EXPLOIT-CVE-2026-26216

CVE-2026-26216 — Crawl4AI unauthenticated RCE via hooks GHSA-5882-5rx9-xgxp CVSS 10.0 · pre-auth RCE · CWE-94 Code Injection Unauthenticated remote code execution on the Crawl4AI Docker server field. This code is executed with exec inside a "homemade sandbox" — a restricted builtins dictionary...

Exploit for CVE-2026-19598

CVE-2026-19598 — Pods WordPress Plugin Unauthenticated Privile...

CVE-2021-26837

CVE-2021-26837 SQL Injection in HelpSystems / Fortra DeliverNow The SearchTextbox parameter on DeliverNow's log search page /LogGrid.aspx is concatenated directly into a SQL Server query with no parameterisation and no server-side validation. The application also rendered the resulting SQL Server...

Malicious code in puppeteer-obscura (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5617ac5e060d08fcfe23669c497e6b4fbb8587fd7f7630a7b9f6e86287880983 On npm install, the package's postinstall hook node dist/install.js downloads a platform-specific binary from...

MAL-2026-16001 Malicious code in puppeteer-obscura (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5617ac5e060d08fcfe23669c497e6b4fbb8587fd7f7630a7b9f6e86287880983 On npm install, the package's postinstall hook node dist/install.js downloads a platform-specific binary from...

CVE-2022-42889-text4shell

CVE-2022-42889-text4shell Description This script is a penetration testing tool designed to exploit the CVE-2022-42889 vulnerability, also known as Text4Shell, within Apache Commons Text versions -param $PARAMETER -L $LHOST -P $LPORT...

CVE-2025-63943

CVE-2025-63943 — SQL Injection in Grocery Store Management System 1.0 Overview A high-severity SQL Injection vulnerability was identified in the searchproducts.php component of Grocery Store Management System 1.0 , a PHP/MySQL-based web application created by anirudhkannan. The issue arises from...

node9-proxy v2.8.3

🛡️ Node9 What did your AI agent actually do? Find out. Node9 sits between your AI agent and the tools it can use — discover what it's already been doing, protect against risky actions in real time, and review what happened over any time window. Works with Claude Code · Codex CLI · Antigravity agy ...

Wordpress-ebook-CVE-2016-10924

Wordpress eBook Download 1.1 plugin has a file disclosure vulnerability by abusing it's get parameter in the filedownload.php file. This script brute forces different processes on the server using this vulnerability. USAGE: python pidbrute.py...

CVE-2024-13513.py

Usage Basic Usage bash python3 exploit.py -l targets.txt -e [email protected] Advanced Usage bash python3 exploit.py -l targets.txt -e [email protected] -t 100 -o /path/to/results Parameters Explanation Parameter Description Required Default -l, --list Path to file containing target URL...

CVE-2021-1732

CVE-2021-1732 La vulnerabilidad ocurre en el controlador gráfico de Windows win32kfull!NtUserCreateWindowEx, donde una llamada de retorno del kernel al modo usuario para asignar memoria y la configuración del atributo tagWND-flag están desincronizadas, lo que permite falsificar el valor de...

pySigma-backend-opensearch

pySigma OpenSearch Backend This is the OpenSearch backend for pySigma. It provides the package sigma.backends.opensearch with two backend classes: OpensearchLuceneBackend - Converts Sigma rules to Lucene query syntax OpenSearchPPLBackend - Converts Sigma rules to PPL Piped Processing Language...

CVE-2024-54916

CVE-2024-54916: Omisión de Autenticación en Telegram APK Un problema en la clase SharedConfig de Telegram Android APK v.11.7.0 permite a un atacante físicamente cercano omitir la autenticación y escalar privilegios manipulando el valor de retorno del método checkPasscode. Tipo de Vulnerabilidad...

trustmebro

Bypass llm guardrails by confusing it with fabricated tool output. Results · Installation · Quick start · Rules · Architecture TrustMeBro intercepts command-line tools invoked by coding agents such as Codex, Claude Code, and pi. Rules decide whether to return fabricated output, modify the real...

CVE-2025-67888

CVE-2025-67888 Control Web Panel = 0.9.8.1208 admin/index.php OS Command Injection Vulnerability Affected Versions: Version 0.9.8.1208 and prior versions. Vulnerability Description: User input passed via the "key" GET parameter to /admin/index.php when the "api" parameter is set is not properly...

PoC-for-ME-SAML-Vulnerability

PoC-for-ME-SAML-Vulnerability PoC for cve-2022-47966 To test, send it to /SamlResponseServlet as POST Request. Base64 encode it and give it as value to SAMLResponse Parameter and send. Format POST /SamlResponseServlet HTTP/1.0 Host: SAMLResponse=&RelayState=...

mysqli

MySQLi.py - Time-Based Blind SQL Injection for MySQL MySQLi.py is a personal practice project, inspired by Exploit-DB exploit 46635, used during the SimpleCTF room on TryHackMe. What caught my attention in the original exploit was its ability to extract credentials and even crack the password has...

CVE-2026-15981

CVE-2026-15981 SAML Single Sign On = 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter CVE-2026-15981 SAML Single Sign On ≤ 5.4.4 — Unauthenticated Authentication Bypass Proof-of-Concept Exploit Malformed Signature → opensslverify returns -1 → PHP loose cast to true →...

CVE-2025-9435

ADManager Plus Build 7230 Elevation of Privilege CVE-2025-9435 Requirements A technician user with the 'Modify user general properties' role and logon access to the server where ADManager is installed. Description If the technician user has logon rights on the server , they can escalate privilege...

firefox-devtools-mcp v0.10.2

Firefox DevTools MCP Model Context Protocol server for automating Firefox via WebDriver BiDi through Selenium WebDriver. Works with Claude Code, Claude Desktop, Cursor, Cline and other MCP clients. Repository: https://github.com/mozilla/firefox-devtools-mcp Note : This MCP server requires a local...