EUVD-2026-96927

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but...

CVE-2026-108578 Neterbit NW-431F Embedded Web Server sms.json information disclosure

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but...

CVE-2026-108578

A vulnerability exists in the Embedded Web Server component of Neterbit NW-431F 20250715 . Specifically, an unknown function within the /sms.json file allows for information disclosure . This vulnerability can be triggered via a remote attack . No remediation details or specific exploit informati...

CVE-2025-53770

CVE-2025-53770 SharePoint Description The deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an attacker to execute code remotely and compromise the system. Microsoft is aware of active exploitation and is preparing a comprehensive update. Ensure that mitigations...

headerpwn

headerpwn Un fuzzer para analizar cómo responden los servidores a diferentes cabeceras HTTP. 🏗️ Instalación ⛏️ Uso 📡 Proxy de solicitudes HTTP Instalación Para instalar headerpwn, ejecuta el siguiente comando: go install github.com/devanshbatham/[email protected] Uso headerpwn te permite...

sak1to-shell

sak1to-shell Servidor c2 multi-hilo, multi-sistema/plataforma Linux/Windows y cliente de shell TCP inversa para Windows, ambos escritos en C. Compilando el cliente de shell TCP inversa con i686-w64-mingw32-gcc: i686-w64-mingw32-gcc sakitorevshell.c lib/windows/sakitowincore.c -o sakitorevshell.ex...

CVE-2026-108753 Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and...

EUVD-2026-96917

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...

CVE-2026-108718 Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CVE-2026-108718

The Rill platform (versions 0.77.0 through 0.90.5 ) contains a missing authorization vulnerability within the admin OAuth server . The flaw allows the server to issue authorization codes to dynamically registered clients without requiring explicit user consent. An attacker can register a maliciou...

EUVD-2026-96992

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CVE-2026-108718 Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CS4277-CVE-Path-Traversal-Apache-HTTP-Server

CS4277-CVE-Path-Traversal-Apache-HTTP-Server Team Members: Emily Nguyen, Jonathan Kim, Joon Jang Project Topic Selection: Project 1: Recreate and Exploit a Real-World CVE: Path Traversal CVE-2021-41773 in the Apache HTTP Server. Project Goal: We hope to reproduce CVE-2021-41773 to deepen our...

CVE-2025-55182

CVE-2025-55182 Next.js RCE Exploit Tool 🚀 This is an automated Proof-of-Concept PoC tool for the Next.js React Server Components CVE-2025-55182 Remote Code Execution RCE vulnerability. The tool integrates an interactive Shell , intelligent protocol detection , and multi-threaded batch scanning...

react2shell-CVE-2025-55182

React2Shell Exploit CVE-2025-55182 Python exploit for Next.js React Server Components RCE vulnerability with HTTP/HTTPS support. 🚀 Quick Start Clone & run git clone https://github.com/BrianLopezM99/react2shell-CVE-2025-55182.git cd react2shell-CVE-2025-55182 python3 exploitreact2shell.py "" 📖 Usa...

whonow

Servidor DNS Whonow Un servidor DNS malicioso para ejecutar ataques de DNS Rebinding sobre la marcha. whonow te permite especificar respuestas DNS y reglas de rebinding dinámicamente usando las propias solicitudes de dominio. responder a consultas DNS para este dominio con 34.192.228.43 la primer...

CVE-2021-1675

CVE-2021-1675 Fix without disabling Print Spooler Script checks the existance of de CVE-2021-1675 fix from Microsoft and removes members from the "Pre-Windows 2000 Compatible Access" group on the domain. Issues: With an empty "Pre-Windows 2000 Compatible Access" group the following things stop...

CVE-2020-14065

CVE-2020-14065 Icewarp Email Server 12.3.0.1 unlimitedfileupload https://nvd.nist.gov/vuln/detail/CVE-2020-14065...

CVE-2025-55182-PoC

⚡ React2Shell Exploit PoC CVE-2025-66478 Next.js Remote Code Execution RCE via Prototype Pollution in Server Components 🕵️‍♂️ Overview This repository contains a Proof of Concept PoC for CVE-2025-66478 also referenced as CVE-2025-55182 in some contexts, a critical vulnerability affecting Next.js...

xolo

XOLO Autor: ET Lownoise Versión: 1.0 Herramienta para rastrear, visualizar e interactuar con enlaces de servidor SQL en un gráfico d3 para ayudar en sus ejercicios de equipo de pentest hacking de evaluaciones de riesgo rojo/azul/púrpura/... Requisitos: Requests==2.18.4 Flask==0.12.2 Json Pypyodbc...