SnaffPoint

SnaffPoint What is it SnaffPoint is a tool for pointesters who are in need of some sweetness in this world. It should help you find sensitive files available on SharePoint online and on shared OneDrive files for your company or your customer. How does it work There are actually 2 tools:...

MoxaPass

This is a sample exploit for CVE-2016-9361. It retrieves the SNMP community string and 'admin' password for many kinds of Moxa device. It uses Moxa's UDP/4800 proprietary management protocol. The protocol lacks security, and using the 'unlock' function code does not require a password. This explo...

CVE-2025-26318

TSplus Remote Access - CVE-2025-26318 Insecure Permissions Information Disclosure 📌 Description TSplus is, by default, vulnerable to the disclosure of information from users currently connected to the domain on TSplus. 🔍 Vulnerability Details CVE ID : CVE-2025-26318 Vendor : TSplus Affected...

system_prompts_leaks

System Prompts Leaks Leaked system prompts of ChatGPT, Claude, Gemini and more. The hidden system prompt of every popular chatbot, in full, every version since May 2025. Also Anthropic Claude Code, OpenAI Codex, Google Antigravity, xAI Grok, Meta Muse, Moonshot Kimi, Alibaba Qwen, Z.ai GLM ZCode,...

nextjs-CVE-2024-34351-_exploit

CVE-2024-34351 Exploit CVE-2024-34351 PoC Next.js Server-Side Request Forgery in Server Actions · CVE-2024-34351 · GitHub Advisory Database Digging for SSRF in NextJS apps Summary PoC for a full exploitation of NextJS SSRF. An attacker can get any website content from Next.js server using...

CVE-2025-32044

CVE-2025-32044 — Moodle Unauthenticated REST API User Data Exposure Stack Trace Args Leak → Names, Emails, Password Hashes Overview CVE-2025-32044 is a high-severity CVSS 7.5 unauthenticated information disclosure vulnerability in Moodle LMS 4.5.0 through 4.5.2. The vulnerability lies in Moodle's...

CVE-2022-2414-Proof-Of-Concept

CVE-2022-2414-Proof-Of-Concept A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests...

CVE-2021-29447-PoC

CVE-2021-29447-PoC Overview CVE-2021-29447 is an XML External Entity XXE injection vulnerability affecting WordPress versions 5.6–5.7 patched in 5.7.1 when running PHP 8.0+. The vulnerability resides in the getID3 library used for media metadata parsing. WordPress processes WAV file iXML chunks v...

hikihack

🛡️ CVE-2017-7921 — Case Study & Awareness This repository documents, for educational and cybersecurity awareness purposes, the possible consequences of equipment vulnerable to CVE-2017-7921 a public vulnerability disclosed in 2017, affecting certain firmware of Hikvision cameras/recorders that hav...

CVE-2025-5964-

CVE‑2025‑5964 Path Traversal PoC for M‑Files Author: Byte Reaper Telegram: @ByteReaper0 Overview This repository contains a Proof‑of‑Concept PoC in C for a suspected Path Traversal vulnerability in M‑Files version 25.6.14925.0. The PoC file exploit.c attempts to read sensitive files e.g...

Config-Exploiter

Config-Exploiter Config-Exploiter : dump config.php File From Joomla And Wordpress Websites Programmed By Belahsan Ouerghi . Installation sudo apt-get install git git clone https://github.com/TunisianEagles/Config-Exploiter.git cd Config-Exploiter chmod +x install.sh sudo ./install.sh chmod +x...

MongoBleed-CVE-2025-14847

MongoBleed CVE-2025-14847 – Vulnerability Checker Systemhaus Schulz – Security Tools A professional-grade security scanner to detect the MongoBleed CVE-2025-14847 MongoDB memory disclosure vulnerability. Unlike simple version-check tools, this scanner uses a PoC-accurate probing technique , safel...

cve-2023-31346-poc

Firmware Memory Leak The code here aims to demonstrate the memory leaks in guest messages headers and the CPUID request guest message. Prerequisites Install rustup. Install a Linux kernel with SEV-SNP host support. I used a kernel with my a few of own patches...

CVE-2019-7642

CVE-2019-7642 D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and login logs. Vulnerable targets include but are not limited to the latest firmware versions of DIR-817LW A1-1.04, DIR-816L...

CVE-2018-15473

CVE-2018-15473 SSH-Username-Enumeration-Exploit OpenSSH 2.3 7.7 Edited version of the original exploit: https://www.exploit-db.com/exploits/45233 Converted to Python3 Added username wordlist option How To Run Ensure that you install the requirements: foo@bar:$ pip3 install -r requirements.txt For...

WSPIH

WSPIH Website Personal Sensitive Information File Scanner Disclaimer: This project is for learning, testing, and communication purposes only. Do not use for illegal purposes. If the target is a school website, please submit the vulnerability to the Education Industry Vulnerability Reporting...

CVE-2021-27187

CVE-2021-27187 Suggested description The FX Aggregator terminal client by "Sovremennye Delovye Tekhnologii" stores authentication credentials in cleartext in login.sav when the Save Password box is checked. VulnerabilityType Other CWE-522 Insufficiently Protected Credentials Vendor of Product OOO...

ipmi

I wrote some software to explore IPMI; here are some of results. I thought I'd do the usual detect, get data, and audit sort of cycle. Each of these turned out to be fairly interesting problem on its own, at least to me. BTW/FYI - I released a new tool to explore IPMI -...

CVE-2024-32399

CVE-2024-32399 Vulnerability Overview Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via the /webeditor/ component Vulnerability Type Directory Traversal Vendor of Product RaidenMAILD Mail Server Affected...

CVE-2020-4463

IBM Maximo Asset Management is vulnerable to Information Disclosure via XXE Vulnerability CVE-2020-4463 IBM Maximo Asset Management is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive...