cvelistV5

Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...

CVE-2018-7600

CVE-2018-7600 - Drupal 7 Remote Code Execution A Rust implementation of the CVE-2018-7600 exploit targeting vulnerable Drupal 7 installations = 7.57. This CLI reproduces this following PoC flow: it poisons a cached renderable form via the user/password path, extracts a formbuildid, then triggers...

CVE-2020-0674

CVE-2020-0674 CVE-2020-0674 is a use-after-free vulnerability in the legacy jscript engine. It can be triggered in Internet Explorer. The exploit here is written by maxpl0it but the vulnerability itself was discovered by Qihoo 360 being used in the wild. This exploit simply pops calc. Exploit...

Nextjs_RCE_Exploit_Tool

Next.js RCE Exploit Tool CVE-2025-55182 !CAUTION 免责声明 / Disclaimer 本工具仅供安全研究与教学 使用。用户在使用本工具进行测试时，必须确保已获得目标系统的合法授权 。 严禁用于非授权的渗透测试、恶意攻击或任何非法用途。用户感知和利用漏洞所产生的一切风险与法律后果由用户自行承担 ，与本项目开发者无关。 如果不接受此条款，请立即停止下载或使用本工具。 本工具基于公开文章开发，不提供编译好的二进制发布版本，请自行审计代码并编译。 🙏 致谢 / Credits...

CVE-2018-7600-Remote-Code-Execution

Drupalgeddon2 Python Exploit CVE-2018-7600 This repository contains a Python-based proof-of-concept exploit for the critical remote code execution vulnerability in Drupal, known as Drupalgeddon2 CVE-2018-7600. This script is designed for educational purposes and for security professionals to use ...

CVE-2022-24999

CVE-2022-24999 This repository contain exploits samples of the vulnerability we found in the JS library "qs" in december 2021. This vulnerability was fixed in express v4.17.3 & qs v6.10.3 v6.9.7, v6.8.3, v6.7.3, v6.6.1, v6.5.3, v6.4.1, v6.3.3, and v6.2.4. qs Array & String Bombs Vulnerable versio...

meltdown-exploit

MELTDOWN EXPLOIT POC Speculative optimizations execute code in a non-secure manner leaving data traces in microarchitecture such as cache. Lipp et. al 2018 published their code 2018-01-09 at https://github.com/IAIK/meltdown. Look at their paper for details: https://meltdownattack.com/meltdown.pdf...

CVE-2021-21315-PoC

CVE-2021-21315-systeminformation This is Proof of Concept for CVE-2021-21315 which affects The System Information Library for Node.JS npm package "systeminformation". npmjs.com/systeminformation "be sure to check or sanitize service parameters that are passed to si.inetLatency, si.inetChecksite,...

numpy-1.13.1

Travis CI Status --- NumPy is the fundamental package needed for scientific computing with Python. This package contains: a powerful N-dimensional array object sophisticated broadcasting functions tools for integrating C/C++ and Fortran code useful linear algebra, Fourier transform, and random...

CVE-2019-8601

Exploiting CVE-2019-8601 This is an exploit for a WebKit vulnerability that was originally discovered by Fluoroacetate during the pwn2own competition in Vancouver. While I did not discover this bug, I wrote this exploit to practice my exploit development skills. The original writeup for this...

codeql-sample-polkit

-- coding: utf-8 - - The polkit pkexec bug Overview This repository examines the polkit pkexec bug using CodeQL. It has instructions for building the databases the resultant databases a sequence of queries illustrating an approach to find this bug These are done: the polkit source / database buil...

CVE-2026-115722

RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes plyreadlistproperty call an out-of-bounds handler, crashing ASCII parsing or...

EUVD-2026-108710

RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes plyreadlistproperty call an out-of-bounds handler, crashing ASCII parsing or...

CVE-2014-1773

CClipStack::PushClipRect Invalid Array Indexing First, starting with the callstack from the crash with pageheap enabled: ChildEBP RetAddr 0919aac8 6b58459f MSHTML!CWorldTransform::IsAxisAligned 0919ab40 6ba228e9 MSHTML!CDispSurface::CClipStack::PushClipRect+0x1a2 0919aba4 6be25b58...

ByteCaster

ByteCaster Swiss Army Knife for payload encryption, obfuscation, and conversion to byte arrays – all in a single command! It supports 3 encryption algorithms, 4 encoding / obfuscation algorithms and 14 output formats. Installation Download the compiled binary or compile Go source code. Usage...

GitLab-CVE-2023-7028

GitLab CVE-2023-7028 — Mock 16.6.0 Host-only CVE-2023-7028 CVSS 10.0: POST /users/password accepted useremail array — server found user by email0 but sent the same reset token to every address → attacker with [email protected] hijacks [email protected]. Affected: GitLab CE/EE 16.5.6,...

follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects

A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redire...

follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects

A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redire...

CVE-2020-0674-Exploit

CVE-2020-0674 CVE-2020-0674 is a use-after-free vulnerability in the legacy jscript engine. It can be triggered in Internet Explorer. The exploit here is written by maxpl0it but the vulnerability itself was discovered by Qihoo 360 being used in the wild. This exploit simply pops calc. Exploit...

follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects

A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redire...