Cisco ASA Missing Authorization (CVE-2025-20362)

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial...

PT-2026-106774

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayons store.php, causing the authorization dispatcher to resolve an...

Cisco ASA Code Injection (CVE-2024-20485)

A vulnerability in the VPN web server of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this...

CVE-2025-24813

Apache Tomcat Unauthenticated RCE - CVE-2025-24813 This repository provides a guide and testing environment to assess the CVE-2025-24813 vulnerability. Details Affected Versions: Apache Tomcat 11.0.0-M1 to 11.0.2 Apache Tomcat 10.1.0-M1 to 10.1.34 Apache Tomcat 9.0.0.M1 to 9.0.98 References...

CVE-2005-0575-knet-exploit

CVE-2005-0575 KNet Web Server 1.04b Remote Buffer Overflow SEH Exploit for x86 Windows XP SP3, this exploit needs some adjustment ! edit the code before run ! made in the past, I forgot when I made it...

CVE-2024-35106-POC

NEXTU FLETA Wifi6 Router DOS, Potential RCE POC This document describes how the exploit was carried out on the EZNET FLETA WiFI router through the CVE-2024-35106 vulnerability. Vulnerability information CVE ID CVE-2024-35106 Vendor of Product NEXTU Product FLATA AX1500 Wifi6 Router Version 1.0.3...

Netis-N5VN-AC1200-DOS

Exploit Title: Netis N5VN AC1200 - Buffer Overflow DOS Denial of Service Date: 05/03/2024 Exploit Author: Van Lam Nguyen Facebook: fb.com/vanlam1412 Vendor Homepage: Netis Systems Version: Netis N5VN AC1200 V1.0.1.1742 Tested on: Windows CVE : CVE-2024-44596 Overview There exist a buffer overflow...

OpenPLC-CVE-2021-31630-RCE

OpenPLC v3 Authenticated RCE CVE-2021-31630 This is a modern Python 3.13+ compatible proof-of-concept exploit for CVE-2021-31630, a vulnerability in OpenPLC v3 that allows an authenticated user to upload a custom hardware layer containing malicious code, leading to remote code execution RCE on th...

Astra Linux – Vulnerability in nbconvert

The GitHub Security Lab identified sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML, which may lead to cross-site scripting XSS vulnerabilities if...

Astra Linux – Vulnerability in Apache2

Improper neutralization of vulnerabilities related to escape, meta, or control sequences in the Apache HTTP Server, caused by unexpected overrides of variables calculated by the server for CGI programs, through environment variables set via Apache configuration. This issue affects the Apache HTTP...

Astra Linux – Vulnerability in libsoup2.4

A flaw was discovered in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash...

Astra Linux – Vulnerability in Apache2

An HTTP response smuggling vulnerability exists in the Apache HTTP Server via modproxyuwsgi. This issue affects the Apache HTTP Server: from version 2.4.30 through 2.4.55. Special characters in the origin response header can cause the response forwarded to the client to be truncated or split...

Astra Linux – Vulnerability in Apache2

When an HTTP/2 stream is reset by a client via an RST frame, there is a time window during which the memory resources associated with the request are not immediately reclaimed. Instead, the deallocation of these resources is delayed until after the connection is closed. This allows clients to...

CVE-2019-16278-Nostromo-1.9.6-RCE

CVE-2019-16278-Nostromo-1.9.6-RCE This is a exploit of CVE-2019-16278 for Nostromo 1.9.6 RCE. This exploit allows RCE on the victim machine. Requirements optparse socat sys Usage You can use the exploit as follows: python3 CVE-2019-16278.py --ip=10.129.192.225 --port=80 --command="bash -c 'bash -...

CVE-2002-0288

CVE-2002-0288 Phusion WebServer 1.0 - Directory Traversal 1 Exploit-db publication at https://www.exploit-db.com/exploits/21291/ CVE-2002-0288 Phusion WebServer 1.0 - Directory Traversal 2 Exploit-db publication at https://www.exploit-db.com/exploits/21292/ Author Alex Hernandez aka @alt3kx...

CVE-2024-4577

أسرع أداة استغلال لثغرة CVE-2024-4577 الوصف: تنفيذ أوامر عن بُعد عبر PHP CGI أداة استغلال CVE-2024-4577 exploit.py هي سكريبت بلغة Python مصمم لاستغلال ثغرة محددة في خوادم الويب CVE-2024-4577. بناءً على محتوى الاستجابة، يرسل طلبات POST إلى قائمة من المضيفين لتحديد ما إذا كانوا عرضة للثغرة. الميزات...

CVE-2025-50286

Grav Admin Direct Install RCE CVE-2025-50286 Metasploit module and lab setup for authenticated Remote Code Execution in the Grav Admin Plugin Direct Install functionality. Overview CVE: CVE-2025-50286 Impact: Authenticated RCE Vector: Admin panel → Direct Install Result: Arbitrary command executi...

CVE-2021-44228

CVE-2021-44228-POC Yet another CVE-2021-44228 POC Affected Log4j versions: from 2.0-beta9 up to 2.14.1 Prerequisites Used Java: OpenJDK 11 https://jdk.java.net/archive/ Maven required to build apps in this repo alternatively, download prepared jar files from release: https://maven.apache.org/...

Windows-Exploitation-Web-Server-Tomcat-8.5.39-CVE-2019-0232

This repository does not have a README...

boa-detector

boa-detector This Zeek package detects the Boa web server string in HTTP headers. All Boa versions are considered vulnerable: https://www.microsoft.com/en-us/security/blog/2022/11/22/vulnerable-sdk-components-lead-to-supply-chain-risks-in-iot-and-ot-environments/ When the /^Boa/./ server string i...