CVE-2026-44277

🚨 CVE-2026-44277 - FortiAuthenticator Unauthenticated RCE Critical Unauthenticated Remote Code Execution in Fortinet FortiAuthenticator 📋 Overview CVE-2026-44277 is a critical vulnerability in Fortinet FortiAuthenticator that allows unauthenticated attackers to achieve Remote Code Execution RCE v...

RedDrop

RedDrop Exfil Server ¡Mira el artículo del blog de MaverisLabs que lo acompaña aquí! RedDrop Exfil Server es un servidor web Python Flask para probadores de penetración, equipos rojos y profesionales de seguridad que incluye: Carga de archivos Procesamiento automático de payloads Extracción...

CVE-2026-59358

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

JSFScan.sh

JSFScan.sh El blog se puede encontrar en https://medium.com/@patelkathan22/beginners-guide-on-how-you-can-use-javascript-in-bugbounty-492f6eb1f9ea?sk=21500dc4288281c7e6ed2315943269e7 Script creado para toda tu automatización de reconocimiento de JavaScript en bug bounty. Simplemente pasa la lista...

Prommetrix

Info: Prommetrix is a free software tool to obtain relevant information from the instances of 'Node Exporter' executed by 'Prometheus'. Prometheus is an open-source, metrics-based event monitoring and alerting solution for cloud applications. It is used by nearly 800 cloud-native organizations...

cve-2023-38646-poc

Metabase Pre Authentication RCE CVE-2023-38646 CVE-2023-38646 is a remote code execution vulnerability in Metabase. The vulnerability stems from a security flaw in Metabase's handling of JDBC connection strings when processing the unauthenticated API endpoint /api/setup/validate. An attacker can...

GWTMap

Descripción GWTMap es una herramienta para ayudar a mapear la superficie de ataque de aplicaciones basadas en Google Web Toolkit GWT. El propósito de esta herramienta es facilitar la extracción de cualquier endpoint de método de servicio oculto en el código ofuscado del lado del cliente de una...

CVE-2026-59358

Cloud Foundry UAA (v3.7.0 to v79.6.0) and CF Deployment (up to v60.4.0) are vulnerable to an Improper Authentication (CWE-287) flaw in the OAuth token endpoint. The system fails to verify if a Bearer credential is a legitimate client secret, instead accepting any valid access token where the clie...

CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

EUVD-2026-92988

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

CVE-2024-51378

CyberPanel Command Injection Vulnerability - CVE-2024-51378 Exploit for CyberPanel Pre-Auth RCE Remote Code Execution via Command Injection Author: Luka Petrovic refr4g Date Disclosed: October 2024 Overview Proof-of-concept PoC exploit for a command injection vulnerability CVE-2024-51378 in...

CVE-2022-47966

CVE-2022-47966 POC for CVE-2022-47966 affecting the following ManageEngine products: Access Manager Plus Active Directory 360 ADAudit Plus ADManager Plus ADSelfService Plus Analytics Plus Application Control Plus Asset Explorer Browser Security Plus Device Control Plus Endpoint Central Endpoint...

Mass-CVE-2025-3248

Langflow CVE-2025-3248 Exploit Tool Overview This tool exploits the critical Remote Code Execution RCE vulnerability CVE-2025-3248 found in Langflow versions prior to 1.3.0. The vulnerability exists in the /api/v1/validate/code endpoint which improperly executes user-supplied code without...

CVE-2024-2389

Progress Kemp Flowmon CVE-2024-2389 Description This repository contains a Python script to exploit a vulnerability in Flowmon that allows for gaining a reverse shell on the target system. The exploit leverages a flaw in the service.pdfs/confluence endpoint to execute arbitrary commands on the...

CVE-2025-24801

CVE-2025-24801 PoC for GLPI RCE This repository contains a proof-of-concept script poc.py that exploits CVE-2025-24801, an LFI-to-RCE vulnerability in GLPI 10.0.17. It automates: Logging into GLPI Enabling .php uploads by updating document type settings Uploading a PHP reverse shell via the AJAX...

CVE-2026-8380

CVE-2026-8380 CVE-2026-8380 — Frontend File Manager = 23.6 Arbitrary Post Deletion Overview A critical authorization flaw was identified in the WordPress plugin Frontend File Manager nmedia-user-file-uploader affecting versions = 23.6. The vulnerability allows authenticated users with low...

CVE-2026-33712

CVE-2026-33712 - Typebot Unauthenticated SSRF Description Typebot = 3.15.2 fixed in 3.16.0 contains an unauthenticated Server-Side Request Forgery SSRF vulnerability in the preview chat endpoint. Endpoint: POST /api/v1/typebots/typebotId/preview/startChat The preview endpoint accepts a...

CVE-2023-50564

CVE-2023-50564 📌 Description This exploit allows an authenticated admin in Pluck CMS v4.7.18 to upload a malicious ZIP module containing a PHP shell, resulting in remote code execution RCE. ⚙️ Features Authenticates to the target using a valid username and password Automatically creates a ZIP...

JSONBee

JSONBee A ready to use JSONP endpoints to help bypass content security policy of different websites. The tool was presented during HackIT 2018 in Kiev. The presentation can be found here not sure why format of the slides is screwed :D:...