CVE-2024-34327

CVE-2024-34327 SQL Injection Vulnerability Checker This script V-24-02-001SQLiCheck.py is a proof-of-concept PoC tool to verify the presence of a time-based blind SQL injection vulnerability affecting the password-reset-token.php endpoint, identified as CVE-2024-34327. ⚠️ Disclaimer This tool is...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

CVE-2025-7840

XSS Exploit for CVE-2025-7840 Author : Byte Reaper @ByteReaper0 Description Proof‑of‑concept exploit for CVE-2025-7840 , targeting a vulnerable web application endpoint that fails to sanitize user input on the Firstname parameter of a reservation form. By crafting a GET request to:...

codeql-workshop

Finding vulnerabilities with CodeQL Original workshop by Sylwia Budzynska Prerequisites • Resources • Workshop Who is this for : Security Engineers, Security Researchers, Developers. What you'll learn : Learn how to use CodeQL for code exploration and for finding security issues. What you'll buil...

CVE_2019_2215

CVE-2019-2215 - Android Binder UAF Local Privilege Escalation A rewritten Proof-of-Concept / Local Privilege Escalation LPE exploit targeting CVE-2019-2215 , a Use-After-Free vulnerability in the Android Binder driver. I have provided the vulnerable kernel build in the vulnerablekernelbuilds...

MAL-2026-18054 Malicious code in @decoopus/claude-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1329498b9f2a24897a73f2e5d2d0ffb8ea848d5f6699a703fa88dcbe8b578852 The CLI prompts the user for an Anthropic API key sk-ant-... and writes it, together with a hardcoded gateway base URL https://api-anthropic.help, in...

Malicious code in @decoopus/claude-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1329498b9f2a24897a73f2e5d2d0ffb8ea848d5f6699a703fa88dcbe8b578852 The CLI prompts the user for an Anthropic API key sk-ant-... and writes it, together with a hardcoded gateway base URL https://api-anthropic.help, in...

CVE-2025-8550

CVE-2025-8550 – atjiu pybbs XSS Exploit Description This repository hosts an automated Proof-of-Concept PoC exploit for CVE-2025-8550 , a reflected Cross‑Site Scripting XSS vulnerability in atjiu pybbs ≤ v6.0.0. It targets the /admin/topic/list endpoint’s username parameter, which lacks proper...

CVE-2024-13479

CVE-2024-13479 LTL Freight Quotes – SEFL Edition = 3.2.4 - Unauthenticated SQL Injection Description The LTL Freight Quotes – SEFL Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropshipeditid' and 'editid' parameters in all versions up to, and including, 3.2.4 due to...

CVE-2024-5522-PoC

CVE-2024-5522-PoC : HTML5 Video Player 2.5.27 - Unauthenticated SQLi The plugin does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks setup script: 1. git clone...

CVE-2026-112391

A flaw was found in Pillow. The PDF parser fails to limit recursion depth when reading nested PDF data structures such as arrays and dictionaries. A remote attacker could exploit this vulnerability by supplying a specially crafted, deeply nested PDF file to an application processing PDFs in appen...

MilkSad-Mnemonic-Generator

Milk Sad Mnemonic Generator This tool is designed to generate BIP-39 mnemonic phrases 24-word seed phrases based on Unix timestamps, specifically exploring phrases that could be generated through the "Milk Sad" vulnerability CVE2023-39910. What This Tool Does The Milk Sad Mnemonic Generator creat...

CVE-2024-25503

CVE-2024-25503 Vulnerability type : Cross Site Scripting XSS Product: Advanced REST Client desktop application Vulnerable Version: 17.0.9 Vendor of the products:https://www.advancedrestclient.com/ 1. Description Cross-Site Scripting XSS vulnerability in Advanced REST Client v.17.0.9 allows a...

Scanner_CVE_2026-42945

Scanner for detecting Nginx instances vulnerable to CVE-2026-42945 NGINX RIFT. Accepts individual IPs, CIDR ranges, and ASNs as input. About CVE-2026-42945 affects all Nginx versions prior to 1.30.1. The tool probes HTTP and HTTPS on default ports, reads the Server header from the response, and...

CVE-2024-44947

CVE-2024-44947 Description : In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before setting uptodate fusenotifystore, unlike fusedoreadpage, does not enable page zeroing because it can be used to change partial page contents. So...

hp-slate7-root-kit

Root for the HP Slate 7 2800 on Android 4.1.1 English | Русский This repository contains a complete, self-contained kit for obtaining persistent root access on the HP Slate 7 2800 running firmware 1.05.18 and kernel Linux 3.0.8+ by exploiting the local vulnerability CVE-2015-1805. The kit was run...

CVE-2023-45657

CVE-2023-45657 Nexter = 2.0.3 - Authenticated Subscriber+ SQL Injection via 'to' and 'from' Description: The Nexter theme for WordPress is vulnerable to SQL Injection via the 'to' and 'from' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied...

GO-2026-6765 GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli

GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli...

GO-2026-6767 GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli...

GO-2026-6726 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...