JEP290_RMI_Bypass

what's this? This project is for JEP290 Bypass studying Result...

thermoptic

thermoptic "I don't believe it, thermoptic camouflage!" What is it? This is an HTTP proxy designed to bypass services that use fingerprinting such as JA4+ to block certain HTTP clients. Using this proxy, you can use your preferred HTTP clients like curl and still have magically indistinguishable...

cpanel2shell-scanner

cpanel2shell-scanner A high-fidelity scanner for the cPanel/WHM authentication bypass tracked as CVE-2026-41940. It identifies vulnerable hosts without producing the false-negatives common to public proofs-of-concept and detections, and without triggering the account lockout and root-IP-allowlist...

awesome-list

Awesome Cybersecurity List My personal collection of awesome blog posts, write-ups, and papers focusing on cybersecurity. For a deeper dive into cybersecurity-related tools, check out the dedicated Cybersecurity Tools list. Outline 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2014 2011...

cve-2016-1764

PoC Exploit Code for CVE-2016-1764 Recovery of Plaintext iMessage Data Without Breaking Crypto Authors Shubham Shah from Bishop Fox Joe DeMesy from Bishop Fox Matthew Bryant CVE-2016-1764 Vendor: Apple Release Date: April 8, 2016 Patch Date: March 21, 2016 Systems Affected: Messages on OSX Mounta...

CVE-2026-23552

CVE-2026-23552 - Cross-Realm Token Acceptance in camel-keycloak Overview Apache Camel's KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. This means a token issued by one Keycloak realm is silently accepted by a policy configured for a...

PrestaShop-CVE-2018-19126

PrestaShop Back Office Remote Code Execution CVE-2018-19126 This is the PoC for CVE-2018-19126, chaining multiple vulnerabilities in PrestaShop Back Office to trigger deserialization via phar to achieve remote code execution. Prerequisite: PrestaShop 1.6.x before 1.6.1.23 or 1.7.x before 1.7.4.4...

log4j2burpscanner

JUST FOR TESTING，DON'T ATTACK ANYONE JUST FOR TESTING，DON'T ATTACK ANYONE JUST FOR TESTING，DON'T ATTACK ANYONE 交流群 二维码失效请加微信f-f0ng、备注log4j2burpscanner交流 关注主页公众号（only security），回复log4j2burpscanner获取下载地址】 FAQ Frequently Asked Questions how to use? releases download the latest plugin 简体中文|English...

CVE-2017-17692

CVE-2017-17692 Exploit Title: SOP Bypass Date: 06 Septmber 2017 Software Link: https://play.google.com/store/apps/details?id=com.sec.android.app.sbrowser&hl=en Exploit Author: Dhiraj Mishra Contact: http://twitter.com/mishradhiraj Website: http://datarift.blogspot.in/ Category: Browser Video PoC:...

CVE-2024-22243

CVE-2024-22243 Author: Sean Pesce This project contains an example web application that demonstrates exploitable scenarios for CVE-2024-22243, a URL-parsing vulnerability in the Java Spring Framework official disclosure here. Vulnerability Affected versions of Spring parse the "userinfo" segment ...

CVE-2026-2699

CVE-2026-2699 — Progress ShareFile Storage Zones Controller Authentication Bypass Critical Authentication Bypass CVSS 9.8 in customer-managed Progress ShareFile Storage Zones Controller SZC ≤ 5.12.3. 📋 Overview CVE-2026-2699 is a severe authentication bypass vulnerability affecting the web...

apfell

Apfell Apfell is a JavaScript for Automation JXA payload for macOS. This version currently supports Mythic 2.3.+ and will update as necessary. It will not work with Mythic 2.2 and lower. How to install an agent in this format within Mythic When it's time for you to test out your install or for...

CVE-2025-31324_PoC

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...

javascript-obfuscator

JavaScript obfuscator 🚀 Obfuscator.io with VM Obfuscation Obfuscator.io adds VM-based bytecode obfuscation to this package - your JavaScript functions are compiled to custom bytecode that runs on an embedded virtual machine. Each build produces unique opcodes and VM structure, making reverse...

EXPLOIT-CVE-2026-22778

CVE-2026-22778 — vLLM RCE in video processing Vulnerable lab + proof of concept for CVE-2026-22778 CVSS 9.8, an unauthenticated remote code execution chain in vLLM's multimodal ingestion path. | ---|--- CVE| CVE-2026-22778 Advisory| GHSA-4r2x-xpjr-7cvv Affected| vLLM = 0.8.3, vLLM turned...

cPanel-WHM-CVE-2026-41940-auth-bypass-exploit

CVE-2026-41940 - cPanel & WHM Authentication Bypass Exploit Critical Authentication Bypass via CRLF Injection in cPanel/WHM cpsrvd Daemon 📋 Overview CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel & WHM that allows unauthenticated remote attackers to gain root-level...

CVE-2026-63223-POC

CVE-2026-63223 PoC — CodeIgniter 4 File Upload RCE CVSS 9.8 Critical | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-434 : Unrestricted Upload of File with Dangerous Type Fixed : CodeIgniter 4 v4.7.4 Advisory : GHSA-mmj4-63m4-r6h5 Vulnerability Summary CodeIgniter 4's isimage and mimein file upload...

CVE-2025-55182-NextJS-Scanner-React2Shell-PoC

CVE-2025-55182 Exploitation Tool A comprehensive security research tool for testing Next.js React Server Components Remote Code Execution vulnerability CVE-2025-55182. Overview This toolkit provides automated detection and exploitation capabilities for CVE-2025-55182, a critical RCE vulnerability...

keycloak__keycloak_CVE-2022-4137_20-0-3

Keycloak Keycloak is an Open Source Identity and Access Management solution for modern Applications and Services. This repository contains the source code for the Keycloak Server, Java adapters and the JavaScript adapter. Help and Documentation Documentation User Mailing List - Mailing list for...

CVE-2024-53900

CVE-2024-53900 - Mongoose populate.match $where RCE This repository provides a reproducible vulnerable environment and PoC for CVE-2024-53900 , a critical Remote Code Execution RCE vulnerability in Mongoose 8.8.3. 📌 Vulnerability Details CVE : CVE-2024-53900 Affected : Mongoose 8.8.3 Severity :...