CVE-2026-126801

Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and...

offensive-azure

Collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. The current list of tools can be found below with a brief description of their functionality. ./DeviceCode/devicecodeeasymode.py Generates a code to be entered by the target user Can be used for...

CVE-2023-29489

Introductoin An exploitable reflected cross-site scripting XSS vulnerability has been discovered in certain versions of cPanel and was assigned with CVE-2023-29489. This vulnerability allows attackers to execute arbitrary JavaScript code without requiring authentication. The XSS vulnerability can...

Insta-Crawler

Insta Crawler A python script designed to generate a random instagram pictures ids and try it Screenshot...

CVE-2026-76080

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.nodeid: with @authenticationrequired: OPTIONAL — an unauthenticated internet visitor to any published trust...

CVE-2026-126766

OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/id/status request...

CVE-2024-32370

CVE-2024-32370 Vulnerability Description Issue An issue in HSC Cybersecurity HSC Mailinspector version 5.2.17-3 has been identified, allowing a remote attacker to obtain sensitive information via a crafted payload to the id parameter in the mliSystemUsers.php component. Vulnerable Component...

ibrute

UPDATE If you are concerned about cloud storage security, please read What if I was a cloud? and leave your feedback please. Thank you. The end of fun, Apple have just patched Here is appleID password bruteforce pOc. It's only p0c, so there is no MultiThreading feature Save-State-On-Exception...

Event-ID-268-Rule-Name-SOC292-Possible-PHP-Injection-Detected-CVE-2024-4577-

This repository does not have a README...

ASSAMEE

ASSAMEE ASSAMEE is a free advanced encryption tool that can be used to encrypt files and directories and store them on Anonfiles.com. It uses AES-256 encryption, which is a strong and secure encryption method. To access the encrypted files, a download ID is required to decrypt and download the da...

EUVD-2026-123671

OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/id/status request...

CVE-2026-126766

OpsTree REMS versions through 1.0.0 are affected by an improper authorization vulnerability (CWE-639) regarding incident reporting. An authenticated user can spoof a reporter's identity by supplying a client-controlled reporter field within crafted POST /api/v1/incidents or PATCH /api/v1/incident...

EUVD-2026-123670

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.nodeid: with @authenticationrequired: OPTIONAL — an unauthenticated internet visitor to any published trust...

CVE-2026-76080

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.nodeid: with @authenticationrequired: OPTIONAL — an unauthenticated internet visitor to any published trust...

CVE-2025-32432

CraftCMS CVE-2025-32432 Exploit Toolkit Exploitation tools for CraftCMS Remote Code Execution vulnerability based on SensePost research. 📁 File Description 🎯 Main Tools 1. finalpoc.py - Final optimized POC Supports information disclosure and remote code execution Automatic asset ID discovery...

Spring-Data-Mongodb-Example

Spring-Data-Mongodb-Example CVE-2022-22980 environment Build docker environment docker build -t mongo . docker run -dit -p 6666:6666 mongo PoC ➜ Spring-Data-Mongodb-Example git:main curl 0:6666/v1/user/get -d 'id=Tjava.lang.Runtime.getRuntime.exec"touch /tmp/aaaa"'...

CVE-2026-124687

In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the id and target attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event...

CVE-2021-21042

CVE-2021-21042 Inspired from https://www.zerodayinitiative.com/blog/2021/2/17/zdi-21-171-getting-information-disclosure-in-adobe-reader-through-the-id-tag...

CVE-2024-10140

CVE-2024-10140 The script exploits a SQL Injection vulnerability found in the endpoint /php/managesupplier.php?action=delete&id=32. The vulnerability allows an attacker to inject arbitrary SQL commands through the id parameter, potentially compromising the database and exposing sensitive...

CVE-2026-124687

In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the "id" and "target" attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event...