UsoDllLoader

UsoDllLoader ⚠️ 2020-06-06 Update: this trick no longer works on the latest builds of Windows 10 Insider Preview. This means that, although it still works on the mainstream version of Windows 10 , you should expect it to be patched in the coming months. Description This PoC shows a technique that...

mitm6

mitm6 mitm6 es una herramienta de pentesting que explota la configuración predeterminada de Windows para tomar el control del servidor DNS predeterminado. Lo hace respondiendo a mensajes DHCPv6, proporcionando a las víctimas una dirección IPv6 de enlace local y estableciendo el host del atacante...

CVE-2022-0155-PoC

CVE-2022-0155 Proof-of-Concept PoC This repository contains a demonstration of the CVE-2022-0155 vulnerability. The vulnerability was detected by ranjit-git and is described in detail here. The purpose of this PoC is to demonstrate that the vulnerability doesn't just apply to scenarios where...

CVE-2019-0887

CVE-2019-0887 Compile the CVE-2019-0887, rename to winhlp.dll Compile the InstallHook, rename to hook.exe be careful, they must be compile with x64 Put then into the evil system just like that c:\windows\hook.exe c:\windows\winhlp.dll c:\windows\winhlp64.exe something evil if somebody want to...

wptsextensions.dll

WptsExtensions.dll for exploiting Task Scheduler DLL Hijacking "won't fix " Load x64 visual studio environnement variables: "C:\Program Files x86\Microsoft Visual Studio\2019\Community\VC\Auxiliary\Build\vcvars64.bat" Update the TCHAR script variable with a writable SYSTEM path where the DLL will...

CdpSvcLPE

CdpSvcLPE Windows Local Privilege Escalation via CdpSvc service Writeable SYSTEM path Dll Hijacking Short Description: Connected Devices Platform Service or CDPSvc is a service which runs as NT AUTHORITY\LOCAL SERVICE and tries to load the missing cdpsgshims.dll DLL on startup with a call to...

IDiagnosticProfileUAC

IDiagnosticProfileUAC Just another UAC bypass using auto-elevated COM object Virtual Factory for DiagCpl 12C21EA7-2EB8-4B55-9249-AC243DA8C666. This COM object can be used to create instance of DiagnosticProfile D0B7E02C-E1A3-11DC-81FF-001185AE5E76 COM object which exposes SaveDirectoryAsCab metho...

CVE-2025-67875

CVE-2025-67875: ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking Overview Field| Details ---|--- CVE ID| CVE-2025-67875 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products ChurchCRM/CRM Details Summary A critical privilege...

claude-code-security-audit

Claude Code Security Audit & CVE-2026-21852 Scanner A security audit and environment hardening tool for Anthropic's Claude Code agentic CLI. Scans repositories for CVE-2026-21852 pre-trust execution surfaces, hook hijacking, malicious base URL redirection, and unauthenticated token exfiltration...

btlejack

BtleJack: una navaja suiza de Bluetooth Low Energy Btlejack proporciona todo lo que necesitas para esnifar, interferir y secuestrar dispositivos Bluetooth Low Energy. Se basa en uno o más dispositivos BBC Micro:Bit que ejecutan un firmware dedicado. También es posible que quieras usar un sniffer...

LockBit-Ransomware-Analysis

🔐 LockBit Ransomware Analysis – Citrix Bleed Exploitation 📌 Overview This project presents a detailed threat intelligence and incident response analysis of the October 2023 LockBit ransomware attack targeting Boeing. The attackers exploited CVE-2023-4966 Citrix Bleed to hijack NetScaler session...

morpheus

Morpheus - herramienta automatizada de secuestro TCP/IP con ettercap Versión lanzada: v2.2 - ESTABLE Autor: pedro ubuntu r00t-3xp10it Nombre clave: oneiroi phobetor El dios griego de los sueños mitológicos Distros compatibles: Linux Ubuntu, Kali, Debian, BackBox, Parrot OS...

Zoom-dll-hijacking

Zoom-dll-hijacking A dll hijacking vulnerability in zoom meeting 5.1.3 Affected Windows version Windows 7 or less Windows Server 2008 Any other windows system that doesn't have SHCore.dll present. Usage Copy the dbghelper.dll and SHCore.dll to following location...

CVE-2025-25461

📌 CVE-2025-25461 - Cross-Site Scripting XSS Almacenado en SeedDMS 6.0.29 📝 Descripción Existe una vulnerabilidad de Cross-Site Scripting XSS Almacenado en SeedDMS 6.0.29. Un usuario o administrador malintencionado con el permiso "Add Category" puede inyectar un payload XSS malicioso en el campo d...

CVE-2025-26202-Details

CVE-2025-26202-Details CVE-2025-26202: Cross-Site Scripting XSS in DZS Router Web Interface Description A Cross-Site Scripting XSS vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings 2.4GHz & 5GHz bands in the DZS Router Web Interface. An authenticated attacker...

CVE-2025-1094-Exploit

CVE-2025-1094: SQL Injection to RCE via WebSocket 🚀 This repository contains a proof of concept PoC exploit for CVE-2025-1094 , a vulnerability in PostgreSQL that allows an SQL Injection SQLi attack to escalate to Remote Code Execution RCE through WebSocket hijacking. Overview This exploit...

CVE-2026-108737

Versions of Traccar through 6.16.0 are vulnerable to a weak password recovery flaw due to token purpose confusion in the TokenManager component. Because the system fails to bind tokens to a specific purpose, an attacker who obtains a leaked password reset link can reuse that token to establish a ...

CVE-2025-33053_PoC

CVE-2025-33053 POC Exploit Overview The working directory in a .url file can be set to a foreign WebDAV server. When opened by a Windows client, dependencies for the executable defined in the URL field are searched for in the foreign WebDAV share. If an arbitrary executable or DLL is given the sa...

RansomLord

RansomLord NG v1.0 Anti-Ransomware exploit tool. Proof-of-concept tool that automates the creation of PE files, used to exploit ransomware pre-encryption. Updated version NG: https://github.com/malvuln/RansomLord/releases/tag/v1.0 Lang: C SHA256:...

CVE-2025-12135

WPBookit getparam'csscode'; $jscode= $request-getparam'jscode'; updateoption 'wpbcustomcodedata', 'csscode' = $csscode, 'jscode' = $jscode ; Code execution from /core/shortcodes/class-wpbookit-shortcode-abstract.php:20-27: $wpbcustomcode= getoption 'wpbcustomcodedata', 'csscode' = '', 'jscode' = ...