xpc-string-leak

xpc-string-leak xpc-string-leak is a proof-of-concept exploit for an out-of-bounds memory read in libxpc. This exploit uses the vulnerability to read out-of-bounds heap memory from diagnosticd, an unsandboxed root process with the taskforpid-allow entitlement. The vulnerability: CVE-2018-4248 On...

Popcorn-TJNULL-OSCP-

HackTheBox: Write-up de Popcorn Fecha: 05 de junio de 2026 Dificultad: Fácil Plataforma: HackTheBox Técnicas Clave: Enumeración de Puertos y Servicios, Fuzzing de Directorios Gobuster, Evasión de Subida de Archivos, Manipulación de Solicitudes HTTP Burp Suite, Ejecución Remota de Código RCE,...

INPGer

INPGer | CVE-2022-4063 - Galería InPost Herramienta automática masiva para verificar la vulnerabilidad CVE-2022-4063 - InPost Gallery install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh...

dirtcow

dirtcow Dirty Cow Linux Local Privilege Escalation Vulnerability Reproduction CVE-2016-5195 0、 Use the command uname -a to check the Linux kernel information 1、 Download the EXP to local/server 2、 Use the command gcc -pthread dirty.c -o dirty -lcrypt to compile dirty.c, generating an executable...

WindowsPatchDetector

Experimental Windows .text section Patch Detector ====================== Experimental: Windows .text section compare - disk versus memory Original Idea After reading about the Skeleton Key malware http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/ develop ...

ip-finder-cli

IPFinder CLI Command Line Interface https://ipfinder.io/ Supports Single IP Address, asn, ranges, firewall as Input Supports Bulk Exports Results to Screen or to An Output File Supports IPv4 and IPv6 Supports ASN number , RANGES , Firewall Getting Started sign up for a free account at...

CVE-2021-22986-Poc

CVE-2021-22986-Poc This is a Poc for BIGIP iControl unauth RCE POC : curl -ksu admin:redacted https://192.168.123.134/mgmt/tm/access/bundle-install-tasks -d '"filePath":"id"' | jq . curl -ksu : https://192.168.123.134/mgmt/shared/authn/login -d...

CVE-2026-95843

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/shareName/topicFilter structure. A remote client can send a filter such as $share/grp withou...

CVE-2026-95842

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions,...

CVE-2026-93349

Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters ...

ADReaper

ADReaper ADReaper es una herramienta escrita en Golang que enumera un entorno de Active Directory con consultas LDAP en pocos segundos Instalación Puedes descargar binarios ejecutables precompilados para Windows/Linux desde últimos lanzamientos Instalar desde código fuente Para compilar desde el...

gogsownz

GogsOwnz GogsOwnz es un script sencillo para obtener derechos de administrador y RCE en un servidor Gogs/Gitea. Explota vulnerabilidades en Gogs/Gitea, incluyendo CVE-2018-18925 , CVE-2018-20303. Aviso legal Este script se ofrece tal cual. Sin garantía, úselo bajo su propia responsabilidad, por...

cve-2020-1472

cve-2020-1472 @toc Vulnerability Principle The principle is relatively complex. If interested, you can check the article at the following link: https://www.freebuf.com/articles/system/249860.html Exploitation 1. Modify the file impacket.dcerpc.v5.nrpc Need to use the...

shepard

SHEPARD BITS This is a persistance tool using Windows Background Intelligent Transfer Service BITS. Functionality File Download, File Exfiltration, File Download + Persistent Execution Usage Run shepard.exe as Administrator with the following command line arguments: -d : regular file download to ...

JavaDeserialization

Java Deserialization Vulnerability Scanner A Java deserialization vulnerability scanner for vulnerabilities similar to CVE-2017-10271. This project currently contains only one PoC; others have not been organized yet. Installation 1. Install nmap ​ https://nmap.org/download.html Download the...

postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN

A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...

Important: Red Hat Security Advisory: postgresql:16 security update

An update for the postgresql:16 module is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

CVE-2024-45337

Proof of Concept exploit for CVE-2024-45337 This repository contains a proof of concept exploit for CVE-2024-45337. It can be used to wrap ssh when interacting with an SSH server which is implemented using golang.org/x/crypto = v0.30.0. while caching permissions in the...

redis-cve-2026-23479-check

redis-cve-2026-23479-check A safe, read-only version checker for CVE-2026-23479 — the use-after-free in Redis's blocking-client code that lets an authenticated user reach remote code execution on the host. It does not exploit the bug. It connects, optionally authenticates, runs a single read-only...