CVE-2026-41940-PoC-Exploit

🚀 CVE-2026-41940 - Exploit de Bypass de Autenticación en cPanel/WHM Edición cPanel & WHM - Inyección CRLF para Bypass de Autenticación y Secuestro Total de Sesión 📌 Descripción general Este exploit aprovecha CVE-2026-41940 , una vulnerabilidad crítica de bypass de autenticación en cPanel/WHM. Al...

React2Shell-Toolbox

React2Shell Toolbox 一个基于 Electron + Vue 3 的安全测试工具箱，专注于 React Server Actions 漏洞检测与利用。 中文文档 | English 项目简介 React2Shell Toolbox 是一款针对 Next.js React Server Actions 原型链污染漏洞（CVE-2025-55182）的安全测试工具。该工具提供了友好的图形界面，支持 POC 验证、虚拟终端交互、FOFA 资产搜索、以及高级的路由劫持功能。 应用截图 POC 验证界面 虚拟终端交互...

LiquidSnake

Liquid Snake Liquid Snake is a program aimed at performing lateral movement against Windows systems without touching the disk. The tool relies on WMI Event Subscription in order to execute a .NET assembly in memory, the .NET assembly will listen for a shellcode on a named pipe and then execute it...

CVE-2022-3368

CVE-2022-3368 PoC for arbitrary file move vulnerability in Software Update component of Avira Security. Users have option to use this feature to update any outdated software on their PC ,when this feature is used Avira Security service will drop downloaded files in...

killcast

Manipulate Chromecast Devices in your Network Available in Inspiration - Thousands of Google Chromecast Devices Hijacked to Promote PewDiePie This tool is a Proof of Concept and is for Research Purposes Only, killcast shows how Chromecast devices can be easily manipulated and hijacked by anyone...

killcast

操控你网络中的Chromecast设备 支持以下平台 灵感来源 - 数千台谷歌Chromecast设备被劫持以推广PewDiePie 此工具为概念验证，仅用于研究目的，killcast展示了Chromecast设备如何容易被任何人操控和劫持。 功能 提取Chromecast设备信息 IP地址侦察 提取已保存的网络 扫描附近的WiFi接入点 忘记一个WiFi接入点 重命名设备 终止运行中的应用程序 重启设备 执行恢复出厂设置 待办事项 播放YouTube视频 设置壁纸 终止更多应用程序 已测试平台： BlackArch Linux Kali Linux Ubuntu Termux 安装...

CVE-2024-50962

Cross-Site Scripting XSS in DonWeb Ferozo Webmail CVE-2024-50962 Description A Cross-Site Scripting XSS vulnerability in Ferozo Webmail v1.1 allows attackers to execute arbitrary scripts via the Identities and Automatic Responses components. This vulnerability can be used to hijack user sessions,...

CVE-2026-101158

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...

RDPHijack-BOF

BOF - RDPHijack Cobalt Strike Beacon Object File BOF that uses WinStationConnect API to perform local/remote RDP session hijacking. With a valid access token / kerberos ticket e.g., golden ticket of the session owner, you will be able to hijack the session remotely without dropping any beacon/too...

CVE-2017-8464-exp-generator

CVE-2017-8464-exp-generator this tool can generate a exp for cve-2017-8486, it is developed by python Usage: CVE-2017-8464.py dllname then there will generate 26 files name as A.lnk,B.lnk,....,Z.lnk then you just need to put the dll file into any of the disk A:/,B:/,....,Z:/ for example, if you p...

SharpNoPSExec

SharpNoPSExec File less command execution for lateral movement. SharpNoPSExec will query all services and randomly pick one with a start type disable or manual, the current status stopped and with LocalSystem privileges to reuse them. Once it select the service it will save its current state,...

urlcrazy

😜⌨ URLCrazy URLCrazy is an OSINT tool to generate and test domain typos or variations to detect or perform typo squatting, URL hijacking, phishing, and corporate espionage. Homepage: https://github.com/urbanadventurer/urlcrazy 🌟 Use Cases Detect typo squatters profiting from typos on your domain...

CVE-2026-101158

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS) . Successful exploitation could enable an attacker to hijack another CloudVision user's web session , potentially resulti...

DNSHighJackMonitoring

Monitoreo de Secuestro de DNS Descripción general Scripts de trade craft para ayudar a detectar intentos de secuestro de DNS tras las revelaciones de enero de 2019 https://www.us-cert.gov/ncas/alerts/AA19-024A https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073

NetBox versions 2.9.5 before 4.7.0 are vulnerable to a server-side template injection vulnerability. A low-privileged user with the "Can add custom links" permission can exploit this by exposing the raw Django HttpRequest object to the Jinja2 template context. An attacker can craft a custom link ...

CVE2_Jenkins_RCE

Jenkins CLI Websocket Hijacking - PoC A proof of concept cross-site WebSocket hijacking exploit for CVE-2024-23898 — a vulnerability affecting Jenkins versions 2.217-2.441. This exploits targets the Jenkins CLI that can be used to remotely access and issue commands to a Jenkins control server...

CVE-2021-33699_Task_Hijacking

CVE-2021-33699TaskHijacking ¿Qué es? Una aplicación atacante y una aplicación víctima para practicar la vulnerabilidad CVE-2021-33699 Task Hijacking. Referencia https://naro-security.tistory.com/55...

CVE-2022-27502

RealVNC server up to 6.9.0 DLL Hijacking Exploit CVE-2022-27502 You can use pre-compiled version 64-bit of it from HERE Copy it to %TEMP% and initiate a repair of RealVNC Server from add or remove programs. It will write the output of whoami command in %TEMP%\output.txt If you want to change the...