CVE-2022-0847-Docker

Dirty Pipe CVE-2022-0847: A Hands-On Exploit Demonstration in Docker This repository provides a self-contained, interactive Docker environment to safely demonstrate and analyze the "Dirty Pipe" privilege escalation vulnerability. It is designed as an educational tool for security professionals to...

CVE-2019-16784-POC

CVE-2019-16784 POC This is my POC for the Windows PyInstaller version 3.6 vulnerability that exists for the --onefile option. An attacker could achieve command execution and possible LPE by hijacking a DLL imported by the python interpreter DLL used by the pyinstaller binary. A short explanation ...

CVE-2019-18634

CVE-2019-18634 CVE-2019-18634 is a vulnerability that affects Sudo in versions 1.8.25 when pwfeedback is enabled in sudoers file. It allows an attacker to escalate privileges to root by exploiting a BSS-Based Buffer Overflow, where the data strucutres are altered and it thinks that it is being...

CVE-2019-1663-Binary-Analysis

Binary Analysis of CVE-2019-1663 Author: Corentin Wolff Origin of the Vulnerability Source of the Vulnerability The vulnerability originates from the function 0x0002BF64, which misuses the strcpy function, making it prone to buffer overflow attacks. For clarity, this function has been renamed to...

cve-2025-20333

CVE-2025-20333 - Complete Research & Exploitation Toolkit Overview This directory contains comprehensive research, analysis, and proof-of-concept code for CVE-2025-20333 , a critical stack buffer overflow vulnerability in Cisco ASA/FTD WebVPN servers. Status: ⚠️ Actively exploited in the wild...

CVE-2022-46169_poc

CVE-2022-46169 unauthenticated remote code execution Description Authentication Bypass: a hostname-based authorization check is not implemented safely for most installations of Cacti Command Injection: unsanitized user input is propagated to a string used to execute an external command Demo POC...

-Remcos-RAT-Fileless-svchost-Injection-Obfuscated-Payload-Analysis-

1. Remcos – svchost Injection via Native API Calls The following Binary Ninja snippet reveals the core injection mechanism used by Remcos to inject its payload into svchost.exe. What This Code Does: CreateProcessW with the CREATESUSPENDED flag starts a new svchost process in a suspended state...

CVE-2025-5548

Technical study of vulnerability CVE-2025-5548 Introduction This work analyzes the vulnerability CVE-2025-5548 , associated with a stack buffer overflow in FreeFloat FTP Server v1.0. The main objective of the lab is to understand how a vulnerable application behaves when faced with manipulated...

slurp-old

slurp Enumerates S3 buckets manually or via certstream Overview First of all, credit to https://github.com/eth0izzle/bucket-stream for the certstream idea. Also, credit to all the vendor packages that made this tool possible. Not responsible for how you use this tool. Modes Certstream Domain...

ghostlock-s25fe

GhostLock CVE-2026-43499 for the Galaxy S26 CVE-2026-43499 ported to the Samsung Galaxy S26 series — Android 16 / GKI 6.12. One binary, three kernel lines, dynamic parameter matching at runtime: theoretically covers the whole S26 series without per-build compilation. Most GhostLock porting effort...

poco-f6-unlock

POCO F6 / Redmi Turbo 3 — Bootloader Unlock A reproducible,...

CVE-2026-73673

CVE-2026-73673: Netis NC63 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication Original vulnerability research by Özcan Ersan @ozcanpng. This repository documents CVE-2026-73673, discovered and reported by the author. Non-destructive proof-of-concept and evidence...

luadec

Overview LuaDec is a Lua decompiler for lua 5.1 , and experimental for lua 5.2 and 5.3. It is based on Hisham Muhammad's luadec which targeted lua 5.0.x and LuaDec51 by Zsolt Sz. Sztupak. LuaDec is free software and uses the same license as the original LuaDec. Compiling git clone...

cve-2026-64560-a16

CVE-2026-64560 — Toolchain + Multi-Target Port CVE-2026-64560 is a use-after-free in the Linux kernel posix-cpu-timers local unprivileged race, CVSS 3.1 = 7.8; unfixed in 6.6.118, fixed only in 6.6.147. This repository does two things: it turns the upstream toolchain, which can only be driven by ...

CVE-2025-55182

CVE-2025-55182 React2Shell Exploit Kit 🎯 Complete Working Exploit Demonstration This project provides a fully functional demonstration of CVE-2025-55182 React2Shell - a critical Remote Code Execution vulnerability in React Server Components and Next.js. Status: ✅ WORKING - Achieves actual command...

wp2shell

wp2shell Pre-authentication remote code execution for WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Chains CVE-2026-63030 batch route confusion SQLi with CVE-2026-60137 customizer changeset re-entry to achieve unauthenticated administrator creation and OS command execution. No password cracking required...

CVE-2026-43499-pmg110-root

pmg110-root CVE-2026-43499 futex PI rtmutexwaiter use-after-free local privilege escalation, ported to the OPPO PMG110 / K15 Pro+ — MediaTek MT6991, ColorOS 16. One file pushed, run over LDPRELOAD: adb push out/preload-pmg110-16.0.9.400.so /data/local/tmp/preload.so adb shell chmod 644...

EulerOS 2.0 SP13 : openssl (EulerOS-SA-2026-4169)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1mbstringncopy can lead to a heap buffer...

EulerOS 2.0 SP13 : shim (EulerOS-SA-2026-4198)

According to the versions of the shim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1mbstringncopy can lead to a heap buffer...

EulerOS 2.0 SP11 : openssl (EulerOS-SA-2026-4354)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: When CMS password-based decryption RFC 3211 / PWRI key unwrap processes attacker-supplied CMS data, an attacker-chosen stream-mode...