CVE-2026-49176_LPE_POC

CVE-2026-49176 SYSTEM Shell PoC Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026. Technical write-up: CVE-2026-49176 Exploit Development: WalletService to SYSTEM. A standard user creates a Wallet ESE database containing a persisted callbac...

letsdefend-cve2024-3400-case-study

letsdefend-cve2024-3400-case-study Detection, analysis, and response strategies for CVE-2024-3400 exploitation attempts targeting Palo Alto PAN-OS GlobalProtect portals. Includes IOCs, exploit patterns, and mitigation guidance. CVE-2024-3400 Incident Investigation 🔍 Overview This repository...

CVE-2023-38146

PoC for the ThemeBleed CVE-2023-38146 exploit Windows 11 Themes Heavily inspired by https://github.com/gabe-k/themebleed which only runs on windows the reason why i decided to write this. Used modified code from the impacket smbserver.py...

EUVD-2026-84008

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever ISGAE is false, which affects self-hosted Docker and WAR deployments. A...

CVE-2026-84298 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied taskexternalid values in the durableInvocations routing map before tenant ownership is verified, and callback delivery...

CVE-2026-84298 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied taskexternalid values in the durableInvocations routing map before tenant ownership is verified, and callback delivery...

CVE-2025-24813

CVE-2025-24813 Simple reproduction and analysis of CVE-2025-24813, with a simple exploit script root@kitploit: usage: CVE-2025-24813.py -h -u URL -d DATA CVE-2025-24813 optional arguments: -h, --help show this help message and exit -u URL, --url URL URL -d DATA, --data DATA base64serialdata Examp...

CallStranger

CallStranger This script created by Yunus Çadırcı https://twitter.com/yunuscadirci to check against CallStranger CVE-2020-12695 vulnerability. An attacker can use this vulnerability for: Bypassing DLP for exfiltrating data Using millions of Internet-facing UPnP device as source of amplified...

CVE-2026-87858

Temporal Server is vulnerable in its Workflow completion callback delivery logic (both HSM and CHASM implementations). A caller with only write permission in a single namespace can attach a callback with a non-empty source header, causing the History service to re-target the request to the intern...

CVE-2026-87858 Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...

Solar-exploiting-log-4j

🔥 Solar Exploiting Log4j - TryHackMe Walkthrough 📌 Room: Solar Exploiting Log4j Platform: TryHackMe Difficulty: Medium Topic: Log4Shell Log4j Vulnerability 🧠 Objective Exploit the Log4j vulnerability CVE-2021-44228 to gain remote code execution and capture flags. 🛠️ Tools Used Nmap Burp Suite cURL...

jugular

jugular Use jugs to look for CUPS: an ultrafast UDP sender, that tries to tickle listening cups-browsed processes to do a HTTP callback. This is a high performance scanner that writes UDP packets directly to the network. Install Ubuntu or similar root@kitploit: sudo apt install golang...

py-log4shellscanner

PY-Log4ShellScanner A simple, one-file DNSLog server with HTTP endpoint for log retrieval Credit Based on the Log4jScanner by fullhunt.io, modified with multithreading and custom DNS Callback server Features Support for lists of URLs Fuzzing for more than 60 HTTP request headers, with ability to...

SharpWnfSuite

SharpWnfSuite This is the repository for Windows Notification Facility WNF tools. Currently, a C port of the tools in wnfun developed by Alex Ionescu @aionescu and Gabrielle Viala @pwissenlit has been uploaded. When I develop additional tools for Windows Notification Facility, they will be upload...

CVE-2025-3605

🚀 CVE-2025-3605 Exploit Guide 🛡️ Vulnerability Summary The Frontend Login and Registration Blocks plugin for WordPress versions = 1.0.7 is vulnerable to privilege escalation via account takeover. The issue arises because the plugin does not validate user identity when updating sensitive details...

CVE-2024-21762

Usages: python3 exploit.py --target 192.168.1.1:443 --callback-ip YOURIP --callback-port 8080...

CVE-2007-2447

CVE-2007-2447 Saikat Karmakar | Oct 14 : 2022 Usage: root@kitploit: python3 exploit-smb-3.0.20.py -lh -lp -t requirements root@kitploit: pysmb argparse P.S. I'm not the author of this cve. I barely had a computer when this cve was created. I tried to create am automated script to exploit...

CVE-2017-11882-Blocker

CVE-2017-11882-Blocker A Windows driver that neutralizes CVE-2017-11882 : How it works This project is split into a kernel driver and a user-mode notification component that talk over a custom device using the inverted call model. Kernel driver 1. Process callback - DriverEntry registers a...

CVE-2022-47447

CVE-2022-47447 POC CSRF - CVE-2022-47447 ⚠️ For educational purposes and authorized environments only. Functional PoC for vulnerability CVE-2022-47447, which affects a vulnerable WordPress plugin, allowing a Cross-Site Request Forgery CSRF attack against authenticated users. VULNERABLE URL:...

EUVD-2026-83679

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code...