CVE-2026-106630

Adobe Experience Manager is impacted by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by injecting malicious scripts into vulnerable form fields . When a victim visits a page containing these fields, the malicious JavaScript may execute in their browser,...

CVE-2021-33699_Task_Hijacking

CVE-2021-33699TaskHijacking What is it? An attacker app and a victim app to practice the CVE-2021-33699Task Hijacking vulnerability. Reference https://naro-security.tistory.com/55...

CVE-2017-8464-exp-generator

CVE-2017-8464-exp-generator this tool can generate a exp for cve-2017-8486, it is developed by python Usage: CVE-2017-8464.py dllname then there will generate 26 files name as A.lnk,B.lnk,....,Z.lnk then you just need to put the dll file into any of the disk A:/,B:/,....,Z:/ for example, if you p...

CVE-2019-10008

CVE-2019-10008 ManageEngine Service Desk Plus 9.3 Privilaged account Hijacking Date: 30-03-2019 Exploit Author: Ata Hakçıl, Melih Kaan Yıldız Vendor: ManageEngine Vendor Homepage:www.manageengine.com Product: Service Desk Plus Version: 10.0 Tested On: Windows 10 64 bit CVE : 2019-10008 Complete P...

POC-of-CVE-2022-36271

POC-of-CVE-2022-36271 The name of an affected Product : Outbyte PC Repair Installation File The affected version : 1.7.112.7856 The CVE ID for the entry : CVE-2022-36271 Description: iertutil.dll is missing so an attacker can use a malicious dll with same name and can get a admin privileges and...

Enumprotections_BOF

Enumprotections BOF This BOF can be used to enumerate system processes and identify the protection level of each one. Additional information, like service relation, user, session, and path, are also returned. This information in combination can be used to identify good candidates to explore for...

CVE-2020-0001

CVE-2020-0001 POC to run system component in an untrusted-app process Blog https://zachinio.com/blogs/cve-2020-0001 How to use Run the app, make sure the process "com.android.settings" does not exist, and click the "start service" button. Launch the settings app or wait for a system component to...

aapanel-ws-bypass

aaPanel: Vendors Don't Always Fix Things Properly An incomplete fix for CVE-2021-37840 still exposes 3.6M servers to root RCE, 5 years later Discovered by: EON Security CVE: Pending assignment CVSS: 8.8 High — AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected: aaPanel versions 6.8.12 through 7.65.0...

CVE-2026-82416

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVEPHPSESSION at compile time. In this build configuration,...

CVE-2026-82416

FrankenPHP versions prior to 1.12.5 are vulnerable to a cross-request PHP session ID leak in worker mode. The root cause occurs when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time, causing frankenphp_reset_session_state() to be omitt...

CVE-2026-82416 FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVEPHPSESSION at compile time. In this build configuration,...

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes...

CVE-2024-34324

An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NETSessionId cookie...

poc-cribl-rce

Disclaimer This is for informational/educational purposes only. This was put together to demonstrate an insecurity in the tool, in order for a fix to be verified by the vendor. Info Tested on Cribl v1.5.0 - Previous versions not tested but likely vulnerable. A valid JWT token can be transfered fr...

CVE-2024-48990-Exploit

CVE-2024-48990 Exploit My full writeup for how I came to re-discovering this N-day and creating my own exploit for it can be found on my blog. Essentially, you can git clone this repository into an attacker-controlled directory, export PYTHONPATH=, and then run main.py with that PYTHONPATH value...

CVE-2022-43144-Stored-XSS

CVE-2022-43144 : Stored-XSS Description A cross-site scripting XSS vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Impact Allowing an attacker to hijack the user's session and take over the account. To exploit this...

Notepad-8.8.1_CVE-2025-49144

CVE-2025-49144 – Exploit for Notepad++ 8.8.1 This repository contains a functional Proof of Concept PoC that exploits the CVE-2025-49144 vulnerability in the Notepad++ 8.8.1 installer. The malicious execution occurs by placing a binary regsvr32.exe in the same directory as the vulnerable installe...

CVE-2023-34312-exp

Disclaimer This project is created only for reproduction experiments. Affected Versions QQ 9.6.2.27855 9.7.11.29088 except QQ 9.7.10, because it does not come with QQProtect.exe apparently TIM 3.4.5.22071 3.4.7.22084 Usage After installing QQ/TIM, place the two malicious DLLs in the same folder a...

CVE-2024-44000

EN GenCookieSessionHijack is a PoC tool designed to exploit insecurely exposed debug logs from WordPress sites and extract session cookies. This allows the attacker to hijack active admin sessions and gain unauthorized access to the WordPress admin dashboard. Features Extract cookies from WordPre...

CVE-2025-34077

CVE-2025-34077 — WordPress Pie Register ≤ 3.7.1.4 - Admin Privilege Escalation Unauthenticated 💀 Author Mrj Haxcore 🧠 Vulnerability Summary The Pie Register plugin for WordPress version ≤ 3.7.1.4 exposes an unauthenticated endpoint that allows an attacker to hijack admin sessions simply by POSTin...