VCG

==================================================================================== VCG VisualCodeGrepper Current version: 2.3.2 ==================================================================================== Contents: 1. Overview 2. Latest additions to VCG V2.3.2 3. Using VCG Input...

abdal-cve-2026-63030

English | فارسی 🛡️ Abdal CVE-2026-63030 PoC Exploits Abdal CVE-2026-63030 is a defensive WordPress exposure verifier for the REST API batch route confusion tracked as CVE-2026-63030. The issue can be chained with CVE-2026-60137 on affected WordPress releases and may lead to remote code execution...

abdal-cve-2026-60137

English | فارسی 🛡️ Abdal CVE-2026-60137 PoC Exploits Abdal CVE-2026-60137 is a defensive WordPress exposure verifier for the insufficient sanitization of the authornotin parameter in WPQuery, tracked as CVE-2026-60137. The vulnerability can allow SQL injection when untrusted input reaches the...

Apache-Tomcat-CVE-2025-24813-Lab

CVE-2025-24813: Apache Tomcat Detection & Mitigation Lab A defensive cybersecurity portfolio project demonstrating vulnerability research, detection engineering, log correlation, layered mitigation, and technical documentation in an isolated two-VM environment. Project summary This repository...

cve-2025-9951-ffmpeg-jp2-poc

CVE-2025-9951 FFmpeg JPEG 2000 Exploitation Research This repository contains two deliberately separated exploitation milestones for the FFmpeg JPEG 2000 component-mapping vulnerability: 1. 01-gdb-assisted/ — the original deterministic GDB-launched PoC and its full research-journey writeup,...

CVE-2025-55182

CVE-2025-55182 Proof of concept exploit for CVE-2025-55182. When successful, it will emulate a shell on the remote target over HTTP-POST requests. Works with both HTTP and HTTPS, but skips any certificate checks. Only supports directory changes with absolute paths. How to use 1. Set up the...

Ghost-CMS-Code-Injection-Audit-CVE-2026-26980

Ghost CMS Code Injection Cleaner Removes injected code from every post and page on a Ghost CMS website via the Admin API. Use this to clean up a compromised Ghost site — for example, one affected by the code injection vulnerability CVE-2026-26980 — by stripping attacker-supplied tags and other...

gstack

gstack "I don't think I've typed like a line of code probably since December, basically, which is an extremely large change." — Andrej Karpathy, No Priors podcast, March 2026 When I heard Karpathy say this, I wanted to find out how. How does one person ship like a team of twenty? Peter Steinberge...

omapi-cve-2015-6606-exploit

Simple Exploit for Verification of CVE-2015-6606 This is a simple exploit to verify a code injection vulnerability that exists in the SEEK smartcard service versions 3.1.0 and below CVE-2015-6606, Google internal bug ANDROID-22301786. The vulnerability allows specially crafted Android application...

MySQL-Remote-Root-Code-Execution

MySQL-Remote-Root-Code-Execution Usage root@kitploit: python rcemysql.py -dbuser -dbpass -dbname -dbhost -mycnf...

CVE-2026-81766

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

CVE-2026-19722

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

bitbucket-iac-scan

Bitbucket Security: Infrastructure as Code Security Scanner Scans your Infrastructure as Code configuration files to ensure good security practises. Creates a security Code Insights report if issue is found. This Bitbucket Cloud supported Pipe leverages the industry leading KICS scanning tool to...

CVE-2024-2887-REPORT

SSD Advisory – Google Chrome RCE Source: ssd-disclosure.com/ssd-advisory-google-chrome-rce Summary A critical remote code execution vulnerability in Google Chrome versions 123 and earlier affecting WebAssembly WASM garbage-collection type handling. The bug allows type confusion that can be...

CVE-2026-47103-python-statemachine-rce

CVE-2026-47103: Ejecución remota de código en Python StateMachine mediante inyección de eval en SCXML Gravedad: Crítica, CVSS 4.0 9.3 , CVSS 3.1 9.8 asignado por VulnCheck, el CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1:...

CVE-2024-4577-PHP-RCE

PHP RCE PoC CVE-2024-4577: Argument Injection in PHP-CGI Overview This repository contains scripts to check for the CVE-2024-4577 vulnerability, an argument injection issue in PHP-CGI. You can use the provided Bash, Go, and Python scripts to test a list of domains for this vulnerability. I've als...

AutoIt-Obfuscator

AutoIt Obfuscator — Ofuscación para el código fuente de scripts AutoIt AutoIt Obfuscator es una herramienta para modificar el código fuente de scripts AutoIt de tal manera que el análisis del código ofuscado resulte muy difícil. Más detalles técnicos, descargas y documentación disponibles en:...

vscode-frida

Frida Workbench para VSCode Repositorio | Incidencias | Instalar Este es un proyecto contribuido por la comunidad, no afiliado al equipo oficial de Frida. Es desarrollado y mantenido por @CodeColorist como una extensión de código abierto para Visual Studio Code que mejora la experiencia de...

apache-cve-2021-42013-rce

apache-cve-2021-42013-rce Docker-based penetration testing lab simulating CVE-2021-42013 vulnerability Path Traversal & RCE on Apache HTTP Server 2.4.49. This project is prepared to simulate and exploit the CVE-2021-42013 vulnerability found in Apache HTTP Server 2.4.49 in an isolated environment...

CVE-2026-81766 Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...