CVE-2025-14269

CVE-2025-14269 A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse cached credentials to access Helm functionality through the Headlamp UI. Kubernetes clusters are only affected if Headlamp is installed, is configured with...

CVE-2022-24707_AnukoTimeTracker_Version-1.20.0_POC

CVE-2022-24707 Anuko Time Tracker SQL Injection Exploit A security assessment tool that demonstrates a SQL injection vulnerability in Anuko Time Tracker's Version 1.20.0 puncher feature. This tool helps to Dump the whole ttusers Database and revels every single entry, If used as per following the...

vulnerability-assessment

openssh-vulnerability-assessment Professional cybersecurity assessment demonstrating vulnerability identification, CVSS severity scoring, MITRE ATT&CK framework application, and detailed remediation planning for OpenSSH 6.6.1p1 critical vulnerabilities CVE-2016-0777, CVE-2015-5600 🛡️ OpenSSH...

CVE-2025-9983

CVE-2025-9983 - GALAYOU G2 RTSP EXPLOIT /!\ Disclaimer: This script is provided 'as is' and exclusively for educational purposes. Users are strongly advised to exercise caution and utilize it within the boundaries of legal and ethical considerations. Description Python POC for CVE-2025-9983 , an...

CVE-2026-103090 Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)

Missing Authentication for Critical Function CWE-306 and Insufficiently Protected Credentials CWE-522 in the control plane enrollment status handler HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha....

CVE-2026-103090

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 are vulnerable to unauthenticated Biscuit credential disclosure . The root cause is missing authentication and insufficiently protected credentials in the control plane enrollment status handler (HandleEnrollStatus at GET /e...

CVE-2023-42793

Batch scan python teamcityscan.py -f targets.txt -o results.txt Single target python teamcityscan.py -u http://target.com:8111 -o result.txt Specify thread count python teamcityscan.py -f urls.txt -t 20 -o vuln.txt Target file format targets.txt: http://192.168.1.100:8111...

CVE-2025-26199

🛡️ CVE-2025-26199 — Insecure Password Transmission via Cleartext in CloudClassroom-PHP-Project v1.0 📄 Description CloudClassroom-PHP-Project v1.0 is vulnerable to insecure transmission of user credentials. During the authentication process, passwords are submitted over unencrypted HTTP rather than...

ThunderCloud

ThunderCloud Cloud Exploit Framework Usage python3 tc.py -h | | | | | / | | | | | | | | | | | | | | | | | | | ' | | | | ' \ / |/ \ '| | | |/ | | | |/ | | | | | | | || | | | | | | / | | || | | || | | | / || ||,|| ||,||| ||/ ,|,| usage: tc.py -h -ce COGNITOENDPOINT -reg REGION -accid...

CVE-2026-18963

CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detector https://github.com/user-attachments/assets/005fab89-339a-4e4e-881c-da6a626f6c9e python3 kc-resetforge.py -h usage: kc-resetforge.py -h --target TARGET --targets-file TARGETSFILE --port PORT --realm REALM --client-id CLIENTID --userna...

HikvisionExploiter_fixed

HikvisionExploiter Educational security tool for testing unsecured Hikvision exposures and checking CVE-2021-36260 in authorized environments. ⚠️ Legal and Ethical Warning This project should be used only on systems you own or have explicit permission to test. Scanning/exploitation without...

metasploitable2-exploitation-metasploit

Exploiting Metasploitable2 with Metasploit: VSFTPD, Samba, and More A hands-on walkthrough of exploitation using the Metasploit Framework — from PostgreSQL database setup and dbnmap scanning, through three root shells via vsftpd, Samba, and UnrealIRCd, to credential exfiltration with Netcat...

cve-2026-34472-auth-bypass-zte-h188a-router

CVE-2026-34472 Technical breakdown of CVE-2026-34472, an auth bypass via leaked credentials affecting ZTE ZXHN H188A V6 firmware. Summary In the tested H188A V6 builds, unauthenticated requests to the root path can reach pre-login wizard handlers and disclose sensitive data including: WLAN PSKs...

CVE-2026-31278

CVE-2026-31278 Suprema BioStar 2: Active Directory Credential Exposure Metadata Field| Details ---|--- CVE ID| CVE-2026-31278 Vendor| Suprema Inc. Product| BioStar 2 Vulnerability Type| Sensitive Information Disclosure / Credential Exposure Attack Vector| Remote / Authenticated / Low Complexity...

DEBIAN-CVE-2026-111812

Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are...

CVE-2026-111812

Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are...

SCAT

SCAT HP SiteScope Credential Acquisition Tool What is this? A tool that abuses a remote code execution vulnerability in default HP SiteScope v11.32 et al installations to steal credentials stored in SiteScope. What remote code execution vulnerability? HP SiteScope by default enables Java Manageme...

TP-Link-Archer-CR-700-XSS-Exploit

TP-Link-Archer-CR-700-XSS-Exploit Exploiting TP-Link Archer CR-700 Router. Responsibly Disclosed to TP-Link Step 1- On you linux machine Kali or Ubuntu type the following command gedit /etc/dhcp/dhclient.conf Comment out the line below send host-name = gethostname; Copy it to the line below it an...

CVE-2026-111812

Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are...

EUVD-2026-107536

Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are...