shiro-cve-2022-32532

Apache Shiro CVE-2022-32532 Reproduction Environment This is a minimal web application for reproducing CVE-2022-32532 Apache Shiro RegExPatternMatcher authentication bypass. Vulnerability Description CVE : CVE-2022-32532 Affected versions : Shiro 1.9.1 Cause : RegExPatternMatcher does not properl...

CVE-2025-55182-scanner

React Server Components Surface Exposure Scanner CVE-2025-55182 A specialized, non-intrusive surface detector for CVE-2025-55182 React Server Components RCE. ⚠️ Critical Technical Context Read this before scanning: While CVE-2025-55182 is a critical RCE vulnerability CVSS 10.0, real-world...

CVE-2022-35500

CVE-2022-35500 Stored Cross-site Scripting XSS in leave comment functionality in Amasty Blog Pro for Magento 2 Description The leave comment functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the AmBlogLeaveComment mutation in name...

CVE-2026-5061

CVE-2026-5061 Consul Template validated where a symlink pointed during template evaluation, but its later dependency fetch read the original path. Retargeting the link between those operations turned an in-sandbox file reference into an out-of-sandbox file disclosure. Intro I found this issue whi...

JEP290_RMI_Bypass

what's this? This project is for JEP290 Bypass studying Result...

thermoptic

thermoptic "I don't believe it, thermoptic camouflage!" What is it? This is an HTTP proxy designed to bypass services that use fingerprinting such as JA4+ to block certain HTTP clients. Using this proxy, you can use your preferred HTTP clients like curl and still have magically indistinguishable...

cpanel2shell-scanner

cpanel2shell-scanner A high-fidelity scanner for the cPanel/WHM authentication bypass tracked as CVE-2026-41940. It identifies vulnerable hosts without producing the false-negatives common to public proofs-of-concept and detections, and without triggering the account lockout and root-IP-allowlist...

awesome-list

Awesome Cybersecurity List My personal collection of awesome blog posts, write-ups, and papers focusing on cybersecurity. For a deeper dive into cybersecurity-related tools, check out the dedicated Cybersecurity Tools list. Outline 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2014 2011...

cve-2016-1764

PoC Exploit Code for CVE-2016-1764 Recovery of Plaintext iMessage Data Without Breaking Crypto Authors Shubham Shah from Bishop Fox Joe DeMesy from Bishop Fox Matthew Bryant CVE-2016-1764 Vendor: Apple Release Date: April 8, 2016 Patch Date: March 21, 2016 Systems Affected: Messages on OSX Mounta...

CVE-2026-23552

CVE-2026-23552 - Cross-Realm Token Acceptance in camel-keycloak Overview Apache Camel's KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. This means a token issued by one Keycloak realm is silently accepted by a policy configured for a...

PrestaShop-CVE-2018-19126

PrestaShop Back Office Remote Code Execution CVE-2018-19126 This is the PoC for CVE-2018-19126, chaining multiple vulnerabilities in PrestaShop Back Office to trigger deserialization via phar to achieve remote code execution. Prerequisite: PrestaShop 1.6.x before 1.6.1.23 or 1.7.x before 1.7.4.4...

log4j2burpscanner

JUST FOR TESTING，DON'T ATTACK ANYONE JUST FOR TESTING，DON'T ATTACK ANYONE JUST FOR TESTING，DON'T ATTACK ANYONE 交流群 二维码失效请加微信f-f0ng、备注log4j2burpscanner交流 关注主页公众号（only security），回复log4j2burpscanner获取下载地址】 FAQ Frequently Asked Questions how to use? releases download the latest plugin 简体中文|English...

CVE-2017-17692

CVE-2017-17692 Exploit Title: SOP Bypass Date: 06 Septmber 2017 Software Link: https://play.google.com/store/apps/details?id=com.sec.android.app.sbrowser&hl=en Exploit Author: Dhiraj Mishra Contact: http://twitter.com/mishradhiraj Website: http://datarift.blogspot.in/ Category: Browser Video PoC:...

CVE-2024-22243

CVE-2024-22243 Author: Sean Pesce This project contains an example web application that demonstrates exploitable scenarios for CVE-2024-22243, a URL-parsing vulnerability in the Java Spring Framework official disclosure here. Vulnerability Affected versions of Spring parse the "userinfo" segment ...

CVE-2026-2699

CVE-2026-2699 — Progress ShareFile Storage Zones Controller Authentication Bypass Critical Authentication Bypass CVSS 9.8 in customer-managed Progress ShareFile Storage Zones Controller SZC ≤ 5.12.3. 📋 Overview CVE-2026-2699 is a severe authentication bypass vulnerability affecting the web...

apfell

Apfell Apfell is a JavaScript for Automation JXA payload for macOS. This version currently supports Mythic 2.3.+ and will update as necessary. It will not work with Mythic 2.2 and lower. How to install an agent in this format within Mythic When it's time for you to test out your install or for...

CVE-2025-31324_PoC

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...

javascript-obfuscator

JavaScript obfuscator 🚀 Obfuscator.io with VM Obfuscation Obfuscator.io adds VM-based bytecode obfuscation to this package - your JavaScript functions are compiled to custom bytecode that runs on an embedded virtual machine. Each build produces unique opcodes and VM structure, making reverse...

EXPLOIT-CVE-2026-22778

CVE-2026-22778 — vLLM RCE in video processing Vulnerable lab + proof of concept for CVE-2026-22778 CVSS 9.8, an unauthenticated remote code execution chain in vLLM's multimodal ingestion path. | ---|--- CVE| CVE-2026-22778 Advisory| GHSA-4r2x-xpjr-7cvv Affected| vLLM = 0.8.3, vLLM turned...

cPanel-WHM-CVE-2026-41940-auth-bypass-exploit

CVE-2026-41940 - cPanel & WHM Authentication Bypass Exploit Critical Authentication Bypass via CRLF Injection in cPanel/WHM cpsrvd Daemon 📋 Overview CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel & WHM that allows unauthenticated remote attackers to gain root-level...