CVE-2026-41940

CVE-2026-41940: cPanel/WHM Authentication Bypass Single & Multi-Target Disclaimer: This document and the associated script exploit.py are provided strictly for educational purposes, security research, and authorized penetration testing. Do not use this software against systems you do not own or d...

CVE-2026-42533

CVE-2026-42533 — nginx Heap Buffer Overflow PoC Exploit Pre-Authentication Remote Code Execution via Two-Pass Capture Clobbering Public PoC released 2026-07-27 — Don't wait, patch now. | ---|--- CVE| CVE-2026-42533 CVSS 4.0| 9.2 Critical Type| Heap Buffer Overflow CWE-122 Affected| nginx 0.9.6 –...

TopazTerminator

TopazTerminator F, Another driver got burned.. I was gatekeeping wsftprm.sys driver for a while ; but since someone posted a public POC, I'm ungatekeeping it. We all know it'll get added to the driver blocklist soon, so here's my implementation for the same — in C This project exploits the...

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

CVE-2024-3400: Vulnerability Analysis, Patch Management, Cyber...

zig-pe

zig-pe Reflective PE loader written in Zig. Loads and executes native and .NET PE files directly from memory. Features PE Loading Pipeline Parse DOS and NT headers PE32 and PE32+ at runtime Map sections into allocated memory Resolve imports name and ordinal, PE32 4-byte / PE32+ 8-byte thunks Appl...

CVE-2024-12172

CVE-2024-12172 WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses = 3.2.21 - Missing Authorization to Authenticated Subscriber+ Arbitrary User Meta Update Description The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution,...

CustomC2ChannelTemplate

IAT Hooking for custom C2 channels This is a simple PoC and template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader. Blog post: https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/building-custom-c2-channels-by-hooking-winin...

blogpost_cve-2018-19987-analysis

CVE-2018-19987 D-Link OS command injection analysis Hello there! In this short blog post I'll break down a quick analysis that I performed to better understand the details behind CVE-2018-19987. At the beginning I went after this CVE because I thought that there wasn't any public information or...

CVE-2024-9935

CVE-2024-9935 PDF Generator Addon for Elementor Page Builder = 1.7.5 - Unauthenticated Arbitrary File Download Description The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5 via the rtwpgaepbdwnldpdf...

NoArgs

NoArgs: Manipulating and Hiding Process Arguments Twitter: @AzizWho Disclaimer: Educational Use Only This tool is intended solely for educational purposes. I am not liable for any misuse and all users must adhere to applicable laws. Illegal use is prohibited. Introduction NoArgs is a tool designe...

objdump-Out-Of-Bounds-write

GNU Binutils objdump — OOB Write → FSOP → Arbitrary Code Execution Target: GNU Binutils all versions through HEAD — objdump Environment: Debian 13 Trixie, glibc 2.41, x8664 Impact: Arbitrary code execution Vector: Crafted ELF file processed by objdump -g ASLR: Bypassed deterministic mmap delta...

Maverick

Maverick An Adaptix C2 agent built with Crystal Palace — a custom PIC Position Independent Code linker and PICO module system. Demonstrates how to build modular shellcode agents where each component transport, tasks, obfuscation is a separate PICO blob loaded at runtime. Note This agent does not...

SUSE-SU-2026:4619-1 Security update for expat

This update for expat fixes the following issues: - CVE-2025-59375: denial of service resource consumption caused by processing malformed small documents bsc1249584. - CVE-2026-24515: NULL dereference CWE-476 due to function XMLExternalEntityParserCreate failing to copy the encoding handler data...

frida-ui

Frida UI A modern, lightweight, web-based user interface for Frida, designed for Android application penetration testing. It allows you to interact with devices, processes, and scripts directly from your browser. Quick Start Install using uv recommended or pipx/pip uv tool install frida-ui Or: pi...

Shelly

Shelly | Simple Backdoor Manager with Python based on weevely Shelly is a simple tool that is written using Python, which functions to remote a website Instalation : $ git clone https://github.com/tegal1337/Shelly $ cd Shelly $ python3 shell.py Requirements : sudo pip install -r requirements.txt...

CVE-2026-112161 Lack of integrity checks in Mobatek’s MobaXterm

MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...

EUVD-2026-104122

MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...

CVE-2026-112161 Lack of integrity checks in Mobatek’s MobaXterm

MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...

CVE-2026-112161

MobaXterm Personal Edition (Portable) 26.4 GA is vulnerable to a local code execution flaw due to a lack of integrity checks when extracting the CygUtils64.plugin file. An attacker with local write permissions can replace the bin/cygwin1.dll library within that plugin with a malicious version. Wh...

Flutter-Reverse-Engineering-Labs

Flutter Reverse Engineering Labs This repository contains a series of progressive challenges designed to introduce the reverse engineering of Flutter applications. Since there aren't many blog posts or tutorials that explain Flutter reversing in detail, I decided to create this repo as a hands-on...