CVE-2026-11730

Certain NETGEAR Extender models are affected by an insufficient session randomness vulnerability. A network-adjacent attacker with network access, such as valid WiFi credentials, can predict valid session identifiers. This allows the attacker to hijack an authenticated administrator session on th...

XSSight

WARNING: This page is only for education, every malicious purpose from the users that are using it, will be punished with law rules! XSSight Cross-site Scripting XSS Cross-site Scripting XSS is an attack technique that involves echoing attacker-supplied code into a user's browser instance. A...

CVE-2025-47962-POC

CVE-2025-47962-POC Reproduction process： i686-w64-mingw32-gcc -shared -o CRYPTBASE.dll poc.c -lkernel32 copy CRYPTBASE.dll "C:\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\CRYPTBASE.dll" net stop IpOverUsbSvc net start IpOverUsbSvc Explanation： IpOverUsbSvc sc.exe qc IpOverUsbSvc SERVICENAME:...

CVE-2018-8090

CVE-2018-8090 DLL Hijacking in Quickheal Total Security/ Internet Security/ Antivirus Pro Installers Affected Products: Quick Heal Total Security - 17.00 Quick Heal Internet Security - 17.00 Quick Heal AntiVirus Pro - 17.00 Affected Installers: Quick Heal Total Security 64 bit 17.00 QHTS64.exe,...

cve-2022-32223

CVE-2022-32223 Source files for generating a demonstration exploit of CVE-2022-32223: Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms. This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:...

CVE-2020-0014-Toast

CVE-2020-0014 Toast Reproduction This vulnerability allows a malicious app to intercept user operations on the screen by constructing a clickable Toast view, thereby achieving the purpose of collecting sensitive information such as user passwords. Affected versions: Android 8.0, 8.1, 9, 10 Only...

CVE-2023-22894

Unauthenticated Strapi Exploit: CVE-2023-22894 This repository contains a proof of concept PoC exploit for CVE-2023-22894, which allows unauthenticated users to leak sensitive information and hijack Strapi administrator accounts by exploiting Strapi's filtering functionality on private fields...

CVE-2020-0601-EXP

CVE-2020-0601-EXP This resource is the author's reproduction of the Microsoft signature certificate vulnerability CVE-2020-0601, implemented by combining related resources and articles. It is recommended that you read the author's blog to understand the ECC algorithm, Windows verification...

CVE-2025-61922-PoC

CVE-2025-61922 Exploit: PrestaShop Checkout Account Takeover A simple, educational proof-of-concept script demonstrating the zero-click account takeover vulnerability in the PrestaShop Checkout module CVE-2025-61922. ⚠️ Legal & Ethical Notice: Use Responsibly This tool is for educational purposes...

CVE-2025-56383-Proof-of-Concept

Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. The example method is as follows: Please note that the following demonstration uses npp.8.8.3.Installer.x64.exe to install Notepad++for testing, but in reality, any installed...

CVE-2026-41940-PoC-Exploit

CVE-2026-41940 - cPanel/WHM Authentication Bypass Exploit cPanel & WHM Edition - CRLF Injection to Authentication Bypass & Full Session Hijacking Overview This exploit leverages CVE-2026-41940 , a critical authentication bypass vulnerability in cPanel/WHM. By injecting a crafted CRLF payload into...

DNSHighJackMonitoring

DNS High Jack Monitoring Overview Trade craft scripts to aid with detecting DNS high jacking attempts after the disclosures in January 2019 https://www.us-cert.gov/ncas/alerts/AA19-024A https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html...

CVE-2025-55580

CVE-2025-55580 - SolidInvoice Stored Cross-Site Scripting XSS in Clients Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Client Module. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users' browsers...

React2Shell-Toolbox

React2Shell Toolbox A security testing toolkit built with Electron + Vue 3, focused on React Server Actions vulnerability detection and exploitation. 中文文档 | English Overview React2Shell Toolbox is a security testing tool designed for Next.js React Server Actions prototype pollution vulnerability...

CVE-2021-25374_Samsung-Account-Access

CVE-2021-25374 - Samsung Account Access Script This script can be used to gain access to a victim's Samsung Account if they have a specific version of Samsung Members installed on their Samsung Device, and if the victim's device is from the US or Korea region. How to use this script: 1. Host a we...

chimera

Rust-based DLL hijacking loader for MobaXterm CVE-2026-6421 with persistence...

CVE-2024-44000-LiteSpeed-Cache

Poc LiteSpeed Cache CVE-2024-44000 Exploit CVE-2024-44000 is a vulnerability in the LiteSpeed Cache plugin, a popular WordPress plugin. This vulnerability affects session management in LiteSpeed Cache, allowing attackers to gain unauthorized access to sensitive data. The script works in the...

CVE-2025-46173

CVE-2025-46173 - Stored Cross-Site Scripting XSS in Online Exam Mastering System 1.0 📌 Summary CVE-2025-46173 is a stored Cross-Site Scripting XSS vulnerability discovered in the Online Exam Mastering System 1.0 by code-projects. The vulnerability exists in the feedback.php component where user...

DriverJack

DriverJack Introduction DriverJack is a tool designed to load a vulnerable driver by abusing lesser-known NTFS techniques. These method bypass the registration of a Driver Service on the system by hijacking an existing service, and also spoof the image path presented in the Driver Load event. To...

CVE-2025-55579

CVE-2025-55579 - SolidInvoice Stored Cross-Site Scripting XSS in Tax Rates Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Tax Rates Feature. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users'...