scan_CVE-2020-29583

Scanner for Zyxel products which are vulnerable due to an undocumented user account CVE-2020-29583 Vuln details: https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html But I'm not sure if it's really possible to login with zyfwp via the web interface? Any reports would be...

CVE-2018-18852

CERIO router Authenticated RCE backdoor vendor creds CVE-2018-18852 Python PoC hook-s3c github.com/andripwn, @andripwn on twitter Working Python PoC for CVE-2018-18852, originally appearing on; https://github.com/andripwn/CVE-2018-18852 What's up CERIO Router models and variants of, DT300N, DT100...

CVE-2025-14269

CVE-2025-14269 A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse cached credentials to access Helm functionality through the Headlamp UI. Kubernetes clusters are only affected if Headlamp is installed, is configured with...

odat

Quentin HARDY --- [email protected] [email protected] ODAT ODAT Oracle Database Attacking Tool is an open source penetration testing tool that tests the security of Oracle Databases remotely. Usage examples of ODAT: You have an Oracle database listening remotely and want to find valid...

Exploits

Exploits Real world and CTFs exploit POCs. Real World CVE| Short description| Exploit ---|---|--- CVE-2017-5343| Wordpress SQL Injection| POC CVE-2018-8880| Unauthenticated Lutron Quantum Bacnet v2 network info exfiltration| POC CVE-2018-11629| Default and unremovable credentials in Homeworks QS...

aws-iam-authenticator

AWS IAM Authenticator for Kubernetes A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster. The initial work on this tool was driven by Heptio. The project receives contributions from multiple community engineers and is currently maintained by Heptio and Amazon EKS OSS...

festin

FestIN the powered S3 bucket finder and content discover What is FestIn Why Festin Install Using Python Using Docker Full options Usage Configure search domains Concurrency HTTP Crawling configuration Manage results Proxy usage DNS Options Full Text Support Running as a service or watching mode...

gerapy-cve-2021-43857

Gerapy CVE-2021-43857 Authenticated RCE This repository contains a proof of concept exploit for CVE-2021-43857 , a Remote Code Execution vulnerability affecting Gerapy -p -L -P Requirements 1. Python 3.x 2. requests and pyfiglet pip install requests pyfiglet 3. Netcat nc...

CVE-2025-65855

CVE-2025-65855 HelpFlash IoT OTA Update Multiple Vulnerabilities Summary Multiple vulnerabilities in the OTA firmware update mechanism of Netun Solutions HelpFlash IoT allow an attacker with brief physical access to execute arbitrary code. CVE ID: CVE-2025-65855 Severity: HIGH CVSS v3.1 Score: 7....

Teldat-Router-CVE-2022-POC

Teldat Router CVE-2022-39996 & CVE-2022-39997 POC Proof of Concept for two vulnerabilities discovered in Teldat RS123 / RS123w routers. Overview CVE ID| Type| CWE| CVSS| Severity ---|---|---|---|--- CVE-2022-39996| Reflected XSS| CWE-79| 6.1| Medium CVE-2022-39997| Weak Password| CWE-521| 9.8|...

POC-CVE-2026-19295

Description Proof of concept exploit code for CVE-2026-19295 Usage python3 poc.py -url -uname -pword -c...

EyeWitness

EyeWitness - Web Screenshot Tool EyeWitness is designed to take screenshots of websites, provide server header info, and identify default credentials if known. Now powered by Chromium browser for better reliability and easier installation. 🚀 Key Features Cross-platform support - Windows, Linux,...

CVE-2022-3656

Imperva Red Team recently revealed a vulnerability called CVE-2022-3656 that affects more than 2.5 billion users of Google Chrome and Chromium-based browsers. This vulnerability allows the theft of sensitive files, such as encrypted wallets and cloud provider credentials. Vulnerability...

teamcity-idea-cve-2020-35667-poc

TeamCity IntelliJ IDEA Plugin credential interception CVE-2020-35667 Quick Links Proof-of-Concept Report | Workflow Analysis | Server script Description This is a reproduction of CVE-2020-35667 by building a fake XML-RPC TeamCity endpoint. CVE-2020-35667 is a SSRF vulnerability in the JetBrains...

CVE-2025-49132

🛡️ Pterodactyl Panel Vulnerability Checker & Exploit Tool ✨ About A Python script that automates the discovery and exploitation of vulnerabilities in misconfigured Pterodactyl panels. 🔍 Discovers exposure of sensitive configuration locale.json file. 🔑 Extracts MySQL database credentials. 👑...

CVE-2026-44578

CVE-2026-44578 — Next.js WebSocket Upgrade SSRF Pre-authentication Server-Side Request Forgery in Next.js self-hosted deployments. A single crafted HTTP request extracts AWS credentials, secrets, and internal service data from localhost:80. Field| Value ---|--- CVE| CVE-2026-44578 GHSA|...

eos

Enemies Of Symfony EOS EOS loots information from a Symfony target in debug mode: Section| Description ---|--- General| Get general information about the target. Phpinfo| Extract Symfony environment variables from the exposed phpinfo. Routes| Get the list of registered routes. Request logs| Look...

motioneye-authenticated-RCE

MotionEye/MotionEyeOS Authenticated RCE A Python 3 script that uploads a tasks.pickle file that enables RCE in MotionEye. You need administrator credentials, so it should not be that big of a deal. Unfortunately, MotionEye/MotionEyeOS can frequently be found running with default credentials...

cve-2025-9933

🔒 Credential for admin panel Username: admin Password: Test@123 Username: [email protected] Password: Test@123 Or Register a new user. Description A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the fi...

JS-Secret-Hunter

JS Secret Hunter V2 🕵️‍♂️ JS Secret Hunter is an advanced Python tool designed for security researchers to automate the detection of hardcoded secrets in client-side JavaScript. Unlike simple scanners, V2 includes a dynamic crawler that parses the HTML of the target website to extract all loaded...