longfellow-zk

Longfellow ZK Overview The Longfellow library enables the construction of zero-knowledge protocols concerning legacy identity verification standards such as the ISO MDOC standard, the JWT standard, and W3 Verifiable Credentials. This implementation is described in: Anonymous credentials from ECDS...

SiYuan - SQL Execution

SiYuan = v3.7.2 contains a SQL injection caused by passing client-supplied SQL statements verbatim to the main read-write database handle in /api/search/searchEmbedBlock, letting attackers with publish RoleReader token or anonymous access read and modify content, exploit requires publish RoleRead...

Microsoft FrontPage Extensions - Information Disclosure

Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /vtibin/ virtual directory. id: CVE-2000-0114 info: name: Microsoft FrontPage Extensions - Information Disclosure author: r3naissance,matejsmycka severity...

DbGate - Remote Code Execution via Anonymous JWT

DbGate contains a remote code execution vulnerability exploitable by unauthenticated attackers. The /auth/login endpoint issues anonymous JWT tokens without credentials, and the /runners/start endpoint accepts JavaScript payloads that execute via Node.js childprocess, allowing arbitrary command...

Exploitarium-Detections

Exploitarium KQL Detection Coverage KQL detection rules for Microsoft Sentinel and Defender XDR covering the bikini/exploitarium anonymous disclosure — a personal research archive of 15+ distinct vulnerability targets across 109+ tracked files, released without vendor notification on June 23, 202...

CVE-2026-126839

A deserialization type-restriction control in the BSON serialization component can be bypassed because the check for compiler-generated types uses an overly permissive heuristic instead of precise identification. An unauthorized party can provide BSON content that, when deserialized into a loosel...

CVE-2026-126839 Deserialization allow-list bypass via anonymous-type misdetection in BSON object deserialization

A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identification. An unauthorized party able to supply BSON content...

ADTrapper

ADTrapper - Active Directory Security Analysis Platform Professional Active Directory Security Analysis and Threat Detection Platform Transform Windows authentication logs into actionable security insights with advanced threat detection and interactive visualizations Overview ADTrapper is a...

onionshare

OnionShare OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Installing OnionShare You can download OnionShare for Windows and macOS from the OnionShare website. For macOS you can also use Homebrew: br...

POC-2020-8559

POC-2020-8559 Exploit for CVE-2020-8559. We steal all the connections to the kubelet using iptables then rewrite the 101 or 302 responses to 307. The 101s are for modern Kubernetes versions, the 302s are for older ones. We don't have access to the kube-apiserver's x509 cert, so kubelet webhook au...

CVE-2026-116304

Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and lat...

CVE-2026-120142

A flaw was found in PostgreSQL. An authenticated database user with object creation privileges can exploit this vulnerability to execute arbitrary code on the host as the operating system user running the database service. By defining row types with dropped attributes in identical positions but...

audit_couchdb

Audit CouchDB: The simple, clear, CouchDB security assessment Audit CouchDB is a simple tool with a powerful message. Given an Apache CouchDB URL, it will tell you everything you ever wanted to know about its security. Objective Audit CouchDB will perform the following actions: 1. Learn every...

POC-CVE-2023-32233

Use-After-Free in Netfilter nftables when processing batch requests Demo Vulnerability Details The affected code originates from the official Linux kernel from https://kernel.org/ and is part of the Netfilter nftables component net/netfilter/nftablesapi.c. Netfilter nftables allows to update its...

CVE-2025-47812-poc

CVE-2025-47812 Wing FTP Server Remote Code Execution RCE Exploit CVE-2025-47812 📌 Credit : Vulnerability discovered by Julien @MrTuxracer. This PoC implementation is based on their original research. This repository hosts a Python exploit for the Wing FTP Server Remote Code Execution RCE...

SafeText

SafeText Tool to sanitize text to allow for safe distribution of documents from anonymous sources by removing zero-width characters and homoglpyhs. Individuals attempting to leak an email or other text file face the risk of identification through fingerprinting. Fingerprinting often occurs when t...

msLDAPDump

msLDAPDump LDAP enumeration tool implemented in Python3 msLDAPDump simplifies LDAP enumeration in a domain environment by wrapping the ldap3 library from Python in an easy-to-use interface. Like most of my tools, this one works best on Windows. If using Unix, the tool will not resolve hostnames...

CVE-2026-67545

Versions of Heym prior to 0.0.73 are vulnerable to a Server-Side Request Forgery (SSRF) in the HTTP workflow node . The root cause is the lack of validation on user-supplied target hosts or IP addresses during outbound HTTP requests. If a workflow author preconfigures an HTTP node to target inter...

CVE-2026-67545 Heym: Server-Side Request Forgery (SSRF) in HTTP Workflow Node

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.73, the HTTP workflow node in Heym makes outbound HTTP requests to user-supplied URLs without validation of the target host or IP address. If a workflow author has already...

EUVD-2026-124046

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.73, the HTTP workflow node in Heym makes outbound HTTP requests to user-supplied URLs without validation of the target host or IP address. If a workflow author has already...