CVE-2026-106145 Privilege Escalation in Telerik Report Server Service-Agent Hub

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server...

CVE-2024-23897

CVE-2024-23897 CVE-2024-23897 - CLI를 통한 임의 파일 읽기 취약점은 RCE로 이어질 수 있음 영향을 받는 제품 및 버전: 제품| 영향을 받는 버전 ---|--- Jenkis Server| = 2.441 = LTS 2.426.3 CVSS: CRITICAL 실제 악용 여부: YES 패치: YES 완화 조치: YES 도움말 usage: CVE-2024-23897.py -h -c COUNTRY options: -h, --help show this help message and exit -c COUNTRY,...

POC-CVE-2026-56164-exploit

CVE-2026-56164 — Microsoft SharePoint Server 인증 우회 익스플로잇 Critical CVSS 9.8 — Microsoft SharePoint Server에서 Farm Administrator로의 비인증 권한 상승 목차 개요 취약점 세부 정보 영향을 받는 버전 아키텍처 다이어그램 프로젝트 구조 설치 스캐너 사용법 — 단계별 안내 익스플로잇 사용법 — 단계별 안내 페이로드 설계 완화 조치 면책 조항 개요 CVE-2026-56164는 Microsoft SharePoint Server 에서 발생하는...

Rogue-MySql-Server

Rogue-MySql-Server Edit script and change file to read and server port if you want. Run script and connect to your server for read file from client side. Read mysql.log for readed file content...

MAL-014

MAL-014: Authenticated Arbitrary File Read in VMware vCenter Server The “com.vmware.appliance.version1.system.update.set” API component is vulnerable to a flag injection attack that can be leveraged with the “com.vmware.showlog” plugin in order to read arbitrary files as the “root” user on the...

MAL-012

MAL-012: Reflected Cross-Site Scripting in Admin Console leading to Remote Code Execution in Payara Server A reflected Cross Site Scripting XSS attack was found in the Payara Admin Console. By convincing an admin user to access the malicious URL and click the “Choose File” button, an attacker can...

MAL-001

MAL-001: FreeMarker Server-Side Template Injection in Liferay Portal An issue was discovered in Liferay - Portal =7.4.3.12-ga12. By inserting malicious content in the FTL Templates, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects ...

CVE-2026-11111-TOCTOU-in-File-Permission-Check-Before-Open

CVE-2026-11111 – 파일 열기 전 권한 검사의 TOCTOU 프로그램 코드 Python toctouserver.py - File server that checks permission then opens import os, time, tempfile from flask import Flask, request app = Flaskname SAFEDIR = '/tmp/safe' @app.route'/read' def readfile: filename = request.args.get'file' filepath =...

scout

Scout Scout는 웹 서버에서 공개되지 않은 VHOST, 파일 및 디렉토리를 발견하기 위한 URL 퍼저 및 스파이더입니다. 전체 단어 목록이 바이너리에 포함되어 있어 최대의 이식성과 최소한의 설정을 제공합니다. 조준하고 발사하세요! 사용법 Usage: scout command Available Commands: help Help about any command url Discover URLs on a given web server. version Display scout version. vhost Discover VHOS...

CVE-2026-23918

CVE-2026-23918 Apache modhttp2 Double-Free Detector https://github.com/user-attachments/assets/d6c30e58-548c-4b6d-9ba3-baa667238a58 python3 h2ghost.py -h usage: h2ghost.py -h --host HOST --port PORT --tls --no-tls --iterations ITERATIONS --burst-n BURSTN --timeout TIMEOUT --crash-threshold...

CVE-2025-55182-Exploit-PoC-Scanner

CVE-2025-55182 - React Server Components RCE Exploit v2.0 A comprehensive security research tool for testing CVE-2025-55182 and CVE-2025-66478 vulnerabilities in React Server Components RSC and Next.js Server Actions. Vulnerability Overview Property| Value ---|--- CVE IDs| CVE-2025-55182,...

local-mcp

local-mcp Zero-dependency MCP server for local file operations. 13 filesystem tools + 3 meta-tools for progressive discovery — no SDKs, no frameworks, no npm install needed. MCP Protocol: 2024-11-05 · Transport: stdio + Streamable HTTP · Runtime: Node.js ≥ 22.0.0 Architecture local-mcp.mjs — 595...

tinydtls

CONTENTS This library contains functions and structures that can help constructing a single-threaded UDP server with DTLS support in C99. The following components are available: dtls Basic support for DTLS with pre-shared key mode. tests The subdirectory tests contains test programs that show how...

CVE-2026-63292

⚠️ CVE-2026-63292 — Apache HTTP Server セキュリティ脆弱性 🔐 --- 🔎 概要 CVE-2026-63292 は、Apache HTTP Server の modvhostalias モジュールに影響を与えるスタックベースのバッファオーバーフロー脆弱性です。 この問題は、過大な HTTP Host ヘッダーと VirtualDocumentRoot ホスト名フォーマット指定子を含む特定のサーバー設定下で発生する可能性があります。 脆弱性 CVE-2026-63292 ├── Component: modvhostalias ├── Type:...

ssllabs.rb

ssllabs.rb Ruby gem for Qualys SSL Labs server test. API Notes All API objects described in the SSL Labs API docs are exposed as native ruby objects. Properties are accessed with "underscored" names, i.e. endpoint.hoststarttime will return the hostStartTime field from the API response. All boolea...

exchange-scanner

Microsoft Exchange Server Scanner Description This tool scans several common public-facing services on a target host in order to detect Microsoft Exchange Server and fingerprint its software version if possible. To do this, it uses the following techniques: Outlook Web Access OWA fingerprinting b...

CVE-2024-54330

CVE-2024-54330 Hurrakify bfdibc85r04ky96cie05dfzjjgigz...

CVE-2018-12533

CVE-2018-12533 Credits to https://www.lucifaer.com/2018/12/05/RF-14310%EF%BC%88CVE-2018-12533%EF%BC%89%E5%88%86%E6%9E%90/...

Sync_Breeze_Enterprise_10_6_24_-DOS

SyncBreezeEnterprise10624-DOS Exploit Title: Sync Breeze Enterprise 10.6.24 - Denial Of Service Vulnerability Date: 03-09-2018 Exploit Author: Ege Balcı Vendor Homepage: http://www.syncbreeze.com Software Link: http://www.syncbreeze.com/setups/syncbreezeentsetupv10.6.24.exe Version: 10.6.24 Teste...

santa

Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...