htb-sau-exploit-chain

HTB Sau Exploit Chain — CVE-2023-27163 SSRF + Maltrail RCE Automation A Python exploit script that chains CVE-2023-27163 Server-Side Request Forgery in Request Baskets ≤ 1.2.1 with an unauthenticated Remote Code Execution vulnerability in Maltrail 0.53, delivering a reverse shell. Designed for th...

CVE-2020-26217-XStream

CVE-2020-26217 XStream RCE Exploit XStream Remote Code Execution Vulnerability Exploit Tool. Vulnerability Description CVE-2020-26217 is a deserialization vulnerability in the XStream library that allows an attacker to trigger remote code execution by crafting malicious XML data. Affected version...

ciphertest

cipherTest.sh by Patrick Bogen cipherTest.sh is a "better" SSL cipher checker in that it uses gnutls, which has support for many more configurations than openssl. It tests potentially 3,200 different configurations but does some pre-optimization so that it minimizes "failed" checks. It relies on...

Hipcam-RTSP-Format-Validation-Vulnerability

Hipcam RealServer/V1.0 RTSP Format Validation Vulnerability Proof-of-Concept | CVE-2023-50685 Proof-of-Concept for RTSP Service Format Validation Vulnerability in Hipcam RealServer/V1.0. Description This POC exploits a format validation vulnerability in the Real Time Streaming Protocol RTSP servi...

pd-agent

ProjectDiscovery Cloud Platform — Agent What it does • Quick Start • Install • Configuration • Scaling What it does pd-agent lets you scan your own internal networks from the ProjectDiscovery Cloud Platform. Install the agent on a machine inside the network you want to scan — a VM, a server, a...

CVE-2020-6308

CVE-2020-6308 Exploit script for SAP Business Objects SSRF This is a simple Golang script to automate the exploitation of CVE-2020-6308. The original Github repo did not show any automation https://github.com/InitRoot/CVE-2020-6308-PoC , thanks @InitRoot, so this was made in an effort to help...

zte-smartlife-app-pwned

Proof of Concept PoC Suites This directory contains the minimal, standalone PoC tooling used to validate the ZTE SmartLife backend vulnerabilities CVE-2026-86552, CVE-2026-86553, CVE-2026-86554, CVE-2026-86555. All endpoints have been patched and key material rotated by ZTE. The scripts and keys...

CVE-2026-5524-PoC

CVE-2026-5524 — Divi Form Builder Unauthenticated RCE Mass exploit toolkit for CVE-2026-5524 , an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Divi Form Builder = 5.1.8 leading to remote code execution. Field| Value ---|--- CVE| 2026-5524 CVSS| 9.8 Critical Vector|...

Exploit for CVE-2026-104736

CVE-2026-104736 — LearnPress PHP object injection !PoCbit...

RtlHijack

RtlHijack A repository with scripts to demonstrate alternative Read and Write primitives using Rtl functions the unintended way. RtlFillMemory.c RtlFillMemory takes three arguments: a pointer to the destination memory, the number of bytes to write, and a single byte value. Writes only a byte into...

ephemera

Ephemera : Zero-Trust SSH Certificate Authority Ephemera is a lightweight, self-hosted SSH Certificate Authority designed to enforce Zero-Trust access for infrastructure. It replaces static SSH keys with short-lived certificates, integrates hardware-backed WebAuthn MFA, and maintains...

punchline

punchline End-to-end encrypted peer-to-peer chat over UDP. No accounts, no central server relaying/storing messages, no middleman. Just two peers, a direct connection, and Noise protocol encryption. https://github.com/user-attachments/assets/939e96d3-45e3-4484-9a27-28c3a0457b05 Table of Contents...

gsscred-move-uaf

GSSCred-move-uaf The com.apple.GSSCred XPC service, which runs as root on macOS and iOS, does not properly implement the "move" command, leading to a use-after-free condition in the doMove function. The GSSCred service can be reached from within the default application sandbox on iOS. This progra...

CVE-2022-45436

CVE-2022-45436 Reflected Cross Site Scripting leading to session hijacking in pandorafms Exploit Title: Reflected Cross Site Scripting Date: 15/02/2023 Exploit Author: Damodar Naik Vendor Homepage: https://pandorafms.com/en/ Software Link: https://github.com/pandorafms/pandorafms Version: Tested...

abap-code-scanner

OWASP ABAP Code Scanner Static Application Security Testing SAST for SAP ABAP. A free, open-source CLI for finding security vulnerabilities in custom ABAP code - offline and in CI. Editions Edition| What it is| Where ---|---|--- Open-source CLI free, MIT| Scan exported ABAP source locally or in C...

desktop-2fa

🛡️ Desktop-2FA A secure, offline two-factor authentication 2FA manager for desktop environments. Built with Python, featuring strong encryption and no cloud dependencies. 🌐 Landing Page : desktop-2fa.org ✨ Features Feature| Description ---|--- 🔐 Vault Security| AES-256-GCM encryption with Argon2id...

Mass-Assigner

Mass Assigner Mass Assigner is a powerful tool designed to identify and exploit mass assignment vulnerabilities in web applications. It achieves this by first retrieving data from a specified request, such as fetching user profile data. Then, it systematically attempts to apply each parameter...

DroidDetective

🕵️ A machine learning malware analysis framework for Android apps. ☢️ DroidDetective is a Python tool for analysing Android applications APKs for potential malware related behaviour and configurations. When provided with a path to an application APK file Droid Detective will make a prediction using...

CVE-2022-26159-Ametys-Autocompletion-XML

CVE-2022-26159-Ametys-Autocompletion-XML A python exploit to automatically dump all the data stored by the auto-completion plugin of Ametys CMS to a local sqlite database file. Features Automatic detection of maximum results returned by the autocompletion plugin. Depth first search to dump all th...

CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC

CVE-2025-24893 - XWiki Unauthenticated RCE Exploit POC ⚠️ Unauthenticated Remote Code Execution in XWiki 🛠️ PoC implementation by @dollarboysushil 💡 Overview CVE-2025-24893 is a critical RCE vulnerability in XWiki, caused by unsafe Groovy expression handling inside the SolrSearch macro. An attacker...