CVE-2026-97731

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

CVE-2023-32243

CVE-2023-32243 Essential Addons for Elementor - Unauthorized Account Takeover. PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

GEVAUDAN

GEVAUDAN Gluster Environment Vulnerable AUthentication Data Access & Nuke. Getting Started Gevaudan is a Red Hat GlusterFS exploit for CVEs 2018-1088 & 2018-1112. Available in both standalone and metasploit module formats. Presentations | Date| Conference| Link to Video| Link to Slides...

minio_unauth_check

miniounauthcheck CVE-2023-28432, herramienta de detección de fugas de información de MinIO Esta herramienta es solo para fines educativos y de investigación, para mejorar la conciencia de seguridad y las prácticas de desarrollo de software. Antes de usar esta herramienta, asegúrese de cumplir con...

Gorsair

Gorsair Gorsair es una herramienta de pruebas de penetración para descubrir y acceder remotamente a APIs de Docker desde contenedores Docker vulnerables. Una vez que tiene acceso al demonio de Docker, puedes usar Gorsair para ejecutar comandos directamente en contenedores remotos. Exponer la API ...

abaddon

Abaddon Red team operations involve miscellaneous skills, last several months and are politically sensitive; they require a lot of monitoring, consolidating and caution. Wavestone’s red team operations management software, Abaddon, has been designed to make red team operations faster, more...

behave

¡Behave! Una extensión de navegador de monitoreo aún en desarrollo para páginas que se portan mal. NB : Este es el repositorio de código del proyecto, si buscas las extensiones empaquetadas: Firefox: https://addons.mozilla.org/en-US/firefox/addon/behave/ Chrome:...

CVE-2026-22241

🚨 CVE-2026-22241 - Open eClass Theme Import Remote Code Execution 📌 Vulnerability Summary Open eClass also known as GUnet eClass, a widely used open-source Learning Management System LMS, contains a critical Unrestricted File Upload vulnerability in its Theme Import feature. An authenticated...

CVE-2023-32749-PoC

CVE-2023-32749 | Pydio Cells Unauthorised Role Assignment Exploit for CVE-2023-32749 affecting Pydio Cells 4.1.2 and earlier. A low-privileged authenticated user can create a new external user with all roles assigned, granting access to all cells and non-personal workspaces across the instance...

authcov

AuthCov Escaneo de cobertura de autorización de aplicaciones web. Introducción AuthCov rastrea su aplicación web utilizando un navegador Chrome sin interfaz gráfica mientras está conectado como un usuario predefinido. Intercepta y registra las solicitudes API, así como las páginas cargadas durant...

CVE-2025-66678

CVE-2025-66678 En Hardware Read & Write Utility v1.25.11.26, el controlador expuso lectura y escritura arbitrarias de MSR, así como lectura y escritura de memoria física a través de MmMapIoSpace, ambas habilitan la ejecución de código en el kernel. Detalle del PoC El PoC intercambiará el token...

XSS-Bypass-Filters

XSS-Bypass-Filters Redirection root@kitploit: document.location= document'location'= window.location= this"window""location"= document.location.href= location.href= location= window.location.assign window'location''href'= document.location.replace window.open"link", "blank"; Link root@kitploit:...

CVE-2024-47533-Cobbler-XMLRPC-Authentication-Bypass-RCE-Exploit-POC

CVE-2024-47533 - Cobbler XMLRPC Authentication Bypass RCE Exploit ⚠️ Critical Remote Code Execution via Authentication Bypass in Cobbler 🛠️ PoC implementation by @dollarboysushil 💡 Overview Cobbler, a Linux installation server that enables rapid setup of network installation environments, has an...

CVE-2026-38577

CVE-2026-38577 — Tenda HG21 Hardcoded Root Credentials Summary Field| Value ---|--- CVE ID| CVE-2026-38577 Vendor| Tenda Product| Tenda HG21 XPON Fiber Modem Affected Version| V4.0.0-260302 Product Key| HG21-V1.0-TDE01 Hardware Version| V1.0 Firmware Build Date| 2026-03-02 Firmware File|...

CVE-2026-32136_exploit

CVE-2026-32136exploit - AdGuard Home h2c Upgrade Auth Bypass Unauthenticated authentication bypass in AdGuard Home 0.107.73 via HTTP/2 cleartext h2c upgrade. | ---|--- CVE| CVE-2026-32136 CVSS| 9.8 Critical — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-287 Improper Authentication Affected| AdGua...

Advanced_Initial_access_in_2024_OffensiveX

This repository does not have a README...

CVE-2022-41876

CVE-2022-41876 - eZ Platform user information disclosure A vulnerability emerged in eZ Platform letting an unauthenticated user access every contributor password's hash. This PoC enumerates every possible GraphQL path leading to a 'User' object, and then requests these paths to retrieve users'...

CVE-2024-4879

CVE-2024-4879 Bulk scanning tool for ServiceNow CVE-2024-4879 vulnerability. Overview This tool is designed for bulk scanning of the ServiceNow CVE-2024-4879 vulnerability. It is inspired by Assetnote security research, which covers the recent ServiceNow CVE-2024-4879, CVE-2024-5178, and...

CVE-2025-6713

CVE-2025-6713 Creación de un pipeline de agregación para acceder a datos sin la autorización adecuada debido al manejo incorrecto de $mergeCursors en MongoDB v8.0 v7.0 v6.0 6.0.22 instalación no es muy difícil, solo usa pip3 para instalar los requisitos: pip install -r requirements uso...

CVE-2026-25049

🚨 CVE-2026-25049 – n8n Unauthenticated Settings Disclosure 📌 Overview CVE ID: CVE-2026-25049 Affected Software: n8n Severity: Critical Category: Improper Access Control / Information Disclosure This vulnerability allows unauthenticated access to internal configuration data via a REST API endpoint...