CVE-2020-11579

CVE-2020-11579 Introduction PHPKB 9.0 Enterprise Edition MySQL database is affected by an unauthenticated arbitrary file disclosure via a malicious MySQL Server. A remote attacker can read any file on a remote victim host with web-server privileges e.g. www-data, via a single HTTP GET request. Re...

Weblogic_Vuln

Preface This article provides a detailed analysis of historical Weblogic vulnerabilities from CVE-2015 to CVE-2019, and organizes related POCs in WeblogicVuln. It records learning notes on Java deserialization vulnerabilities. Welcome to star and issue. WeblogicVuln POCs for CVE-2015-4852,...

cpanel-cve-41940-detector

Detector de IOC de cPanel para CVE-2026-41940 Detector de IOC de solo lectura para servidores cPanel/WHM que puedan haber sido afectados por CVE-2026-41940 y actividad posterior al compromiso relacionada. El script ayuda a un operador a revisar indicadores de ransomware .sorry, rastros de backdoo...

CVE-2007-2447

CVE-2007-2447 PoC: Samba "usermap script" remote command-execution historical CVE. This repository contains a small proof-of-concept script for research and educational review. The primary script is usermapscriptCommandExecution.py. Reference writeup:...

Addon

ClearURLs ClearURLs es un complemento basado en la nueva tecnología WebExtensions y está optimizado para Firefox y algunos navegadores basados en Chrome. Esta extensión eliminará automáticamente los elementos de seguimiento de las URL para ayudar a proteger tu privacidad al navegar por Internet, ...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.99 security and extras update

Red Hat OpenShift Container Platform release 4.12.99 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a security impact of Low...

ManticoreUI

============ Manticore UI .. image:: https://raw.githubusercontent.com/trailofbits/manticore/master/docs/images/manticore.png :width: 200px :align: center :alt: Manticore The Manticore User Interface MUI project provides a graphical user interface plugin for different disassemblers that allows...

CVE-2018-11776-Python-PoC

CVE-2018-11776-Python-PoC hook-s3c github.com/hook-s3c, @hooks3c on twitter Working Python test and PoC for CVE-2018-11776, originally appearing on; https://github.com/hook-s3c/CVE-2018-11776-Python-PoC What's going on? Man Yue Mo from Semmle has disclosed an Struts2 RCE vulnerability, delivered ...

CVE-2026-103686 rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

EUVD-2026-90847

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-103686 rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-103686

The rhukster dom-sanitizer library (up to version 1.0.15 ) is vulnerable to Cross-Site Scripting (XSS) due to a flaw in the URL Validation component. Specifically, the DOMSanitizer::isDangerousUrl function in src/DOMSanitizer.php can be manipulated to allow malicious scripts. This vulnerability c...

twittor

Twittor A stealthy Python based backdoor that uses Twitter Direct Messages as a command and control server This project has been inspired by Gcat which does the same but using a Gmail account. Setup For this to work you need: A Twitter account Use a dedicated account! Do not use your personal one...

CVE-2021-27403

UNAUTHENTICATED Cross-Site Scripting - Askey Internet Fiber Modem Vendor: Askey Software Version: BRSVg11.11RTFTEF001V6.54V014 Model: RTF8115VW Vulnerable Param: curWebPage Payload: ";alert'xss'// Not tested in other model/version. Via GET REQUEST At the login request we can issue a GET Request:...

spring-cloud-netflix-hystrix-dashboard-cve-2021-22053

CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability Severity High Vendor Spring by VMware Description Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI...

deep-pwning

Deep-pwning is a lightweight framework for experimenting with machine learning models with the goal of evaluating their robustness against a motivated adversary. Note that deep-pwning in its current state is no where close to maturity or completion. It is meant to be experimented with, expanded...

tornado

tornado anonymously reverse shell over onion network using hidden services without portfortwarding Explore the docs fully undetectable reverse shell · View Demo · bulletproof anonymity Table of Contents 1. What is tornado? 2. Built With 3. Getting Started Installation 4. Usage 5. Roadmap 6...

wshlient

Wshlient Web Shell Client Description & Demo Wshlient is a web shell client designed to be pretty simple yet versatile. One just need to create a text file containing an HTTP request and inform where Wshlient inject the commands, then you can enjoy a shell...

patchy

Patchy Automated lateral movement and persistence by abusing GCP OS patch management based on my blog post. Patchy is made up of two main modes, lateral movement, and persistence. Persistence uses valid service account credentials to create a patch job or deployment. Lateral movement attempts to...

yersinia

Spanning Tree 1: DOS attack sending conf BPDUs Let's send some conf BPDUs claiming be root!!! By sending continously conf BPDU with root pathcost 0, randomly generated bridge id and therefore the same root id, and some default values for other fields, we try to annoy the switches close to us,...