-Netdata-PrivEsc-CVE-2024-32019

CVE-2024-32019-Netdata-ndsudo-PrivEsc CVE-2024-32019: Netdata ndsudo PrivEsc HTB Editor Automated Bash script to exploit the PATH Hijacking vulnerability in Netdata's SUID ndsudo binary CVE-2024-32019. This exploit was specifically adapted to overcome common restrictions found in hardened...

CVE-2025-46173

CVE-2025-46173 - Stored Cross-Site Scripting XSS in Online Exam Mastering System 1.0 📌 Summary CVE-2025-46173 is a stored Cross-Site Scripting XSS vulnerability discovered in the Online Exam Mastering System 1.0 by code-projects. The vulnerability exists in the feedback.php component where user...

killcast

Manipulate Chromecast Devices in your Network Available in Inspiration - Thousands of Google Chromecast Devices Hijacked to Promote PewDiePie This tool is a Proof of Concept and is for Research Purposes Only, killcast shows how Chromecast devices can be easily manipulated and hijacked by anyone...

Adaptive_Greedy_Local_Search

Adaptive Greedy Local Search AGLS Semantic-Preserving Prompt Hijacking: A Black-Box Adversarial Attack on Auto-Prompt Optimization ICME 2026 Abstract: Large Language Models LLMs are increasingly equipped with automatic prompt-optimization modules that rewrite the user’s input and explicitly prese...

CVE-2025-25747-HotelDruid-3-0-7-Reflected-XSS

CVE-2025-25747 - Reflected XSS Vulnerability in HotelDruid 3.0.7 Description Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristinabackup parameter in the creabackup.php endpoint Severi...

CVE-2026-12704 CVE-2026-12704 CVE Record

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and ga...

CVE-2026-36669-FengOffice

Security Advisory: CVE-2026-36669 Unauthenticated Arbitrary File Upload in Feng Office Community Edition An unauthenticated arbitrary file upload vulnerability exists in ckuploadhandler.php in Feng Office Community Edition version 3.11.13.11. This flaw allows remote, unauthenticated attackers to...

CVE-2022-45436

CVE-2022-45436 Reflected Cross Site Scripting leading to session hijacking in pandorafms Exploit Title: Reflected Cross Site Scripting Date: 15/02/2023 Exploit Author: Damodar Naik Vendor Homepage: https://pandorafms.com/en/ Software Link: https://github.com/pandorafms/pandorafms Version: = v765 ...

autogpt-CVE-2026-30950-poc

AutoGPT CVE-2026-30950 POC Proof-of-concept demonstration for CVE-2026-30950, an authenticated IDOR Missing Authorization in the AutoGPT Platform that lets any logged-in user reassign — and thus hijack — any other user's chat session via a single PATCH request, with no prior access to the session...

POC-of-CVE-2022-36271

POC-of-CVE-2022-36271 The name of an affected Product : Outbyte PC Repair Installation File The affected version : 1.7.112.7856 The CVE ID for the entry : CVE-2022-36271 Description: iertutil.dll is missing so an attacker can use a malicious dll with same name and can get a admin privileges and...

-Linux-PrivEsc-CVE-2024-48990

Privesc-need-restart-2024-48990 Exploit Explanation CVE-2024-48990 - Pure Python This script exploits the CVE-2024-48990 vulnerability in the needrestart Linux utility through library path hijacking PYTHONPATH hijacking. Unlike the original vector, this method uses exclusively Python, bypassing t...

CVE-2017-8464-exp-generator

CVE-2017-8464-exp-generator this tool can generate a exp for cve-2017-8486, it is developed by python Usage: CVE-2017-8464.py dllname then there will generate 26 files name as A.lnk,B.lnk,....,Z.lnk then you just need to put the dll file into any of the disk A:/,B:/,....,Z:/ for example, if you p...

immich-exfiltration-demo

Cybersecurity demo: Immich exfiltration CVE-2026-35455 Proof-of-concept cybersecurity demo for CVE-2026-35455, showcasing automated API key generation and data exfiltration leading to full account hijacking and persistent unauthorized access. Learn more: report, video...

CVE-2025-68461

CVE-2025-68461 Scanner A C++ security scanner tool to detect Cross-Site Scripting XSS vulnerabilities in Roundcube Webmail installations. Impact Unauthorized access to user accounts Session hijacking Data exposure Unauthorized actions on behalf of users Affected Versions The scanner checks for th...

Analysis

Detection Engineering Notes and Analysis This repository documents hands on detection research based on lab testing, log analysis, and real SOC workflows. The focus is on how attacker techniques actually appear in logs, what detection logic works in practice, what fails, and where false positives...

CVE-2025-29015

CVE-2025-29015 - Internet Banking System 2.0.0 Stored XSS in pagesaccount.php Description A Stored Cross-Site Scripting XSS vulnerability exists in Code Astro Internet Banking System 2.0.0 via the name parameter in /admin/pagesaccount.php. Malicious JavaScript code can be injected and stored in t...

CVE-2026-41940-PoC-Exploit

🚀 CVE-2026-41940 - cPanel/WHM Authentication Bypass Exploit cPanel & WHM Edition - CRLF Injection to Authentication Bypass & Full Session Hijacking 📌 Overview This exploit leverages CVE-2026-41940 , a critical authentication bypass vulnerability in cPanel/WHM. By injecting a crafted CRLF payload...

CVE-2023-6401

CVE-2023-6401 · DLL Hijacking Proof-of-Concept English | 中文 中文 ⚠️ 重要聲明：僅供安全研究和教育目的使用 NotePad++ ≤ 8.1 DLL劫持漏洞的概念驗證。通過在應用程式目錄放置惡意 dbghelp.dll 來執行任意程式碼。 快速開始 root@kitploit: 下載專案 git clone https://github.com/mekitoci/CVE-2023-6401.git 進入專案目錄 cd CVE-2023-6401-main 編譯DLL gcc -shared -o dbghelp.dll...

urlcrazy

😜⌨ URLCrazy URLCrazy は、ドメインのタイポやバリエーションを生成・テストし、タイポスクワッティング、URL ハイジャック、フィッシング、企業スパイを検出または実行するための OSINT ツールです。 ホームページ: https://github.com/urbanadventurer/urlcrazy 🌟 使用例 自ドメイン名のタイポを利用して利益を得るタイポスクワッターを検出する 人気のあるタイポを登録してブランドを保護する 別のドメイン宛てのトラフィックを受信するタイポドメイン名を特定する ペネトレーションテスト中にフィッシング攻撃を実施する ⭐ 機能 17...

CVE-2025-61922-PoC

CVE-2025-61922 Exploit: PrestaShop Checkout Account Takeover A simple, educational proof-of-concept script demonstrating the zero-click account takeover vulnerability in the PrestaShop Checkout module CVE-2025-61922. ⚠️ Legal & Ethical Notice: Use Responsibly This tool is for educational purposes...