mhr-cfw

MHR-CFW MITM Domain-Fronted HTTP Relay + Cloudflare Worker Exit English| Persian ---|--- How It Works 1 - GAS + Cloudflare Worker Exit Client - Local Relay - Google/CDN Front - GAS Google Apps Script Relay - Cloudflare Worker - Exit | +- Shows www.google.com to network DPI filter 2 - GAS +...

GHSA-XMJ3-9GF7-H52W vulnerabilities

Vulnerabilities for packages: azure-functions-python-worker...

CVE-2019-11043

CVE-2019-11043 0th3rs Security Team ====================== In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 Tested under PHP 7.2.20/7.3.10 Instructions 1、较为稳定,只要爆破出query长度和Header头字段长度 2、autosession检测漏洞存在性 3、实现判断目标worker进程数实现健壮性 4、全worker进程污染 Nginx configuration locati...

CVE-2021-26690---Apache-mod_session

Patch diffing for CVE-2021-26690 - Apache modsession This vulnerability is a NULL pointer dereference within the modsession Apache's module. It will cause a denial of service for the child processes of Apache's httpd. By using a repetitive loop, each Apache workers will crash, leading to a denial...

CVE-2026-42536-PoC

CVE-2026-42536: Apache HTTP Server modxml2enc Heap Overflow PoC This PoC code is part of the blog post at https://erberkan.github.io/2026/PatchDiffingandN-DayDefense/ . This repository contains a controlled proof of concept for CVE-2026-42536, a heap-based out-of-bounds write in Apache HTTP...

NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256

CVE-2026-9256 NGINX ngxhttprewritemodule PoC Derivation Process and Thoughts Scope: Only for local ranges, authorized reproduction environments, vulnerability verification, and protection rule analysis. Do not use against unauthorized targets. The PoC ideas in this document only verify remotely...

ls-poc

CVE-2026-30368 Proof of concept !IMPORTANT This is patched and now requires credentials, use the workaround to perform actions on yourself. Introduction CVE-2026-30368 allows an attacker to control student devices via a weak authentication flaw in Lightspeed Classroom management. The POC poc.js...

CVE-2026-23918-Apache-H2-PoC

CVE-2026-23918-Apache-H2-PoC This is a proof-of-concept exploit for the double-free vulnerability in Apache's modhttp2 CVE-2026-23918. It's a nasty bug that hits the h2mplx.c stream cleanup path. Basically, if you time it right, you can get the server to try and clean up the same stream twice,...

fix_nginx_cve_2026_42945

NGINX CVE-2026-42945 One-Click Fix Script Automatically detect OS distribution, upgrade NGINX to the fixed version ≥1.30.1, backup configuration, and auto-rollback. Vulnerability Description Vulnerability ID: CVE-2026-42945 Vulnerability Name: NGINX Rift When NGINX processes specific rewrite...

boundary

Boundary Community Edition CE is no longer under active development, and this repository has been archived as of October 8, 2026. Future Boundary development will focus on HCP Boundary and Boundary Enterprise, where we can provide enterprise grade human and agentic access capabilities. This...

open-klara

Open KLara Open KLara is a community-driven fork of KLara by Kaspersky Lab — a distributed system for scanning large malware collections with Yara rules. This project is maintained by the community and is not affiliated with Kaspersky Lab. Features Web Interface — Fire-and-forget Yara scans with...

CVE-2019-11043

CVE-2019-11043 0th3rs Security Team ====================== In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 Tested under PHP 7.2.20/7.3.10 Instructions 1、较为稳定,只要爆破出query长度和Header头字段长度 2、autosession检测漏洞存在性 3、实现判断目标worker进程数实现健壮性 4、全worker进程污染 Nginx configuration locati...

waf-checker

WAF Checker This project helps you check how well your Web Application Firewall WAF protects your product against common web attacks. It can be run as a Cloudflare Worker with a built-in interactive Web UI or as a standalone Node.js CLI tool. 🧪 Test Coverage & Status All packages are thoroughly...

of-CORS

of-CORS of-CORS is Truffle Security's tool suite for identifying and exploiting CORS misconfigurations on the internal networks of bug bounty targets using typosquatting. You can read more here https://trufflesecurity.com/blog/of-CORS How Does it Work?? of-CORS is a Python3 web application built ...

CVE-2026-73321

CVE-2026-73321: PHP worker stack overflow through nested BBCode XenForo before 2.3.13 can exhaust a PHP worker through deeply nested BBCode. Result The public editor/to-html route sends guest-supplied BBCode through XenForo's recursive parser and renderer. It does not apply a raw-length or nestin...

CVE-2026-75430_PowerJob_worker_deployContainer_RCE

PowerJob Worker Unauthenticated Remote Code Execution via /worker/deployContainer Arbitrary JAR Loading 1. Summary The PowerJob Worker exposes the deployContainer handler on its HTTP transport port 27777 with no authentication whatsoever. An attacker submits an arbitrary URL; the Worker downloads...

kubebot

Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...

CVE-2026-25769

🚨 CVE-2026-25769 - Wazuh Insecure Deserialization RCE Critical Worker ➜ Master Remote Code Execution in Wazuh Cluster Mode Unsafe deserialization in Wazuh cluster communications allows a compromised worker node to achieve root RCE on the master node. 📌 Overview CVE ID: CVE-2026-25769 Product: Waz...

CVE-2026-42945

CVE-2026-42945 PoC Go 中文 | English A detection and exploitation helper for nginx HTTP/2 CVE-2026-42945. Use it only in authorized environments to verify vulnerability presence, compare patched vs. vulnerable behavior, and reproduce PoC logic in a controlled lab. Affected versions heuristic: nginx...

wavecrack

Wavecrack Description A user-friendly Web interface to share an hashcat cracking box among multiple users with some pre-defined options. Screenshots The homepage Adding an hash to crack Seeing the results and some stats Outline This Web application can be used to launch asynchronous password crac...