424723 matches found
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
javascript-obfuscator
JavaScript 混淆器 🚀 带 VM 混淆的 Obfuscator.io Obfuscator.io 为本包增加了基于 VM 的字节码混淆 功能——您的 JavaScript 函数会被编译为自定义字节码，并在内置的虚拟机上运行。每次构建都会生成独特的操作码和 VM 结构，使逆向工程和自动化反混淆变得极其困难。 保护目标| 免费（本包）| obfuscator.io ---|---|--- 重命名标识符| ✅ 变量/函数重命名| ✅ + VM 局部符号永不暴露为 JavaScript 混淆字符串| ✅ 字符串数组 + base64/rc4| ✅ + 字符串嵌入字节码常量 混淆控制流|...
CVE-2025-13780
CVE-2025-13780: pgAdmin 4 = 8.14 RCE Scanner A comprehensive vulnerability scanner for CVE-2025-13780 , a Remote Code Execution RCE vulnerability in pgAdmin 4 versions ≤ 8.14. 🔍 Vulnerability Details The vulnerability exists in the Restore feature of pgAdmin 4. The application attempts to block...
Rootsmart-v2.0
Rootsmart 2.0 w/ cve-2019-2215 + 勒索软件 免责声明 本项目仅供教育目的。本项目使用了来自 rkshrksh/2048-Game 和 kangtastic/cve-2019-2215 的代码。 项目描述 本项目是新加坡理工大学移动安全模块的一部分。项目在6周内完成，目的是开发一个恶意的安卓应用程序。通过这样做，它帮助我们了解了安全机制在 Android 操作系统中的实现方式，以及如何利用 OWASP Mobile Top 10:2017 M8 - 代码篡改。 该项目是一个概念验证，用于展示一个自定义编写的勒索软件，它利用 AES 加密、武器化...
CVE-2025-8550
CVE-2025-8550 – atjiu pybbs XSS Exploit Description This repository hosts an automated Proof-of-Concept PoC exploit for CVE-2025-8550 , a reflected Cross‑Site Scripting XSS vulnerability in atjiu pybbs ≤ v6.0.0. It targets the /admin/topic/list endpoint’s username parameter, which lacks proper...
citrix-ioc-scanner-cve-2023-3519
Indicator of Compromise Scanner for CVE-2023-3519 This repository contains a utility for detecting compromises of Citrix ADC Appliances related to CVE-2023-3519. The utility, and its resources, encode indicators of compromise collected during Mandiant investigations. To learn more, please read th...
Stryker
Stryker Multi-purpose proof-of-concept tool based on CPU-Z CVE-2017-15303 System Requirements x64 Windows 7/8/8.1/10; Stryker designed only for x64 Windows; Administrative privilege is required. Features Driver Signature Enforcement Overrider similar to DSEFIx; Protected Processes Hijacking via...
Important: Red Hat Security Advisory: grafana-pcp security update
An update for grafana-pcp is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...
Detections-CVE-2026-23918
MOVING TO: https://github.com/insomnisec/publiccvedetections FOR BETTER LONG TERM MANAGEMENT OF DETECTION PUBLICATIONS THIS REPO WILL BE REMOVED IN JUNE 2026 PLEASE USE THE OTHER REPO GOING FORWARD CVE-2026-23918 "Apache HTTP/2 Double-Free" — Detection & Response Package Published: 2026-05-04...
ioc-scanner-CVE-2019-19781
Indicator of Compromise Scanner for CVE-2019-19781 This repository contains a utility for detecting compromises of Citrix ADC Appliances related to CVE-2019-19781. The utility, and its resources, encode indicators of compromise collected during FireEye Mandiant investigations. To learn more, plea...
CVE-2021-21551
CVE-2021-21551 Simple PoC for exploiting CVE-2021-21551 for LPE by spawning system cmd. https://vulners.com/cve/CVE-2021-21551 An issue was discovered in signed dell windows driver dbutil23.sys which may lead to compromisation of whole local system. Driver's ioctl dispatch routine lacks of...
nodejs-http-transfer-encoding-smuggling-poc
nodejs-http-transfer-encoding-smuggling-poc PoC of HTTP Request Smuggling in nodejs CVE-2020-8287 src/index.js root@kitploit: header: 'Host', '127.0.0.1', 'Transfer-Encoding', 'chunked', 'Transfer-Encoding', 'eee' , body: 'A' header: 'Host', '127.0.0.1' , body: '' data: 'HTTP/1.1 200 OK\r\n' +...
ets5-password-recovery
ETS5 Password Recovery Tool Table of Contents Introduction Installation Requirements How does the password recovery work? How was the design flaw discovered? How can the risk be mitigated? Coordinated Vulnerability Disclosure License Change log Introduction Have you forgotten the password to one ...
CVE-2019-2215
CVE-2019-2215 Bravia TV における CVE-2019-2215 を利用した Temproot Overview カーネルメモリの読み書きのみによる特権昇格攻撃のデモで、結果として一時的な root シェルを取得します。 これは、Android 8 PKG6.0724 ファームウェアとカーネルバージョン 4.9.51 を搭載した Sony Bravia TV デバイスで動作します。 このツールを同じ脆弱性の影響を受ける他のデバイスやカーネルで動作させるには、いくつかのオフセットを見つけて変更する必要があります。Project Zero バグトラッカー...
Log4jPatch
-- 此仓库已被归档 -- 该工具的后续开发将继续在 corretto/hotpatch-for-apache-log4j2 进行。 感谢大家的分享、评论、试用以及对本项目的贡献！ Log4jPatch 这是一个简单工具的POC，用于向正在运行的JVM进程注入一个Java agent。该agent会修补所有已加载的 org.apache.logging.log4j.core.lookup.JndiLookup 实例中的 lookup 方法，使其无条件返回字符串 "Patched JndiLookup::lookup"。这应该在无需重启Java进程的情况下修复 Log4j 中的...
