PhantomFS

PhantomFS ProjFS provider. Projects files where the content depends on which process reads them. Payload is stored AES-256-CBC encrypted on disk, decrypted only in memory at runtime. This shouldnt bypass any EDR as the payload will be written to disk when allowed processes try to read it...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

cve-2017-5638

CVE-2017-5638 PoC Code in Python | DORK: ext:action Example PoC Code for CVE-2017-5638 | Apache Struts Exploit | DORK: ext:action USAGE: python struts.py https://victim.site dir The initial Python Script that was Posted didn't correctly format the Content-Type Header. I recoded the Content Type...

zappzarapp-php-security

⚡ zappzarapp/security Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event...

CVE-2026-114629

The Web::Simple module for Perl (versions before 0.035 ) is vulnerable to a memory allocation issue. The component Web::Dispatch::ParamParser::get_unpacked_body_from reads application/x-www-form-urlencoded bodies using a single read call without a cap. Because Perl's read function grows the buffe...

CVE-2026-114629

Web::Simple versions before 0.035 for Perl allocate a buffer sized by...

CVE-2026-114629 Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl'...

EUVD-2026-109295

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl'...

CWFF

CWFF - Custom wordlists for fuzzing CWFF is a tool that creates a special High quality fuzzing/content discovery wordlist for you at the highest speed possible using concurrency and it's heavily inspired by @tomnomnom's Who, What, Where, When, Wordlist NahamCon2020. Usage CWFF -h --threads --gith...

dockle

Dockle - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start Dockle helps you: 1. Build Best Practice Docker images 2. Build secure Docker images Checkpoints includes CIS Benchmarks $ brew untap goodwithtech/dockle who use 0.1.16 or older version $ bre...

st2-046-poc

Struts2 Content-Disposition filename null-byte variant of CVE-2017-5638 Struts2 Security Bulletin S2-046 A null byte \x00 in a request¡¯s Content-Disposition header filename field can trigger a InvalidFileNameException with the same client controlled filename string in the exception message that ...

CVE-2025-10720-PoC

Description This proof of concept PoC describes an authentication bypass vulnerability found in the WordPress plugin WP Private Content Plus v3.6.2. The issue allows unauthenticated users to bypass password-protected content due to improper reliance on client-side cookies. Details Vulnerability...

strutsy

Strutsy Strutsy - Mass exploitation of Apache Struts CVE-2017-5638 vulnerability. Includes blind and time based code injection techniques which significantly reduces false negatives. Other features include mass URL imports to scan multiple targets in one go. Usage: python strutsy.py urls.txt...

CVE-2023-47668

CVE-2023-47668 Description Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin Example of the result Log file content: 2024-12-24 20:47:19 - wprcpdiscounts table upgrade to 202003311 successful. 2024-12-24 20:47:19 -...

XworkStruts-RCE

XworkStruts-RCE CVE-2017-5638 XworkStruts RCE Vuln test script The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrar...

CVE-2025-50422

Poppler before version 25.04.0 When pdftocairo renders a malicious PDF and calls cairodebugresetstaticdata on exit, heap memory containing PDF object streams is not properly cleared. An attacker with local access can dump process memory and recover clear-text PDF content e.g., /stream /endstream...

apache__sling-org-apache-sling-xss_CVE-2016-5394_1-0-8

Apache Sling XSS Bundle The Apache Sling XSS Bundle provides two services for escaping and filtering XSS-prone user submitted content: 1. org.apache.sling.xss.XSSAPI 2. org.apache.sling.xss.XSSFilter Please check the JavaDoc of each service to find out what methods they provide...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

CVE-2019-3799

CVE-2019-3799 - Spring-Cloud-Config-Server Directory Traversal Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the...

CVE-2026-66066

CVE-2026-66066 — KindaRails2Shell Ruby on Rails Active Storage + libvips arbitrary file read → conditional remote code execution RCE PoC tool. Single-file, Python 3.11+ pure standard library with zero dependencies , includes MAT/HDF5 hybrid payloads, a pure-Python PNG pixel decoder, offset reads,...