CVE-2016-7255

CVE-2016-7255 Used to exploit cve-2016-7255 in 64 bit versions of Windows, tested on Workstation 7 SP1, 8.1, 10 prior to build 1607, and Server 2012 R2. To use cve-2016-7255 cve-2016-7255.exe 7 - Windows 7 SP1 cve-2016-7255.exe 81 - Windows 8.1 cve-2016-7255.exe 10 - Windows 10 prior to build 160...

R2Socks

R2Socks SOCKS5 proxy tunneled through Cloudflare R2 buckets. Client App ◄─SOCKS5─► Proxy ◄─── R2 Bucket ───► Agent ◄─TCP─► Target The proxy runs a local SOCKS5 server on the operator's machine. Every CONNECT request is serialized as binary packets and stored as R2 objects. The agent polls the sam...

CVE-2018-8639-exp

CVE-2018-8639-exp platform: windows 2008 and windows 2008 R2...

2026-10 Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 R2 for x64 (KB5128927)

2026-10 Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 R2 for x64 KB5128927...

KB5126836: Windows Server 2012 R2 Security Update (October 2026)

The remote Windows host is missing security update 5126836. It is, therefore, affected by multiple vulnerabilities - Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network. CVE-2026-100202 - Heap-based buffer overflow in Network Poli...

Malicious code in @s4yhiitestpoc/r2-https-b (npm)

Source: amazon-inspector e89449bafb4f816bd8605f45cedf0fec8ec0cff9088007a7a38aaea0a9db91ec On npm install, postinstall.js automatically collects installer-side identifying data — hostname, username, home directory, non-internal network interface addresses, DNS servers, current working directory,...

Malicious code in @s4yhiitestpoc/r2-https-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e89449bafb4f816bd8605f45cedf0fec8ec0cff9088007a7a38aaea0a9db91ec On npm install, postinstall.js automatically collects installer-side identifying data — hostname, username, home directory, non-internal network...

MAL-2026-17808 Malicious code in @s4yhiitestpoc/r2-https-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e89449bafb4f816bd8605f45cedf0fec8ec0cff9088007a7a38aaea0a9db91ec On npm install, postinstall.js automatically collects installer-side identifying data — hostname, username, home directory, non-internal network...

Malicious code in @s4yhiitestpoc/r2-https (npm)

Source: amazon-inspector b6042f718b39be380eeda7c31dc46b056e753cb8a39e51897c8106e49b44f4d0 On npm install, the package's declared postinstall script postinstall.js collects installer host fingerprint data — hostname, username, home directory, platform/arch/OS release, current working directory,...

MAL-2026-17764 Malicious code in @s4yhiitestpoc/r2-https (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6042f718b39be380eeda7c31dc46b056e753cb8a39e51897c8106e49b44f4d0 On npm install, the package's declared postinstall script postinstall.js collects installer host fingerprint data — hostname, username, home director...

CVE-2026-105870

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1...

CVE-2026-105870

The WP Associate Post R2 plugin by Delight Star Inc. is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw, identified as CWE-79 . This issue is caused by the Improper Neutralization of Input During Web Page Generation in versions up to and including 5.0.1 . An attacker could potentially e...

EUVD-2026-95740

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1...

CVE-2026-105870 WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1...

PT-2026-108883

Name of the Vulnerable Software and Affected Versions WP Associate Post R2 versions prior to 5.0.2 Description WP Associate Post R2 contains a Reflected Cross-site Scripting XSS flaw, which occurs when an application includes untrusted data in a web page without proper validation or encoding,...

CVE-2026-105870: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1...

WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Associate Post R2 versions = 5.0.1...

Relapse-Exploit-13.40-local

PS5 Relapse Exploit — local R2 payload build This community b...

CVE-2026-100621

Capgo capgo.app contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The enforceencryptedbundletrigger / checkencryptedbundleoninsert content lock in supabase/schemas/prod.sql exempts appversions rows whose...

CVE-2026-100619

Capgo capgo.app blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key upload+ rights or an authenticated user with write+ rights on an app...