CaptainHook

Captain Hook What is it ? The purpose of this tool is to trace user inputs, in order to find injection points into sensitive methods like java.lang.Runtime.exec, java.sql.Statement.executeQuery, ... as well as the mutations on these inputs between the injection point and the method call. "Marks"...

AMSI-Bypass

AMSI-Bypass Lists of AMSI triggers VBA, JScript / VBScript Reference : MISC 104 - AMSI: Fonctionnement et Contournements In VBA, JScript and VBScript, AMSI uses a circular buffer to log instructions and a list of believed suspicious functions. The use of one of those blacklisted functions trigger...

CVE-2026-1937

🔴 Vulnerability Overview CVE-2026-1937 — Missing Authorization → Arbitrary Options Update → Privilege Escalation Description: The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data leading to Privilege Escalation in all versions up to an...

oxasploits

oxasploits A number of exploits written by oxagast Most of these CVEs are accreddited to oxagast as well Contact: Marshall Whittaker [email protected] CVEs and PoC code CVE-2006-3392 Webmin =1.29 remote root exploit This exploit, lifts a Webmin cookie with a directory transversal and aritrar...

CVE-2025-55182-TOOLS

CVE-2025-55182 Exploit Tool CVE-2025-55182 Comprehensive Exploitation/Detection Tool Developed byMingYi Security Lab Features Vulnerability Detection : Batch scan multiple targets for the vulnerability Path Scanning : Scan common Server Action endpoints to discover vulnerable paths Remote Code...

CVE-2025-48734

CVE-2025-48734: Apache Commons BeanUtils – enum declaringClass Information Leak & RCE Chain For educational and authorized security research purposes only. This repository provides a controlled lab environment to reproduce the CVE-2025-48734 vulnerability in Apache Commons BeanUtils and explore h...

CVE-2025-12028

1 Start a simple HTTP server to host the proof-of-concept page root@kitploit: mkdir -p /tmp/attacker && cd /tmp/attacker php -S 127.0.0.1:8000 2 Create a file /tmp/attacker/poc.html with the following contents root@kitploit: document.getElementById'x'.submit;...

home_SOC_suite

Home SOC Suite — Night's Watch A personal Security Operations Center SOC built from scratch during an Anwendungsentwicklung retraining program. This suite monitors a Windows endpoint for network anomalies, resource spikes, process execution, registry changes, Security Event Log activity, schedule...

EternalBlue-Exploit-Demonstration-MS17-010

EternalBlue Exploit Demonstration MS17-010 Cybersecurity lab demonstrating exploitation of CVE-2017-0144 EternalBlue using Metasploit against a vulnerable Windows 7 system, achieving SYSTEM-level access via Meterpreter. This project also simulates a WannaCry-style ransomware attack SAFE DEMO and...

cups-script-final-project

What it does Two-stage detection tool for CVE-2025-58060, authentication bypass vulnerability in the Common UNIX Printing System CUPS. Rather than relying on version numbers alone, the tool combines a banner-based version check with an active auth bypass probe. This helps confirming real...

GHSA-MR95-65J8-9MXP Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

Reporter: Cavan Loughran, Celvex Group Inc. Summary ------- The fix for CVE-2026-46439 3.12.2 / 4.0.3 removed the recursive re-render loop in trestle/core/commands/author/jinja.py rendertemplate, but the custom include tags in trestle/core/jinja/tags.py MDSectionInclude, MDCleanInclude still...

Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

Reporter: Cavan Loughran, Celvex Group Inc. Summary ------- The fix for CVE-2026-46439 3.12.2 / 4.0.3 removed the recursive re-render loop in trestle/core/commands/author/jinja.py rendertemplate, but the custom include tags in trestle/core/jinja/tags.py MDSectionInclude, MDCleanInclude still...

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

Summary The Cline Hub dashboard server @cline/cline-hub, launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOMSECRET is not set—the default for local 127.0.0.1 binds—isAuthorizedBrowserRequest...

GHSA-3CJ3-HQCR-G934 Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

Summary The Cline Hub dashboard server @cline/cline-hub, launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOMSECRET is not set—the default for local 127.0.0.1 binds—isAuthorizedBrowserRequest...

@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Summary The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS Access-Control-Allow-Origin: . Any network-adjacent or remote attacker can send a single...

GHSA-JMG2-RCXH-W8Q3 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Summary The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS Access-Control-Allow-Origin: . Any network-adjacent or remote attacker can send a single...

GHSA-4HQ8-GPF5-8P68 Podman: Malformed Image can trick podman run into leaking host environment variables into the container

Summary An container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk will cause podman to pass all host variables into the container. So...

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

Summary An container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk will cause podman to pass all host variables into the container. So...

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Summary DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then...

GHSA-FM8P-53WW-HF6W DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Summary DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then...