GHSA-65H7-9WRW-629C FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname...

FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname...

PetitPotato

PetitPotato Local privilege escalation via PetitPotam Abusing impersonate privileges. Description PetitPotam uses MS-EFSR Encrypting File System Remote, a protocol used to perform maintenance and management operations on encrypted data stored remotely and accessed over a network. There are a seri...

CVE-2023-1177-PoC-reproduce

MLflow CVE-2023-1177 - PoC & Reproduce This repository contains Proof-of-Concept PoC exploit code and instructions to reproduce the Local File Inclusion LFI vulnerability in MLflow, identified as CVE-2023-1177. Vulnerability Information: CVE ID: CVE-2023-1177 Vulnerability Type: Local File...

CVE-2025-50110

CVE-2025-50110 Cleartext Transmission of Sensitive Information in EagleEyes Lite Android Application 1. Overview Name : EagleEyesLite Version : 2.0.0 Vendor : AVTECH CWE : CWE-319: Cleartext Transmission of Sensitive Information, CWE-598: Use of GET Request Method With Sensitive Query Strings CVS...

untitledgoosetool

Untitled Goose Tool The Goose is loose. Table of Contents About Getting Started Prerequisites Requirements Installing Usage Config GUI Auth Csv Honk Messagetrace Recommended Default Workflow Recommended Workflow for UAL Call with Time Bounds Considerations Known Issues Acknowledgements Contributi...

HeapCrypt

HeapCrypt Encypting the Heap while sleeping by hooking and modifying Sleep with our own function that encrypts the heap , sleeps for a moment then decrypts the heap : 16bit key xor heap encryption : 16bit key xor heap decryption : References : https://www.arashparsa.com/hook-heaps-and-live-free/...

UTopia

Introduction UTopia is a tool for automatically generating fuzz drivers from unit tests. UTopia will let developers perform fuzz testing without special knowledge about writing fuzzers. Even developers familiar with fuzzing can save significant time by generating fuzz drivers automatically. UTopi...

Shinigami

Shinigami Shinigami is an experimental tool designed to detect and unpack malware implants that are injected via process hollowing or generic packer routines. How this works The tool operates by hooking NT functions related to Process Hollowing and marking newly executable memory pages with the...

auto-repeater

AutoRepeater: Automated HTTP Request Repeating With Burp Suite tl;dr Within extender import AutoRepeater.jar Some Brief Instructions AutoRepeater will only resend requests which are changed by a defined replacement. When AutoRepeater receives a request that matches the conditions set for a given...

effective-waffle

effective-waffle yet another sleep encryption thing. also used the default github repo name for this one. TpAllocWork + TpPostWork + TpWaitForWork + TpReleaseWork to create + execute + clean the callback. The callback is some scuffed assembly that queues up a ton of rop gadgets that will pop...

yara-ttd

yara-ttd - The ultimate packer nemesis Use YARA rules on Time Travel Debugging traces 1. Demo 2. Motivations 3. Install 4. Usage 5. Upcoming features Demo A binary packed with UPX A simple binary that launches calc.exe, packed with UPX. yara-ttd finds the calc.exe string in the module memory,...

awesome-linux-attack-forensics-purplelabs

awesome-linux-attack-forensics-purplelabs This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools. Due to the fact that I have been practicing the red vs blue approach for years, the material below will allow you to see th...

Kernel-Process-Hollowing

Windows Kernel Mode Process Hollowing This project is a proof of concept of how the Process Hollowing technique works from the kernel level. Resources SSDT Hook Process Hollowing...

Exploit for CVE-2026-85706

GitLabSniper CVE-2026-85706 — GitLab CE/EE unauthenticated a...

cve-2026-3180

CVE-2026-3180 - WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection Description A Blind SQL Injection vulnerability was discovered in the WordPress Contest Gallery plugin versions 28.1.4 and earlier. The issue occurs due to unsafe use of the cglmaili parameter, where the...

CVE-2023-1454

CVE-2023-1454 CVE-2023-1454 Vulnerability Detection Script This article is for reference only. Do not use the technical materials and tools in this article to intrude into any computer system without authorization. The direct or indirect consequences and losses caused by the information provided ...

CVE-2024-49681

CVE-2024-49681 WP Sessions Time Monitoring Full Automatic = 1.0.9 - Unauthenticated SQL Injection Description: The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.9 due to insufficient escaping on the user suppli...

Exploit for Use After Free in Arm Bifrost_Gpu_Kernel_Driver

AI-assisted project. This research, exploit development, a...

JndiLookup

JndiLookup Some tool to help analyzing Apache Log4j 2 CVE-2021-44228 This tool uses the "lookup" feature from log4j-2 to test against the JNDI vulnerability. The objective is to easily run the lookup feature to normalize logs for example or to do a real testing on some payload - please be cautiou...