CVE-2026-73319

CVE-2026-73319: JavaScript URI accepted as a dynamic redirect XenForo before 2.3.13 accepts a same-host javascript: URI as a dynamic redirect and later assigns it to window.location. What happens Server-side redirect validation rejects foreign hosts but does not require HTTP or HTTPS. A URL shape...

amber

Inroduction Amber is a position-independentreflective PE loader that enables in-memory execution of native PE filesEXE, DLL, SYS.... It enables stealthy in-memory payload deployment that can be used to bypass anti-virus, firewall, IDS, IPS products, and application white-listing mitigations...

CVE-2026-19794

CVE-2026-19794 WP-Stats = 2.56 - Unauthenticated Stored Cross-Site Scripting Plugin URL https://wordpress.org/plugins/wp-stats/ Description Unauthenticated reflected XSS in the statsauthor GET parameter of statspage. The sanitization filter striptags is applied before urldecode, allowing an...

CVE-2021-3131

CVE-2021-3131 Suggested description The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the 'creds' URL parameter. VulnerabilityType Other CWE-522 Insufficiently Protected Credentials Vendor of Product 1C Company Affected Product Code Base 1C:Enterprise 8 -...

Imperva_gzip_bypass

Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...

rtl_433

rtl433 rtl433 despite the name is a generic data receiver, mainly for the 433.92 MHz, 868 MHz SRD, 315 MHz, 345 MHz, and 915 MHz ISM bands. The official source code is in the https://github.com/merbanan/rtl433/ repository. See also a list of software that works with rtl433 in the wiki. For more...

cve-2021-42013-httpd

Dockerisation of a Vulnerability: cve-2021-42013 This project aims to dockerize a specific vulnerability using Docker. The goal is to create an isolated environment in which the vulnerability can be exploited and tested securely. Vulnerable Application Apache HTTP Server 2.4.50 - Remote Code...

CVE-2021-41773

CVE-2021-41773 CVE-2021-41773 According to The National Vulnerability Database NVD CVE-2021-41773, Apache HTTP Server 2.4.49 is vulnerable to Path Traversal and Remote Code execution attacks. Path Traversal The path traversal vulnerability was introduced due to the new code change added for path...

CyberChef

CyberChef The Cyber Swiss Army Knife CyberChef is a simple, intuitive web app for carrying out all manner of "cyber" operations within a web browser. These operations include simple encoding like XOR and Base64, more complex encryption like AES, DES and Blowfish, creating binary and hexdumps,...

go-pkcs12

package pkcs12 import "software.sslmate.com/src/go-pkcs12" Package pkcs12 implements some of PKCS12 also known as P12 or PFX. It is intended for decoding DER-encoded P12/PFX files for use with the crypto/tls package, and for encoding P12/PFX files for use by legacy applications which do not suppo...

Gogs_RCE

GogsRCE Vulnerability Reproduction 0x01 Register a Regular Account on the Frontend 0x02 Compile a Forged Admin Session Using Go go run main.go package main import "bytes" "encoding/gob" "encoding/hex" "fmt" "io/ioutil" func EncodeGobobj mapinterfaceinterface byte, error for , v := range obj...

python-codext

CodExt Encode/decode anything. CodExt is a library Python 3.10 or later that extends the native codecs library namely for adding new custom encodings and character mappings and provides 120+ new codecs , hence its name combining CODecs EXTension. It also features a guess mode for decoding multipl...

CVE-2026-23744-poc

CVE-2026-23744 — mcpJam Remote Code Execution RCE Exploit A Python 3 proof-of-concept exploit for CVE-2026-23744 , an arbitrary command execution vulnerability affecting mcpJam v1.4.2. This utility automates payload delivery by transparently Base64-encoding commands before transmission, helping...

owasp-java-encoder

OWASP Java Encoder Contextual output encoding for Java 8+. Choose an encoder for the parser context receiving untrusted text: HTML, JavaScript, CSS, XML or a URL component. The core has no runtime dependencies; optional JSP and Jakarta adapters provide view-layer bindings. Encoding is one part of...

StegaStamp

StegaStamp: Invisible Hyperlinks in Physical Photographs Project Page CVPR 2020 Matthew Tancik, Ben Mildenhall, Ren Ng University of California, Berkeley Introduction This repository is a code release for the ArXiv report found here. The project explores hiding data in images while maintaining...

pyc2

pyc2 simple c2 written in python2 to demonstrate security concepts. use icmp echo requests and replies to trade base64 encoded commands and replies. Video explaining some of the security concepts and implementation decisions: https://www.youtube.com/watch?v=DHrEn7oK9vQ requires scapy pip install...

linux-apache-fix-mod_rewrite-spaceInURL

FIX linux Ubuntu Apache modrewrite space In URL After the last Apache Upgrade, I've had some issues with "spaces in URL" in modrewrite. 2023-04-25 - upgrade apache2:amd64 2.4.38-3+deb10u9 2.4.38-3+deb10u10 The URLs that contain "space" and have been replaced with %20 start to return error 403 by...

br0w

br0w Hack The Br0w | Play your browser and learn more, hack fun !! The Br0w is a simple web to learn about and about web security with a browser as a tool that sometimes people forget about more benefits. Maybe it's more like Capture The Flag CTF. One of the challenges is, disable css and base64...

CVE-2026-66752-HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-

Security Advisory: HTTP Request Smuggling via Unparsed Transfer-Encoding Values tinyhttp Assigned CVE ID: CVE-2026-66752 Summary tinyhttp checks only whether a Transfer-Encoding header is present. It never looks at the value. Any value, including codings that are not chunked and coding lists whos...

NOW

NØW — Word-Based Shellcode Encoder Encode shellcode as natural-looking English prose. Decode it back with the right sentence + password. What is NØW? NØW Natural Output Words is a C tool that converts raw shellcode bytes into human-readable English text — either a plain list of codewords or fluen...