CVE-2026-16475-PoC

CVE-2026-16475 - OCSinventory LFI PoC Local File Inclusion vulnerability in OCSinventory 2.12.4 Vulnerability Details CVE ID: CVE-2026-16475 CVSS Score: 6.9 Medium CWE: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program Affected Version: OCSinventory 2.12.4 Status:...

SecOPD

SecOPD: Mitigating Adaptive Prompt Injections by On-Policy Distillation Yibo Peng · Long Lian · David Wagner† · Sizhe Chen† † Joint supervision. Paper Project page Model This release implements the paper's final full-response KL formulation, also described as the no-parsing variant. The student...

CVE-2019-17662

CVE-2019-17662 Modified the CVE code Used Prepared Requests, as in python3 requests module normalize the ../ in URL such as: For code: r = requests.get"http://123.123.123.123/../../../../../../test" printstrr.statuscode Results in: GET /test HTTP/1.1 Host: 123.123.123.123 Connection: close...

fb-phisher-python

Facebook Phishing Original Author : Arslan Mughal BY : arjunindia original repository : https://github.com/arslanmughal5566/facebookphishing About Script : With this script you can perform Facebook login credentials stealing with some social engineering skills. requirements : 1 : Python3.x 2 :...

CVE-2018-20250

exp for Extracting Code Execution From Winrar poc by Ridter how to use ? you just need to install python 3.7, and prepare a evil file you want to run, set the values you want, this exp script will generate the evil archive file automatically! 1. set the values you want ... ... The archive filenam...

SecureCodingDojo

About the Secure Coding Dojo The Secure Coding Dojo is a platform for delivering secure coding training. While it comes with its own vulnerable training application the Insecure.Inc website the training portal can be used in conjunction with other training applications. The strength of the platfo...

zipbrk

zipbrk 2.2.0 Zip break is a tool to disect, modify, and reassemble zip files for a variety of tasks. It is designed to be cross-platform and as simple as possible to port between varied systems. It has been tested on Windows 9x/2k/XP, Windows Vista/7/8, Fedora 23/24/25/26/27, Kali, Debian 8/9,...

copy-fail-CVE-2026-31431-detection-probe

Linux Kernel LPE Probe Suite — Copy Fail & Dirty Frag Safe detection tooling for two related Linux kernel local privilege escalation vulnerability families — Copy Fail CVE-2026-31431 and Dirty Frag CVE-2026-43284 / CVE-2026-43500 — both affecting all major distributions since 2017, both exploitab...

CVE-2019-15107

CVE-2019-15107 CVE-2019-15107 test program This remote command execution vulnerability in webmin, roughly caused by perl's qx/…/ leading to command execution, requires certain special conditions. During reproduction, I casually wrote a graphical exploit program. It is worth noting that the user...

xnuspy

xnuspy Output from the kernel log after compiling and running example/open1hook.c xnuspy is a pongoOS module that installs a new system call, xnuspyctl, which allows you to hook kernel functions from userspace. It supports iOS 13.x, iOS 14.x, and iOS 15.x on checkra1n 0.12.2 and up. 4K devices ar...

ironcurtain

IronCurtain A secure runtime for autonomous AI agents, where security policy is derived from a human-readable constitution. When someone writes "secure," you should immediately be skeptical.What do we mean by secure? !WARNING Research Prototype. IronCurtain is an early-stage research project...

emploleaks

EmploLeaks EmploLeaks is an OSINT Open Source Intelligence tool with a CLI interface, designed to discover and correlate information about employees of a target company. It allows collecting LinkedIn profiles, generating potential corporate emails, searching for leaked credentials in leak databas...

CVE-2020-14882

Oracle WebLogic Unauthenticated RCE Exploit This PowerShell script exploits CVE-2020-14882 to achieve unauthenticated remote code execution on Oracle WebLogic Server versions: 10.3.6.0.0 12.1.3.0.0 12.2.1.3.0 12.2.1.4.0 14.1.1.0.0 Usage .\exploit.ps1 -target 'https://target:7001' -command...

CVE-2023-2640-CVE-2023-32629-Interactive-PoC

CVE-2023-2640 & CVE-2023-32629 GameOverLay - Real Host Root Escape PoC An interactive, multi-step Local Privilege Escalation LPE Proof of Concept PoC targeting the Ubuntu Linux kernel OverlayFS vulnerabilities CVE-2023-2640 / CVE-2023-32629. Unlike standard automated one-liners that trap your...

WMImplant

WMImplant WMImplant is a PowerShell based tool that leverages WMI to both perform actions against targeted machines, but also as the C2 channel for issuing commands and receiving results. WMImplant will likely require local administrator permissions on the targeted machine. Developed by...

iscsicpl_bypassUAC

iscsicpl autoelevate DLL Search Order hijacking UAC Bypass 0day The iscsicpl.exe binary is vulnerable to a DLL Search Order hijacking vulnerability when running 32bit Microsoft binary on a 64bit host via SysWOW64. The 32bit binary, will perform a search within user %Path% for the DLL iscsiexe.dll...

cacti-rce-cve-2022-46169-vulnerable-application

Cacti v1.2.22 command injection CVE-2022-46169 vulnerable application This is a vulnerable application to test the exploit for the Cacti vulnerability CVE-2022-46169. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is recommended using a backed-up...

CVE-2023-2825

CVE-2023-2825 - GitLab CE/EE 16.0.0 Arbitrary File Read via Path Traversal On May 23, 2023 GitLab released version 16.0.1 which fixed a critical vulnerability, CVE-2023-2825, affecting the Community Edition CE and Enterprise Edition EE version 16.0.0. The vulnerability allows unauthenticated user...

CVE-2025-49132

🛡️ Pterodactyl Panel Vulnerability Checker & Exploit Tool ✨ About A Python script that automates the discovery and exploitation of vulnerabilities in misconfigured Pterodactyl panels. 🔍 Discovers exposure of sensitive configuration locale.json file. 🔑 Extracts MySQL database credentials. 👑...

CVE-2024-52301

CVE-2024-52301 POC This vulnerability is based on the CVE-2024-50340 vulnerability Requirements The registerargcargv option must be enabled in the PHP configuration file php.ini. This setting loads command-line arguments and query params into $SERVER'argv'...