII characters, in rare cases enabling a local attacker to inject configuration leading to code execution. Details In gixpath::env, th...

Exploit for Out-of-bounds Write in Mikrotik Routeros

cve-2023-30800-multithread-doser Multithredded DoS Python Scri...

Malicious code in whalebone7-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ebd207a56329855d7d146895e375b39fcbe907f6ff2e7489a80bbe7c6d4a01fc Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2025-3018 Malicious code in whalebone7-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ebd207a56329855d7d146895e375b39fcbe907f6ff2e7489a80bbe7c6d4a01fc Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Travel 1.0 Shell Upload

============================================================================================================================================= | Title : Travel v1.0 Remote File Upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bits ...

Exploit for Cross-Site Request Forgery (CSRF) in Concretecms Concrete_Cms

CVE-2017-5638 Apache Struts 2 RCE Proof of Concept This repos...

GHSA-C34R-238X-F7QX Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

Summary The Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code Execution to privileged users. A privileged user refers to an Admin UI user with the default Owner or...

Exploit for Improper Check for Unusual or Exceptional Conditions in Mozilla Firefox

CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js Ov...

ThinVNC Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ThinVNC Directory Traversal', 'Description' = %q This module exploits a directory traversal vulnerability in ThinVNC versions 1.0b1 and prior whi...

WinFTP 2.3.0 NLST Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WinFTP 2.3.0 NLST Denial of Service', 'Description' = %q This module is a very rough port of Julien Bedard's PoC. You need a valid login, but eve...