Flowise-RCE-CVE-2025-59528

CVE-2025-59528 - Flowise AI Authenticated Remote Code Execution RCE Overview CVE ID: CVE-2025-59528 Affected Software: Flowise AI Vulnerable Versions: = 3.0.4 Fixed Version: 3.0.5 and later Severity: Critical Author: arensballiu Date: 2025 Description Flowise AI versions up to and including 3.0.4...

MemTracer

MemTracer MemTracer is a tool that offers live memory analysis capabilities, allowing digital forensic practitioners to discover and investigate stealthy attack traces hidden in memory. The MemTracer is implemented in Python language, aiming to detect reflectively loaded native .NET framework...

CVE-2025-55182-React2Shell-Async-Scanner

⚡ React2Shell CVE-2025-55182 / CVE-2025-66478 - Async RCE Scanner Prototype-pollution → Remote Code Execution via React Server Actions Async, version-first, output-based canary detection - no blind guessing !WARNING For authorised security research and penetration testing only. Scanning systems...

Awesome_shiro

Awesome-shiro CVE-2016-4437 Shiro Base64 decode -- AES decrypt -- Deserialize Environment Works on both linux/win10 Works on both python2/python3 Since the module directory contains ysoserial.jar, the project is a bit large. Please bear with us. Local Target Setup docker pull...

CVE-2026-77179

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

LACheck

LACheck Multithreaded C .NET Assembly Local Administrative Privilege Enumeration Arguments ./LACheck.exe help | | /\ / | | | | | | / \ | | | | | | | | / /\ \ | | | ' \ / / | |/ / | | / \ | || | | | / | |// \ || |||||\ Usage: LACheck.exe smb rpc /targets:hostname,fqdn.domain.tld,10.10.10.10...

cve-2022-21907

CVE-2022-21907 This package will detect exploits of CVE-2022-21907 https://corelight.com/blog/detecting-cve-2022-21907 Detection Method: HTTP HTTP data must be = 1750 bytes, and The HTTP/1.1 is not observed at the end of the exploit HTTP request. Usage: $ zeek -Cr your.pcap packages $ cat...

POC-CVE-2026-49975

-red CVE-2026-49975 HTTP/2 Bomb — HPACK Compression Bomb + Flow-Control Hold PoC Security Research PoC by naheeju ⚠️ This is a working, memory-exhaustion DoS tool — not a toy. It opens streams that force the target to allocate memory and holds them open via HTTP/2 flow-control tricks. As long as...

CVE-2026-82090-18-Years-All-Versions-CVSS-9.2-CRITICAL-The-Pocket-Forever-Day

XSS 0-Click / 0-Day Vulnerability Report Cross-Site Scripting 0-Click Leading to JavaScript Bridge Abuse in Pocket Android & iOS — CVSS 9.2 CRITICAL CVE-2026-82090 — Published by MITRE Corporation 2026-08-28 Author: Ing. Zampier Zago FUNFACTOR1 Division: Section 1 — Department of Cyber Security, ...

epagneul

epagneul Epagneul is a tool to visualize and investigate windows event logs. Deployment Requires docker and docker-compose to be installed. Installing make Offline deployment On a machine connected to internet, build an offline release: make release This will create a release folder containing...

exploit_cve-2023-26326_using_cve-2024-2961

Exploit BuddyForms CVE-2023-26326 using Iconv CVE-2024-2961 This work was done by me, Omar Elshopky, and Nour El Dien Bassiouny. This repository contains an exploit for the WordPress BuddyForms Plugin CVE-2023-26326, initially reported in the advisory by Joshua Martinelle. The exploit leverages a...

CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction

CVE-2024-1698 – NotificationX WordPress Plugin SQL Injection Time‑Based Blind Unauthenticated Time‑Based Blind SQL Injection → Extract admin username & password hash from WordPress. 🧠 Vulnerability Overview NotificationX versions 2.8.2 and below suffer from improper input sanitization in the type...

INTACT

SoK Multi-Turn Jailbreak Experiments This repository contains the release version of the code used for the mechanism analyses in SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks. The repository has been trimmed to keep only code, prompts, configuration files, and datasets needed ...

rickmote

rickmote The Rickmote Controller: Hijack TVs using Google Chromecast The Rickmote is a Python program for Hijacking Chromecasts and playing arbitrary video to their connected TVs. Full details on how the hack works were provided at the talk "Rickrolling your Neighbors with Google Chromecast" at...

ruby-saml

Ruby SAML Minor and patch versions of Ruby SAML may introduce breaking changes. Please read UPGRADING.md for guidance on upgrading to new Ruby SAML versions. Vulnerability Notice CVE-2025-66568 and CVE-2025-66567. affects version ruby-saml 1.18.0 including 1.12.4, upgrade to 1.18.1 CVE-2025-54572...

herpaderping

Process Herpaderping png.HerpaderpIcon Process Herpaderping is a method of obscuring the intentions of a process by modifying the content on disk after the image has been mapped. This results in curious behavior by security products and the OS itself. !png.mimioogle !gif.SurivDemo Summary...

CVE-2022-31295

CVE-2022-31295 Online Discussion Forum Site 1.0 - IDOR / Delete any post Exploit Title: Online Discussion Forum Site 1.0 - IDOR / Delete any post Date: 2022-06-13 CVE: CVE-2022-31295 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

CVE-2025-55182-NextJS-RCE-PoC

CVE-2025-55182 React2Shell Reproduction Environment ⚠️ EDUCATIONAL PURPOSE ONLY This repository is created strictly for educational and research purposes. It demonstrates a critical vulnerability in React Server Components Next.js to help developers understand the risks and importance of updating...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF to LFI Exploit ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY This proof-of-concept exploit is provided for educational purposes to help security professionals understand the vulnerability and protect their systems...

jwtear

Jwtear A modular command-line tool to parse, create and manipulate JSON Web TokenJWT tokens for security testing purposes. Features Complete modularity. All commands are plugins. Easy to add new plugins. Support JWS and JWE tokens. Easy interface for plugins. follow the template example Flexible...