CVE-2025-34096

🐞 CVE-2025-34096: Easy File Sharing Web Server 7.2 - Stack-Based Buffer Overflow SEH SEH-based buffer overflow in Easy File Sharing Web Server 7.2, reachable through the password recovery endpoint. 📑 Table of Contents Why this repository exists Why this vulnerability is interesting Context and...

CVE-2024-54910

CVE-2024-54910 https://vulners.com/cve/CVE-2024-54910 This document explores a vulnerability that allows arbitrary file writes, leading to privilege escalation on a Windows System that has Hasleo Backup Suite Free = 4.9.4 installed. It demonstrates how backup recovery operations, combined with...

lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

SummaryThe POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed. Detailspython lightrag/api/lightragserver.py:[email protected]"/login"async def loginformdata: OAuth2PasswordRequestForm =...

CVE-2026-22001-SPHINCS-WOTS-Weak-Randomness-Forgeable-Signature

CVE-2026-22001 – SPHINCS+ WOTS+ Weak Randomness Signature Forgery Overview An implementation of the SPHINCS+ post‑quantum signature scheme uses a flawed random number generator during WOTS+ signature generation. The same nonce k is reused across multiple signatures, allowing an attacker to recove...

tiandy-research

tiandy-research This repository contains the results of my August 2020 research of Tiandy's IPC/NVR firmware these devices are also sold as OMNY. This "research" was not exhaustive, but I did find multiple methods to recover the administrator password remotely, enable telnet and change the root...

isa_recovery

ISA Recovery System A reverse-engineering pipeline that turns a firmware binary and its possibly-wrong disassembly into a working Ghidra processor specification. When you hit a proprietary processor with no documentation and no Ghidra support, this tool recovers the real encoding of each...

engeman-web-language-combobox-sqli

Engeman Web = 12.0.0.2 Password Recovery Page Load Unauthenticated SQL Injection Proof of concept for exploitation of the vulnerability described in CVE-2025-8220, which concerns the possibility of SQL Injection during the password recovery page load in the Engeman Web software. Description A...

CVE-2023-27372

Research Project: CVE-2023-27372 — SPIP RCE, Lab Environment + Safe PoC 1 Description This repository contains: stand/ — a lab environment vulnerable setup on Docker: SPIP + MariaDB. poc/ — a Python verification tool scanner implementing safe confirmation of the vulnerability Safe PoC without...

PGP-client-checker-CVE-2021-33560

PGP client checker – CVE-2021-33560 This is a tool to check whether your OpenPGP client is affected by CVE-2021-33560. This vulnerability exposes to plaintext recovery the messages you encrypt to some ElGamal subkeys. The technical details of the vulnerability are described in this blog post and...

CVE-2024-31497-POC

CVE-2024-31497 POC This vulnerability exploits the biased ECDSA nonce generation in the ecc-ssh.c file. The nonce is generated with $sha512ID\ ||\ sha512privKey\ ||\ sha1data\ mod\ q$ leaving the top 9 bits to zero. In order to recover the private key we need 60 signatures but with 58 we still ha...

CVE-2025-65270

CVE-2025-65270 ⚠️ Disclaimer This repository is for educational and defensive security research only 🔥 Overview Reflected cross-site scripting XSS vulnerability in ClinCapture EDC 3.0 and 2.2.3 , allowing an unauthenticated remote attacker to execute JavaScript code in the context of the victim's...

CVE-2017-9476

CVE-2017-9476 Hidden AP with Deterministic Credentials. Compiling cc xhscmmac2psk.c -o xhscmmac2psk Usage ./xhscmmac2psk The algorithm has been also added to PSKracker. References CVE-2017-9476 Bastille-18.home-security-wifi-network.txt DEFCON 25 whitepaper DEFCON 25 slides...

WinRE-Fix

WinRE-Fix PowerShell script to safely move/recreate Windows Recovery Environment WinRE to a new Recovery partition. Keywords: WinRE Windows Recovery Recovery Partition reagentc KB5034441 KB5028997 CVE-2024-20666 BitLocker Windows Update Fix Partition Resize GPT UEFI 🎯 What This Script Solves This...

WinRE-Patch

WinRE-Patch Patches CVE-2022-41099 Original: https://github.com/halsey51013/UpdateWindowsRE-CVE-2022-41099...

CVE-2021-31159

Zoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration CVE-2021-31159 This script takes advantage of ServiceDesk Plus before build 10519 having different output in the password recovery functionality: if the user exists it returns a message claiming an email has been sent but ...

BIT-OPENBAO-2026-63132 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

PT-2026-104009

Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.13.2 Filament versions 5.0.0 through 5.8.2 Description App-based multi-factor authentication MFA management actions do not consistently require confirmation of the current password. An attacker with access to ...

CentOS Linux 8.4 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl / etc (CENTOS8.4:CLSA-2025:1751142817)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2025:1751142817 advisory. - Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation...

CentOS Linux 8.5 [TuxCare] Security Update: rsyslog / rsyslog-crypto / rsyslog-doc / rsyslog-elasticsearch / etc (CENTOS8.5:CLSA-2026:1788815237)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1788815237 advisory. - A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during...

AlmaLinux 9.2 [TuxCare] Security Update: rsyslog / rsyslog-crypto / rsyslog-doc / rsyslog-elasticsearch / etc (ALMALINUX9.2:CLSA-2026:1788196350)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788196350 advisory. - A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during...