CVE-2019-10708

Scms - SQL Injection exploit.py is a PoC for the CVE-2019-10708 vulnerability, implementing multiprocessing for injection to obtain the database name and backend administrator credentials recommended for versions before 20190401 Usage 測試是否可注入 python3 exploit.py http:localhost/js/scms.php --test...

CVE-2020-3580

CVE-2020-3580 Additional exploits for XSS in Cisco ASA devices discovered by PTSwarm Usage Stage address change me Demonstrate Logon to Cisco ASA WebVPN Visit staged malicious page Recover your credentials Patch ; Example / Result...

CVE-2024-21413-POC

CVE-2024-21413 - POC Usage: python CVE-2024-21413.py -host example.com -port 25 -from [email protected] -recipient [email protected] -url xx.xx.xx.xx/path/to/shared/file/r0tb1t.rtf !NOTE r00tb1t : is the shared test file word in this case from the attacker machine xx.xx.xx.xx. To ensure...

CVE-2024-43451-POC

Description Name : CVE-2024-43451 CVSSv3 Score : 6.5 Affected Versions : All Microsoft Windows versions before the Nov 2024 Patch CVE-2024-43451 is a zero-day vulnerability in Microsoft Windows that allows attackers to capture NTLMv2 password hashes with minimal interaction from the user,...

CVE-2021-21975

CVE-2021-21975 VMware vRealize Operations Manager API Server Side Request Forgery SSRF vRealize Operations vROps is a tool that self-driving IT operations management powered by AI from apps to infrastructure to optimize, plan and scale VMware Cloud and HCI deployments while unifying public cloud...

CVE-2026-111927

The Coder software versions before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 are vulnerable to a credential theft flaw. The root cause is an improper hostname validation in GetWorkspaceProxyByHostname, where a SIMILAR TO pattern performs a prefix match . This ...

physmem2profit

Physmem2profit Physmem2profit can be used to create a minidump of a target host's LSASS process by analysing physical memory remotely. The intention of this research is to propose an alternative approach to credential theft and create a modular framework that can be extended to support other...

KeeFarceReborn

KeeFarce Reborn A standalone DLL that exports databases in cleartext once injected in the KeePass process. Heavily inspired by the great KeeFarce, KeeThief and KeePassHax projects. Yet another KeePass extraction tool, why ? A few years ago, @denandz released KeeFarce, the first offensive tool...

CVE-2026-111631

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection...

CVE-2023-41898_Lab

CVE-2023-41898 Unvalidated Deep Link Lab This is an educational, reduced-scope reproduction Lab built based on the public vulnerability report GHSL-2023-142 for Home Assistant Companion for Android and the open-source structure of the vulnerable version 2023.8.2. It does not use a real Home...

EUVD-2026-103053

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection...

TP-Link-Archer-CR-700-XSS-Exploit

TP-Link-Archer-CR-700-XSS-Exploit Exploiting TP-Link Archer CR-700 Router. Responsibly Disclosed to TP-Link Step 1- On you linux machine Kali or Ubuntu type the following command gedit /etc/dhcp/dhclient.conf Comment out the line below send host-name = gethostname; Copy it to the line below it an...

SCAT

SCAT HP SiteScope Credential Acquisition Tool What is this? A tool that abuses a remote code execution vulnerability in default HP SiteScope v11.32 et al installations to steal credentials stored in SiteScope. What remote code execution vulnerability? HP SiteScope by default enables Java Manageme...

CVE-2026-15583

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-15583 CVE-2026-15583 Grafana MCP Server 0.17.0 - Grafana Labs I am @abraxasnull. Loopback lab. The client is CVE-2026-15583-Abraxas-Labs.py. Confused deputy. Unauthenticated MCP HTTP takes X-Grafana-URL from...

LsassReflectDumping

LsassReflectDumping This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone is created, it utilizes MINIDUMPCALLBACKINFORMATION callbacks to generate a memory dump of the cloned process. Steps Getting the handle of...

sshLooter

DON'T USE THIS There's a C version which is much better sshLooterC sshLooter Script to steal passwords from ssh. Install git clone https://github.com/mthbernardes/sshLooter.git cd sshLooter Configuration Edit the script on install.sh, and add your telegram bot api, and your userid. Call the...

createdump

Windows App LSASS Dump - Proof of Concept This project demonstrates how to dump the LSASS process using the createdump.exe tool, a Microsoft signed executable, from the Windows App, leveraging a custom hook to enable process access to LSASS. Get-AuthentiCodeSignature -FilePath Join-Path -Path...

EUVD-2026-102521

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...

PT-2026-116030

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage options users. Attackers can call dt verify external connection with a chosen endpointId and url to send stored connection...

CVE-2026-111347

The go-ldap-admin tool, versions up to and including 0.6.2 , contains a hard-coded RSA private key within its public repository. This key is used to protect encrypted login passwords. Unauthenticated attackers can recover cleartext LDAP credentials by capturing encrypted passwords and decrypting ...