white-deface

Author WHITE-DEFACE This is a simple tool to automatically deface vulnerable websites. Tutorial video link at last of this page ⚠️ It uses WebDav vulnerability to exploit. This script sends a PUT requests to the websites given in the targets.txt file. Unauthenticated requests will be accepted and...

halogen

Halogen is a tool to automate the creation of yara rules based on the image files embedded within a malicious document. This can assist cyber security professionals in writing detection rules for malicious threats as well as help responders in identifying with particular threat they are dealing...

CVE-2026-116686 Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing...

CVE-2026-116686 Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing...

EUVD-2026-111366

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing...

CVE-2026-116686

The Model Context Protocol Python SDK contains a vulnerability in versions 1.10.0 through 1.30.0 and 2.2.0 . The ClientSession, ClientSessionGroup, and Client tool calls use the default resolver in jsonschema to validate server-declared outputSchema documents. This allows a server to provide an u...

CVE-2022-2414-Proof-Of-Concept

CVE-2022-2414-Proof-Of-Concept A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests...

CVE-2024-53476

CVE-2024-53476 Description SimplCommerce is affected by a race condition vulnerability in the checkout logic, allowing multiple users to purchase more products than are in stock via simultaneous checkout requests. Detection Method An attacker can detect this vulnerability by attempting to purchas...

http_bridge

Http Bridge Motivation I've wrote this program as a proof of concept to test the idea of be able to send tcp stream packets over simple http request like PUT, PATCH, POST, GET, without use a proxy way like CONNECT method. Also as a practice exercise to train my novice skill on rust language...

CVE-2026-36958

CVE-2026-36958: Denial of Service via Concurrent HTTP Requests CVE ID: CVE-2026-36958 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: U-SPEED Product: U-SPEED Router Firmware Version: V1.0.0 CWE: CWE-400 - Uncontrolled Resource Consumption Description The U-SPEED Router firmware V1.0.0 is...

payloads

payloads Git All the Payloads! A collection of web attack payloads. Pull requests are welcome! Usage run ./get.sh to download external payloads and unzip any payload files that are compressed. Payload Credits fuzzdb - https://github.com/fuzzdb-project/fuzzdb SecLists -...

SpringBreakVulnerableApp

Spring Break Vulnerable Application This is a vulnerable application to test the exploit for the Spring Break vulnerability CVE-2017-8046. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is recommended using a backed-up and sheltered environment su...

CVE-2022-46364-Poc

CVE-2022-46364 Exploit Apache CXF SSRF via MTOM XOP:Include | CVSS 9.8 CRITICAL Vulnerability Apache CXF -s -d -t, --target - Vulnerable CXF SOAP endpoint required -s, --ssrf-url - Internal URL to exfiltrate required -d, --domain - Target domain default: localhost --plain-soap - Use plain SOAP...

BLESuite

BLESuite README Overview BLESuite is a python package to make Bluetooth Low Energy BLE device communication more user friendly and enables rapid BLE device testing. Version 2 of BLESuite removes the dependency on PyGattlib and BlueZ and instead uses a modified version of PyBT...

BurpSuite-Team-Extension

BurpSuite-Team-Extension This Burpsuite plugin allows for multiple testers to share live/historical proxy requests, scope and repeater/intruder payloads with each other in real time allowing for truly collaborative web app testing. When connected to the Team Sever and in a Team Room all requests...

CVE-2020-14882-14883

CVE-2020-14882&14883 WebLogic is a J2EE application server launched by Oracle. CVE-2020-14882 is an unauthorized access vulnerability in the Console, with a severity rating of Critical and a CVSS score of 9.8. Meanwhile, CVE-2020-14883 is a code execution vulnerability in the Console that exploit...

CVE-2024-36401

CVE-2024-36401 GeoServer Exploitation Tool Vulnerability Overview CVE-2024-36401 is a remote command execution vulnerability in GeoServer. An attacker can execute arbitrary commands without authorization by crafting a specific WFS Web Feature Service request. Requirements Python 3.x Install...

zap-scripts

zap-scripts Zed Attack Proxy Scripts for finding CVEs and Secrets. Building This project uses Gradle to build the ZAP add-on, simply run: ./gradlew build in the main directory of the project, the add-on will be placed in the directory build/zapAddOn/bin/. Usage The easiest way to use this repo in...

CVE-2019-17662

CVE-2019-17662 Modified the CVE code Used Prepared Requests, as in python3 requests module normalize the ../ in URL such as: For code: r = requests.get"http://123.123.123.123/../../../../../../test" printstrr.statuscode Results in: GET /test HTTP/1.1 Host: 123.123.123.123 Connection: close...

CVE-2024-23334-PoC

Path Traversal PoC CVE-2024-23334 This script is a proof of concept PoC for vulnerability CVE-2024-23334 related to a Path Traversal. The script attempts to access files outside the allowed root directory by manipulating paths in HTTP requests. Requirements To run this script, you will need to ha...