crtsh

crtsh API client for crt.sh crtsh allows to get the information about a HTTPS website. e.g. Search subdoimains. This tool uses Certificate Transparency logs. For more information, check https://crt.sh/ Example Subdomains Search subdomains of example.com Organization In --query, % can be used as...

git-scan

git-scan This tool is designed to scan and identify whether a website has an exposed ".git" directory, which may contain sensitive information such as source code or Git configuration files. Features Massively scans URLs to find out if the ".git/HEAD" directory is available on the website. Uses...

binfinder

binfinder Find binary files not installed through package manager Prerequisites Software go version = 1.12 docker version = 19 How to build and run binfinder Build $ make build Once the build is complete, you can run bindfinder by running: $ ./binfinder --images --output data --top 20 The output...

pickle_exploit

PickleExploit Demonstrating Remote Code Execution Vulnerability via Pickle Serialization in ClearML 🖥️ This script was developed by h3x0v3rl0rd. This proof of concept PoC demonstrates a potential security vulnerability involving the serialization and deserialization of Python objects using the...

Webmin1.910_exploit

Webmin 1.910 Remote Code Execution Exploit Description: This repository contains a Python 3 script designed to exploit a remote code execution vulnerability in Webmin version 1.910. The script utilizes the sessionlogin.cgi endpoint to perform authentication and deploy a reverse shell payload,...

windows_kernel_shadow_stack

Proof of Concepts This project aims to highlight certain aspects of the shadow stack mitigation implemented by Microsoft in Windows 11. The code is specifically focused on Windows 11 24H2. It may not work on other version of Windows 11, due to the kernel offset management. The project is divided...

smb-usermap

Samba "username map script" Command Execution This module exploits a command execution vulnerability in Samba versions 3.0.20 through 3.0.25rc3 when using the non-default "username map script" configuration option. By specifying a username containing shell meta characters, attackers can execute...

mojarragadget

mojarragadget description We found a new Java gadget chain in the Mojarra Library, this repo contains 2 POC to reproduce the exploit on version 2.3 and 3.0. More information here: https://www.synacktiv.com/publications/finding-gadgets-like-its-2015-part-1.html...

CVE-2026-65008

CVE-2026-65008 — Grav CMS 2.0.7 Authenticated RCE Proof-of-concept for CVE-2026-65008 : authenticated remote code execution in Grav CMS via unrestricted calluserfuncarray in Blueprint::dynamicData. A user with admin.pages or api.pages.write can plant a malicious form frontmatter. The payload then...

IPSpinner

🔁 IPSpinner IPSpinner is a local proxy which can be used to redirect all incoming requests through different chosen providers. The purpose is to create a pass-through proxy that rotates the source IP address of each request. As an example, running a bruteforce operation through IPSpinner will hel...

lumina_server

About POC of an offline server for IDA Lumina feature. More details on https://www.synacktiv.com/publications/investigating-ida-lumina-feature.html Instalation Python package installation Download project and run python lumina/setup.py or pip install .. Server can also be used as a standalone...

CVE-2026-22849

CVE-2026-22849: Saleor lacks proper HTML sanitization in rich text fields Overview Field| Details ---|--- CVE ID| CVE-2026-22849 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products saleor/saleor Details Saleor was allowing users to modify rich text fields with HTM...

CVE-2026-58390 OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...

CVE-2026-58390

Prior to version 26.1.11 , OPNsense is vulnerable to a Stored XSS leading to root RCE . The flaw exists in the OpenVPN connection-status dashboard widget (specifically src/opnsense/www/js/widgets/OpenVPNClients.js) and the connection-status view , where the common_name of an OpenVPN client is ins...

CVE-2026-58390 OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...

CVE-2026-58390

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...

EUVD-2026-102136

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...

CVE-2026-4861

cve-id Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example...

cPanel-WHM-CVE-2026-41940-auth-bypass-exploit

CVE-2026-41940 - cPanel & WHM Authentication Bypass Exploit Critical Authentication Bypass via CRLF Injection in cPanel/WHM cpsrvd Daemon 📋 Overview CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel & WHM that allows unauthenticated remote attackers to gain root-level...

CVE-2025-48148

CVE-2025-48148 StoreKeeper for WooCommerce = 14.4.4 - Unauthenticated Arbitrary File Upload 🚀 StoreKeeper for WooCommerce = 14.4.4 - Unauthenticated Arbitrary File Upload Exploit 📝 Description The StoreKeeper for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to...