CVE-2025-29015

CVE-2025-29015 - Internet Banking System 2.0.0 Stored XSS in pagesaccount.php Description A Stored Cross-Site Scripting XSS vulnerability exists in Code Astro Internet Banking System 2.0.0 via the name parameter in /admin/pagesaccount.php. Malicious JavaScript code can be injected and stored in t...

CVE-2022-0155-PoC

CVE-2022-0155 Proof-of-Concept PoC This repository contains a demonstration of the CVE-2022-0155 vulnerability. The vulnerability was detected by ranjit-git and is described in detail here. The purpose of this PoC is to demonstrate that the vulnerability doesn't just apply to scenarios where...

CVE-2025-68461

CVE-2025-68461 Scanner A C++ security scanner tool to detect Cross-Site Scripting XSS vulnerabilities in Roundcube Webmail installations. Impact Unauthorized access to user accounts Session hijacking Data exposure Unauthorized actions on behalf of users Affected Versions The scanner checks for th...

CookieCatcher

CookieCatcher CookieCatcher is an open source application which was created to assist in the exploitation of XSS Cross Site Scripting vulnerabilities within web applications to steal user session IDs aka Session Hijacking. The use of this application is purely educational and should not be used...

ja4

JA4+™ Network Fingerprinting JA4+ is a suite of network fingerprinting methods by FoxIO that are easy to use and easy to share. These methods are both human and machine readable to facilitate more effective threat-hunting and analysis. The use-cases for these fingerprints include scanning for...

CVE-2024-40111-Exploit

CVE-2024-40111: Stored Cross-Site Scripting XSS in Automad 2.0.0-alpha.4 Exploit Details Exploit Title : Stored Cross-Site Scripting XSS in Automad 2.0.0-alpha.4 Date : 2024-06-20 Exploit Author : Jerry Thomas w3bn00b3r Vendor Homepage : Automad Software Link : Automad GitHub Repository Category ...

HotelDruid-CVE-2021-42948

CVE-2021-42948 HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's. The session token used to access authenticated pages of the application is passed using GET...

CVE-2024-44000-LiteSpeed-Cache

Poc LiteSpeed Cache CVE-2024-44000 Exploit CVE-2024-44000 is a vulnerability in the LiteSpeed Cache plugin, a popular WordPress plugin. This vulnerability affects session management in LiteSpeed Cache, allowing attackers to gain unauthorized access to sensitive data. The script works in the...

CVE-2025-25747-HotelDruid-3-0-7-Reflected-XSS

CVE-2025-25747 - Reflected XSS Vulnerability in HotelDruid 3.0.7 Description Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristinabackup parameter in the creabackup.php endpoint Severi...

CVE-2024-57427

CVE-2024-57427 - Reflected Cross-Site Scripting XSS PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting XSS. Multiple endpoints improperly handle user input, allowing malicious scripts to execute in a victim’s browser. Attackers can craft malicious links to steal...

RDPHijack-BOF

BOF - RDPHijack Cobalt Strike Beacon Object File BOF that uses WinStationConnect API to perform local/remote RDP session hijacking. With a valid access token / kerberos ticket e.g., golden ticket of the session owner, you will be able to hijack the session remotely without dropping any beacon/too...

CVE-2024-39090-PoC

CVE-2024-39090 PoC Exploit Script This PoC script exploits CVE-2024-39090, a CSRF to Stored XSS vulnerability in PHPGurukul Online Shopping Portal v2.0. It automates CSRF attacks to inject persistent JavaScript payloads, which execute when a privileged user accesses the affected page, enabling...

CVE-2024-57428

CVE-2024-57428 A stored cross-site scripting XSS vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fields eventimg, seatmaps and seat number configurations numbernewX in pjActionCreate. Attackers can inject persistent JavaScript, leading to...

CVE-2026-36669-FengOffice

Security Advisory: CVE-2026-36669 Unauthenticated Arbitrary File Upload in Feng Office Community Edition An unauthenticated arbitrary file upload vulnerability exists in ckuploadhandler.php in Feng Office Community Edition version 3.11.13.11. This flaw allows remote, unauthenticated attackers to...

ssh-mitm

SSH-MITM - ssh audits made simple An interactive SSH interception tool for authorized security audits. Intercept sessions, monitor live traffic, inject commands, and manipulate file transfers — all in real time. !Follow me on...

CVE-2024-57522

CVE-2024-57522 - Stored XSS Vulnerability in Users.php - SourceCodester Packers and Movers Management System 1.0 Description This repository contains a Proof of Concept PoC for a Stored Cross-Site Scripting XSS vulnerability in the Packers and Movers Management System 1.0 by SourceCodester. The...

SessionHop

SessionHop SessionHop is a C tool that utilizes the IHxHelpPaneServer COM object, configured to run as an Interactive User, to hijack specified user sessions. By creating a session moniker and utilizing the COM object's Execute interface, operators can run arbitrary files within another user's...

CVE-2025-4162030

Security Advisory: CVE-2025-4162030 This security summary was provided by CoPilot ^1^. The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be...

PuttyRider

PuttyRider Hijack Putty sessions in order to sniff conversation and inject Linux commands. Download PuttyRider-bin.zip Documentation Defcamp 2014 presentation - pdf Defcamp 2014 presentation - video Examples List existing Putty processes and their status injected / not injected PuttyRider.exe -l...

TeleShadow3

TeleShadow3 Teleshadow3- Advanced Telegram Desktop Session Hijacker! Download Click HERE to download the latest version! Screenshot Stealing desktop telegrams has never been so easy ! Set the email and sender details of the sender and recipient or use Telegram API! and send it to the victim after...