CVE-2024-50379

Manual exploitation is troublesome, so I whipped up an exp.. Usage: shell.jsp is the shell file, ggsl.jsp is the name/path saved to the target server. ./CVE-2024-50379 -u http://192.168.2.245:8080 -f shell.jsp -p ggsl.jsp Disclaimer This tool is only intended for legally authorized enterprise...

defcon33_silence_kill_edr

🛡️ DEFCON Workshop: Putting EDRs in Their Place 💀 Killing and Silencing EDR Agents Like an Adversary Setup EDR Killing Custom EDR Evasion 🎯 What You’ll Do Each student will be provisioned their own lab environment to: 🔍 Investigate a live EDR agent: discover its hooks, logs, and reach ⚔️ Compile &...

x8

x8 Hidden parameters discovery suite written in Rust. The tool aids in identifying hidden parameters that could potentially be vulnerable or reveal interesting functionality that may be missed by other testers. Its high accuracy is achieved through line-by-line comparison of pages, comparison of...

spring-RCE-CVE-2022-22965

Vulnerability Overview Recently, Spring released a major CVE vulnerability. The CVE information states: "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as ...

Exploit for CVE-2026-82222

⚡ GHOSTLYR00T - GiveWP RCE Exploit Framework...

Nosql-MongoDB-injection-username-password-enumeration

Nosql injection username and password enumeration script Using this script, we can enumerate Usernames and passwords of Nosqlmongodb injecion vulnerable web applications. Exploit Title: Nosql injection username/password enumeration. Author: Kalana Sankalpa Anon LK. Website:...

CVE-2026-2898-FunAdmin-Deserialization

CVE-2026-2898 - FunAdmin Insecure Deserialization Summary FunAdmin Disclaimer For educational and authorized testing only...

CVE-Requests-1896609

CVE Requests 1896609 - feiskyer/mcp-kubernetes-server Executive Summary This report details two critical security vulnerabilities discovered in the feiskyer/mcp-kubernetes-server package. When deployed, the server exposes an MCP tool named kubectl which is intended to provide limited, safe access...

CVE-2022-26937

Windows Network File System Crash PoC CVE-2022-26937 root@kitploit: nt!KeBugCheckEx: fffff8038996efa0 48894c2408 mov qword ptr rsp+8,rcx ss:0018:ffffd000d589ae60=0000000000000139 1: kd !analyze -v Bugcheck Analysis KERNELSECURITYCHECKFAILURE 139 A kernel component has corrupted a critical data...

CVE-2025-65354

CVE-2025-65354 — SQL Injection Vulnerability Summary An SQL Injection vulnerability exists in the PuneethReddyHC event-management application version 1.0 due to improper input handling. Vulnerability Type SQL Injection Affected Component Endpoint: /Grocery/searchproductsitname.php Parameter:...

CVE-2026-8732-POC

CVE-2026-8732 - Escáner Masivo de WordPress WP Google Map Pro y Creador Automático de Administradores 📌 Descripción Esta herramienta explota CVE-2026-8732 , una vulnerabilidad en el plugin WP Google Map Pro para WordPress. La vulnerabilidad permite a un atacante no autenticado obtener un wpmptoke...

sass-king

SASS King Reverse engineering NVIDIA SASS from controlled kernels to production audits. Article 1 · Article 2 · Knowledge base · Pattern library · SM120 instruction glossary · Encoding notes · Start here · Project structure · Tensor-core chapters · Contributing SASS King is a systematic...

Blackash-CVE-2025-31131

Blackash-CVE-2025-31131 CVE-2025-31131 - YesWiki 4.5.2 Path Traversal Exploit Description YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2. NIST: NV...

Find-AdminAccess

FindAdminAccess A C utility that enumerates domain computers and tests administrative access to them, including connectivity checks, admin privileges verification, and C$ share writability testing. Features Enumerate all computers in an Active Directory domain Test network connectivity Verify...

cosign

cosign Firma de contenedores OCI y otros artefactos con Sigstore! Cosign tiene como objetivo hacer de las firmas infraestructura invisible. Cosign admite: "Firma sin claves" con la autoridad certificadora Fulcio del bien público de Sigstore y el registro de transparencia Rekor por defecto Firma c...

cosign

cosign Signing OCI containers and other artifacts using Sigstore! Cosign aims to make signatures invisible infrastructure. Cosign supports: "Keyless signing" with the Sigstore public good Fulcio certificate authority and Rekor transparency log default Hardware and KMS signing Signing with a cosig...

ffuf

ffuf - 更快地模糊测试，你这个傻瓜 一个用 Go 编写的快速 Web 模糊测试工具。 安装 示例用法 内容发现 虚拟主机发现 参数模糊测试 POST 数据模糊测试 使用外部变异器 配置文件 帮助 交互模式 安装 从发布页面下载预编译二进制文件，解压并运行！ 或 如果你在 Windows 上并使用 Scoop，可以通过以下命令安装 ffuf：scoop install ffuf 或 如果你在 Windows 上并使用 Winget，可以通过以下命令安装 ffuf：winget install ffuf.ffuf 或 如果你在 macOS 上并使用 homebrew，可以通过以下命令安...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

drupalgeddon2-cli

drupalgeddon2-cli A command-line rewrite of the Drupalgeddon2 CVE-2018-7600 proof-of-concept, built as a study exercise while working through the Hack The Box Academy Attacking Common Applications module. !WARNING For authorised security testing and education only. Running this against systems yo...

modo

Modo The open-source AI IDE that plans before it codes. MIT License · Quick Start · What Modo Adds · Contributing I wanted a small feature in an AI coding tool. Couldn't find a way to suggest it. So I asked myself: how hard is it to actually build something like Kiro, Cursor, or Windsurf? Turns o...