CVE-2025-52122

CVE CraftCMS Freeform CraftCMS Freeform contains an SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title. Vulnerable versions are v5.0.0 test % set form = freeform.form'pentest' % % if form % form.render % else % Form not foun...

nextjs-security-update

nextjs-security-update There are people building OSS tools to exploit the new Next.js vulnerabilities. This is a tool to fight back - makes it dumb easy to upgrade all your Next.js apps across all your GitHub accounts. Uses the official Vercel fix tool under the hood. What happened Dec 11, 2025:...

seeker

Available in Concept behind Seeker is simple, just like we host phishing pages to get credentials why not host a fake page that requests your location like many popular location based websites. Read more on thewhiteh4t's Blog .Seeker Hosts a fake website which asks for Location Permission and if...

CVE-2021-44228-Apache-Log4j-Rce

Usage: 1. running RMIServer 2. running Main...

Goahead-CVE-2017-17562

Goahead-CVE-2017-17562...

react2shellpoc

Este repositorio contiene una prueba de concepto que demuestra cómo se comporta una clase específica de vulnerabilidades de React Server Component dentro de un entorno de formación controlado y legal. Manual ┌──kali㉿kali-/Documents/tools/2025-55182 └─$ python exploit.py -h /\ /\ /\ /\ /\ /\ ||...

react2shellpoc

This repository contains a proof‑of‑concept demonstrating how a specific class of React Server Component vulnerabilities behaves inside a controlled, legal training environment. Manual ┌──kali㉿kali-/Documents/tools/2025-55182 └─$ python exploit.py -h /\ /\ /\ /\ /\ /\ || CVE-2025-55182 React Serv...

ritm

Ruby In The Middle HTTP/HTTPS interception proxy Ruby in the middle RITM is an HTTP/HTTPS interception proxy with on-the-fly certificate generation and signing, which leaves the user with the full power of the Ruby language to intercept and even modify requests and responses as she pleases...

Freeloader

Docker support for plexmediaservercrack Patches Plex Media Server running in Docker — both the official plexinc/pms-docker image and the community lscr.io/linuxserver/plex image — using the same LDPRELOAD-on-the-PMS-exec mechanism as the native systemd install. See the top-level README and the fu...

regenerator2000

Regenerator 2000 A modern, interactive 6502 disassembler for Commodore 8-bit machines. A modern take on Regenerator. 🕹️ Manual Analysis — A fast, keyboard-centric TUI for hands-on exploration: navigate code, define data, label subroutines, add comments, and iteratively refine your disassembly. 🤖...

CVE-2025-47812

CVE-2025-47812 Improper input validation led to Remote Code Execution to full system compromise 📘 Introduction: Julien Ahrens from RCE Security discovered a critical security vulnerability impacting WingFTP. Tracked as CVE-2025-47812, the vulnerability has a CVSS score of 10. Successful...

rakkess

rakkess Review Access - kubectl plugin to show an access matrix for server resources Intro Have you ever wondered what access rights you have on a provided kubernetes cluster? For single resources you can use kubectl auth can-i list deployments, but maybe you are looking for a complete overview?...

web

Network-wide ad blocking via your own Linux hardware Pi-hole website | Documentation | Discourse Forum | Donate Pi-hole Web Interface Pi-hole®'s Web interface based off of AdminLTE provides a central location to manage your Pi-hole and review the statistics generated by FTLDNS™. Easy-to-interpret...

CVE-2021-21985

CVE-2021-21985 The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. VMware has evaluated the severity of this issue to be in the Critical severity range with a...

JSRat-Py

JSRat-Py This is my implementation of JSRat.ps1 in Python so you can now run the attack server from any OS instead of being limited to a Windows OS with Powershell enabled. Added support to handle client invocation via either rundll32 or regsvr32 methods References & Original Project: regsvr32:...

h3-cli

NodeZero MCP Server The NodeZero MCP Server is now available, enabling you to run and manage a locally hosted MCP Server that brings NodeZero’s Find, Fix, Verify FFV capabilities directly to your development and security workflows. MCP Readme h3-cli: CLI tool for the Horizon3.ai API h3-cli is a...

L3MON

L3MON Layer 3 Sistema Avanzado de Gestión y Monitorización de Redes L3MON es un sistema de gestión y monitorización de redes de vanguardia desarrollado con NodeJS. Proporciona a los usuarios una interfaz web robusta e intuitiva que permite capacidades de gestión y monitorización de redes sin...

CVE-2024-31848-PoC

Exploiting CData within Jetty servers - CVE-2024-31848/49/50/51 - File Path Traversal & File Read What it is A prototype PoC for the automation of vulnerability analysis on targets running CData applications on an embedded Jetty server. Usage Just use -u or --url to specify your target, the scrip...

GenGravSSTIExploit

EN GenGravSSTIExploit is a PoC Python script that exploits an authenticated Server-Side Template Injection SSTI vulnerability in Grav CMS versions -p : Target URL in the format https://hostname. : Port number default is 80. Example: python GenGravSSTIExploit.py -t http://example.com -p 8080 4...

Spring4Shell-POC

Spring4Shell-POC CVE-2022-22965 Spring4Shell CVE-2022-22965 Prueba de Concepto/Información + Un servidor Tomcat vulnerable con una aplicación Spring4Shell vulnerable. Esta mañana temprano, múltiples fuentes han informado de una posible explotación RCE en el popular framework Java Spring. El nombr...