CVE-2024-41651

Blind SSRF to RCE Exploit - PrestaShop 8.1.7 This document outlines a Blind SSRF to RCE exploit on a fresh PrestaShop 8.1.7 docker installation. Prerequisites Ensure you have at least an outdated module installed, for example: psfacetedsearch Download the original package: Download psfacetedsearc...

XSStrike

XSStrike Advanced XSS Detection Suite XSStrike Wiki • Usage • FAQ • For Developers • Compatibility • Gallery XSStrike is a Cross Site Scripting detection suite equipped with four hand written parsers, an intelligent payload generator, a powerful fuzzing engine and an incredibly fast crawler...

CVE-2026-35031

CVE-2026-35031: Jellyfin Subtitle Upload Path Traversal to RCE -darkred?style=flat-square -orange?style=flat-square TL;DR A critical path traversal vulnerability in Jellyfin Media Server allows authenticated users with "Upload Subtitles" permission to upload files to arbitrary locations on disk. ...

CVE-2026-41940

CVE-2026-41940 - cPanel/WHM Auth Bypass Scanner & Exploit Tool cPanel/WHM Authentication Bypass Scanner & Exploit Tool for CVE-2026-41940 ⚠️ Disclaimer This tool is provided for educational purposes and authorized security testing only. By using this tool, you agree that: You will only test system...

ad-ldap-enum

ad-ldap-enum ad-ldap-enum is a Python script developed to collect users/computers and their group membership from Active Directory. In large Active Directory environments, tools such as NBTEnum were not quick enough. By executing LDAP queries against a domain controller, ad-ldap-enum is able to...

CVE-2025-15276-poc

CVE-2025-15276: FontForge SFD PickledData Insecure Deserialization RCE Disclaimer This Proof of Concept PoC is for educational purposes and security auditing only. The author is not responsible for any misuse of this information. Unauthorized access to computer systems is illegal. Always obtain...

CVE-2026-19652 Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter

The Divi Membership plugin for WordPress (versions up to and including 2.2.0 ) is vulnerable to unauthenticated privilege escalation via the form_id parameter. The root cause lies in the dmem_form_submit_handler() function, which determines a new user's role by iterating through all WordPress rol...

CVE-2026-19652 Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter

The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the dmemformsubmithandler function determining the new user's role by iterating all WordPress roles and calling passwordverify against an attacker-controlled bcry...

EUVD-2026-91635

The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the dmemformsubmithandler function determining the new user's role by iterating all WordPress roles and calling passwordverify against an attacker-controlled bcry...

CVE-2026-93875 JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-93875 JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

EUVD-2026-91634

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256

CVE-2026-9256 NGINX ngxhttprewritemodule PoC Derivation Process and Thoughts Scope: Only for local ranges, authorized reproduction environments, vulnerability verification, and protection rule analysis. Do not use against unauthorized targets. The PoC ideas in this document only verify remotely...

parsedmarc

parsedmarc parsedmarc is a Python module and CLI utility for parsing DMARC reports. When used with Elasticsearch and Kibana or Splunk, or with OpenSearch and Grafana, it works as a self-hosted open-source alternative to commercial DMARC report processing services such as Agari Brand Protection,...

Argus

Argus Security Intelligence Framework Argus is a multi-p...

Azure

Azure Offensive Security Toolkit A collection of Bash and PowerShell scripts for Azure security assessments, covering IAM privilege escalation, container security, Key Vault exposure, Entra ID configuration, and more. Designed to run in Azure Cloud Shell or any authenticated terminal. Scripts IAM...

CVE-2025-47812-Wing-FTP-Server-7.4.3-Unauthenticated-RCE-PoC

CVE-2025-47812 — Wing FTP Server Unauthenticated remote code execution vulnerability in Wing FTP Server whoami root References CVE-2025-47812 W...

CVE-2025-2304-Camaleon-CMS-Mass-Assignment-Privilege-Escalation-PoC

CVE-2025-2304 — Camaleon CMS Mass Assignment Privilege Escalation PoC Privilege escalation vulnerability in Camaleon CMS /updatedajax with passwordrole=admin injected into the password parameters. 4. Verifies the role has been updated to admin. Requirements Python 3 Install dependencies: python3 ...

kernagent

| | | | | |/ / \ '| ' \ / |/ |/ \ ' | | | / | | | | | | | | | / | | | | ||\|| || ||,|, ||| ||| |/ 🔍 kernagent Turn binaries into conversations — deterministic, auditable, offline-capable. kernagent converts a binary into a portable static snapshot and lets an LLM or your scripts answer...

HoneyWire

HoneyWire 📋 Table of Contents Overview Showcase The Universal Event Standard Features Architecture Quick Start Guide Security Notes Tech Stack Roadmap & Development Versioning and API Reference Overview HoneyWire is a lightweight, Distributed High-Signal Security Early-Warning System Builder,...