2873457 matches found
padre
padre padre is an advanced exploiter for Padding Oracle attacks against CBC mode encryption Features: blazing fast, concurrent implementation decryption of tokens encryption of arbitrary data automatic fingerprinting of padding oracles automatic detection of cipher block length HINTS! if failure...
toothfairy
toothfairy Related to brokentooth linked below. Unlike brokentooth, toothfairy does not require pressing buttons on the bluetooth menu. Both CVE's were revealed by @SparkZheng but with no POC so I decided to make a POC for the learning experience. The code is not perfect but it does the job. Test...
maltrail
Maltrail Maltrail is a network traffic detection system that identifies communication with known malicious infrastructure and reports selected traffic anomalies. It matches domains, URLs, IP addresses, IP:port pairs, and User-Agent values observed on the network against a set of indicators called...
CVE-2019-19576
class.upload.php = 2.0.3 Arbitrary file upload Author - Jinny Ramsmark Affected vendor - Verot.net Affected product - class.upload.php = 2.0.3 Tested on newly installed Ubuntu 19.10 with PHP7.3 and Apache/2.4.38 Specifically Debian/Ubuntu has been found to be vulnerable since they add the php,...
commix
English • Ελληνικά • Español • Français • فارسی • Bahasa Indonesia • Türkçe Commix short for command injection exploiter is an open source penetration testing tool, written by Anastasios Stasinopoulos @ancst, that automates the detection and exploitation of command and code injection...
azure-sentinel-detection-engineering
Azure Sentinel Detection Engineering Detection engineering on a live Microsoft Sentinel and Defender XDR environment I operate. Nine custom analytics rules span three planes, each mapped to MITRE ATT&CK and proven end to end: a controlled action triggers the rule, the rule raises an incident, and...
cve-2022-22980
spring-data-mongodb-cve-2022-22980-exp A mediocre vulnerability, just making a note. 1. Start Redis, port 27017 2. Start the project, SpringBoot starts on port 6666 3. GET /v1/user/get?username=Tjava.lang.Runtime.getRuntime.exec'open+-a+calculator.app' HTTP/1.1 Host: localhost:6666 Accept-Encodin...
CVE-2023-1454
CVE-2023-1454 jmreport/qurestSql Unauthorized SQL Injection Batch Scan POC Jeecg-Boot is a rapid development platform based on Spring Boot and Jeecg-Boot-Plus. The latest jeecg-boot 3.5.0 has been exposed to multiple SQL injection vulnerabilities. Description Original tool URL The original tool h...
cve-2015-3456
Experiments related to CVE-2015-3456 There is: exploit/ is an "exploit" it just crashes QEMU. mock/ contains a stripped down version of QEMU. Only the vulnerability remains. patch/ contains a program to patch a running instance of QEMU. The main point is to not need debug symbols, nor the origina...
CVE-2020-13405
CVE-2020-13405 Base Score: 7.5 HIGH🟥 MicroWeber is an open-source Content Management System CMS written in PHP. It allows web administrators to easily build a website by dragging and dropping components where they want them to be. It is a popular choice among those looking to start a website that...
CVE-2023-27587-PoC
CVE-2023-27587-PoC The simple PoC of CVE-2023-27587 What is ReadToMyShoe? ReadtoMyShoe RTMS is a web application rust, yew and axum that lets you upload articles via URL or via directly pasting and listen to them later. Impact If an error occurs when adding an article, the website shows the user ...
nono
Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. nono is a complete agent...
TomcatKiller-CVE-2025-31650
TomcatKiller-CVE-2025-31650 A tool designed to detect the vulnerability CVE-2025-31650 in Apache Tomcat versions 10.1.10 to 10.1.39 This vulnerability allows an attacker to trigger a memory leak by sending specially crafted HTTP/2 requests with invalid priority headers, leading to a...
CVE-2018-11776-Python-PoC
CVE-2018-11776-Python-PoC hook-s3c github.com/hook-s3c, @hooks3c on twitter Working Python test and PoC for CVE-2018-11776, originally appearing on; https://github.com/hook-s3c/CVE-2018-11776-Python-PoC What's going on? Man Yue Mo from Semmle has disclosed an Struts2 RCE vulnerability, delivered ...
PadBuster
PadBuster - Automated script for performing Padding Oracle attacks Author: Brian Holyfield - Gotham Digital Science [email protected] Credits to J.Rizzo and T.Duong for providing proof of concept web exploit techniques and S.Vaudenay for initial discovery of the attack. Credits also to James...
FortiWeb-CVE-2025-52970-Authentication-Bypass
🚨 FortiWeb Authentication Bypass → Remote Code Execution 📌 Overview This repository demonstrates an authentication bypass in FortiWeb that can be chained to achieve Remote Code Execution RCE. The exploit leverages a vulnerable endpoint to inject SQL payloads, upload a webshell, and execute comman...
CVE-2021-3019
CVE-2021-3019 CVE-2021-3019 lanproxy directory traversal arbitrary file reading vulnerability Usage Download git clone https://github.com/FanqXu/CVE-2021-3019.git cd CVE-2021-3019 Help Run without parameters to display help information Single URL Detect vulnerabilities on a single URL. If a...
kviklet
Kviklet Kviklet.dev | Release Notes | Discord Secure access to production environments without impairing developer productivity. Kviklet pronounced Quick-let applies the Four-Eyes Principle to production database access, with a pull request-like review and approval workflow for individual SQL...
CVE-2025-55182
CVE-2025-55182 - React2Shell PoC A proof of concept exploit for CVE-2025-55182, a critical CVSS 10.0 unauthenticated remote code execution vulnerability in React Server Components. Credit Discovered byLachlan Davidson - Disclosed to Meta/React team on November 29, 2025. Vulnerability Overview The...