shiro

CVE-2026-49268 — Analysis and Remediation of an LDAP Injection Authentication Bypass Vulnerability | ---|--- Branch| 1.13-CVE-2026-49268 Author| Jinwoo Hwang https://JinwooHwang.com This branch 1.13-CVE-2026-49268 contains a comprehensive security remediation of an LDAP Injection Authentication...

CVE-2023-28432

CVE-2023-28432 MiniO verify interface sensitive information disclosure vulnerability CVE-2023-28432 Chinese name: MinIO verify 接口敏感信息泄露漏洞（CVE-2023-28432） Description : MinIO is an open source object storage service that is compatible with the Amazon S3 API and can be used in private or public...

gadgetinspector

Gadget Inspector This project inspects Java libraries and classpaths for gadget chains. Gadgets chains are used to construct exploits for deserialization vulnerabilities. By automatically discovering possible gadgets chains in an application's classpath penetration testers can quickly construct...

CVE-2024-40815

CVE-2024-40815 POC for CVE-2024-40815 Construction is in its final stage ==IOS 17.0...

security-harness

Security Harness A multi-agent application-security review harness for Claude Code and, later, other AI agents. One router skill dispatches to a full offensive-security pipeline that maps a codebase, hunts vulnerabilities with a per-class knowledge base, chains findings into escalations, verifies...

CVE-2019-1619

CVE-2019-1619 Powershell Script to build the token needed for Authentication Bypass. I was in a pentest and found a server vulnerable to CVE-2019-1619. I couldn't leverage the metasploit module due to restricted access so I exploited it manually. I created this script to automate the building of...

CVE-2026-40176-poc

CVE-2026-40176: Composer Perforce OS Command Injection PoC Description This repository contains a Proof of Concept PoC for CVE-2026-40176 , a critical OS Command Injection vulnerability discovered in Composer 's Perforce VCS driver versions prior to 2.2.27 and 2.9.6. The vulnerability exists in t...

CVE-2024-50972

CVE-2024-50972 Description A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the borrowid parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code...

CVE-2024-50971

CVE-2024-50971 Description A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the mapid parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code Base:...

JavaDeRe

Project Introduction Mainly used for base64-encoding class files while constructing Java deserialization echo payloads, and for decoding base64 strings back into class files to view attack payloads during incident response. PS: mainly because I'm lazy Usage Examples Run evil.java normally...

CVE-2026-11113-SMTP-Header-Injection-in-Contact-Form

CVE-2026-11113 – SMTP Header Injection in Contact Form Program Code Python contactformserver.py - Mails feedback without sanitizing headers from flask import Flask, request import smtplib app = Flaskname @app.route'/contact', methods='POST' def contact: sender = request.form'email' message =...

CVE-2025-65321

CVE-2025-65321 The Language Sloth Discord bot is vulnerable to Directory Traversal in the gif and png functions. The functions build file paths using unsanitized user input for the 'name' parameter, allowing attackers to reference files outside the intended resource directories. The functions "gi...

CVE-2023-40448

CVE-2023-40448 poc for CVE-2023-40448 under construction ,This could probably be a piece for a jailbreak...

CVE-2026-102876

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

CVE-2026-82973 Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via...

CVE-2026-100722

A flaw was found in vm2. An attacker who can execute untrusted code within the sandbox can trigger an unhandled error by instantiating host-provided functions that return a rejected asynchronous operation Promise. Due to missing error handling in the sandbox-to-host object construction trap, the...

CVE-2026-63278

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...

UBUNTU-CVE-2026-63278

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...

CVE-2026-90819

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

CVE-2026-90819 a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...