CVE-2026-94260

The Sifalo Pay WordPress plugin (versions 2.0 - 2.5.2 ) contains a vulnerability where it fails to verify ownership or authorization when handling a payment return . This flaw allows unauthenticated attackers to write arbitrary payment session metadata onto any store order and force orders awaiti...

feroxbuster

!WARNING Security Notice – Domain Impersonation The domain feroxbuster.com is NOT affiliated with this project, its maintainers, or any official feroxbuster releases. Official feroxbuster downloads are distributed ONLY through: https://github.com/epi052/feroxbuster open source...

mtkclient

Language: 🇺🇸 🇨🇳 MTKClient Just some mtk tool for exploitation, reading/writing flash and doing crazy stuff. For windows, you need to install the stock mtk port and the usbdk driver see instructions below. For linux, a patched kernel is only needed when using old kamakiri see Setup folder except for...

CVE-2023-23397

CVE-2023-23397 Patch for MS Outlook Critical Vulnerability - CVSS 9.8 3 PowerShell scripts are included in the Patch folder. If your patch management software uses an evaluation and a remediation script, use the respective files/scripts. The All In One script will evaluate the current version of...

AirWatch

AirWatch What is AirWatch? AirWatch is a simple menu bar app which helps prevent device snatching attacks. As an example, such an attack was carried out against Ross Ulbricht. An agent grabbed his device and ran, thus preventing him from rebooting it. How does it work? AirWatch monitors the curre...

CVE-2022-43110

CVE-2022-43110 Further Information Voltronic Viewpower/Pro and rebrands/derivatives The UPS management software is supposed to only allow a properly Authenticated and Authorized admin user using a web interface to configure the system. Due to CWE-425: Direct Request 'Forced Browsing' an...

CVE-2020-5148

CVE-2020-5148 Forced Authentication in the SonicWall UTM SSO Agent The SonicWall SSO Agent identifies the user behind a given IP address by probing that workstation with NetAPI the default or WMI. It does not validate the workstation before initiating the NTLM authentication, and it continues...

CVE-2026-32202

Zero-click forced authentication: viewing a folder with the crafted .lnk triggers UNC resolution during icon render, coercing the victim into an attacker-directed outbound connection that leaks and enables relay of their Net-NTLMv2 credentials. Emerged due to an incomplete patch of CVE-2026-21510...

hi_my_name_is_keyboard

Ciao, mi chiamo Keyboard Questo repository contiene script proof-of-concept per CVE-2023-45866, CVE-2024-21306 e CVE-2024-0230. Ulteriori dettagli sono disponibili nel post del blog. Proof of Concept| Descrizione ---|--- Iniezione di tasti su Android| Associa forzatamente una tastiera Bluetooth...

MAL-002

MAL-002: Force System Restart via Installed Windows MSIs Once a software is successfully installed on the system, one or more trusted MSI files will appear in the “C:\Windows\Installer” folder and may allow a low privilege user to perform “repair” and/or “modify” actions as the “NT...

dnscrypt-autoinstall

dnscrypt-autoinstall This project has been archived, see last comment in 108. A script for installing and automatically configuring DNSCrypt on Linux-based systems. Description DNSCrypt is a protocol for securing communications between a client and a DNS resolver by encrypting DNS queries and...

CVE-2020-17530

CVE-2020-17530 Quick POC for CVE-2020-17530. In Apache Struts versions 2.0.0 - 2.5.25 a forced Object Graph Navigational Language OGNL evaluation on raw user input in tag attributes may lead to remote code execution RCE. $ python CVE-2020-17530.py --help usage: CVE-2020-17530.py -h -c COMMAND -n...

CVE-2019-6203-PoC

CVE-2019-6203-PoC There is a PEAP bug in all Apple devices that would allow an attacker to force any Apple device iOS, macOS or tvOS to associate with a malicious access point. This is a PoC for CVE-2019-6203, works on iOS 12.2, macOS 10.14.4, tested on Kali Linux. You need a Wi-Fi card that...

CVE-2026-45161 wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding

wger is a free, open-source workout and fitness manager. Prior to version 2.6, the trainerlogin view in wger accepts GET requests and executes djangologin without any CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods POST/PUT/PATCH/DELETE. An attacker can...

CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-89430

The Gitea platform is vulnerable to a Server-Side Request Forgery (SSRF) and forced write vulnerability due to insufficient validation of push mirror remote addresses. The system only validates these addresses against [migrations] allow and block lists during the initial mirror creation. Because ...

CVE-2026-102779

Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task records.customaction without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply...

CVE-2026-102779 Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4

Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task records.customaction without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply...