CVE-2020-28018

CVE-2020-28018: Exim Use-after-free UAF leading to RCE Introduction There exists a Use-after-free UAF vulnerability in tls-openssl.c that allow remote unauthenticated attackers to corrupt internal memory data, thus finally achieving remote code execution. Primitives: Memory Leakage Arbitrary read...

Malicious code in @apexacc/cli (npm)

@apexacc/cli is distributed by "Apex Accelerator" Apex Arena, a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs REF8801, published 2026-10-12 found it is a repackaged Oh My Pi coding agent 1,351 of 1,363 files identical with malicious...

trailmark

Trailmark Parse source code into queryable graphs of functions, classes, calls, and semantic annotations for security analysis. Trailmark uses tree-sitter for language-agnostic AST parsing and rustworkx for high-performance graph traversal. The long-term vision is to combine this graph with...

CVE-2025-29927-PoC

CVE-2025-29927: Next.js Middleware Bypass Vulnerability PoC This repository demonstrates the CVE-2025-29927 vulnerability in Next.js, where the internal header x-middleware-subrequest can be used to bypass middleware checks like authentication. Affected Versions Next.js 15.x 15.2.3 Next.js 14.x...

watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py

cve-2026-41940 cPanel/WHM Authentication Bypass - Detection Artifact Generator cPanel/WHM Authentication Bypass Detection Artifact Generator Tool Description This Detection Artifact Generator verifies if cPanel/WHM is vulnerable to a recent authentication bypass. Detection in Action Test against ...

skyjack

SkyJack SkyJack is a drone engineered to autonomously seek out, hack, and wirelessly take full control over any other drones within wireless or flying distance, creating an army of zombie drones under your control. Update: Proof of Concept of SkyJack for 3D Robotics drones using the TI CC1111...

GhostlyHollowingViaTamperedSyscalls2

Ghostly Hollowing Via Tampered Syscalls Reupload Notice !NOTE The original repository previously used an incorrect license that omitted attribution to the founder of DeceptIQ, @Rad9800, whose TamperingSyscalls repository is published under the MIT License. His work was already credited in the...

Project-Onyx

Project Onyx Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advanced evasion techniques against modern EDR systems. It shifts away from traditional signature-based obfuscation towards behavioral camouflage and stri...

quill-router

TrustedRouter End-to-end encrypted LLMs. One API. Privacy with proof. Stop worrying about who can see your prompts. Tell your coding agent to move your project over, pick how private you want to be, pick a model, drop in a key — done. Same API, 30+ models, one key. The gateway runs in hardware...

Eaton-UPS-Companion-Exploit

Overview The Eaton UPS Companion software checks for an update every single week over an insecure HTTP connection and evals the content of whatever is at the update URL. This allows an attacker to craft a JavaScript function which uses the low-level OS operations that already exist in the backend...

CVE-2017-8641_chakra_Js_GlobalObject

Description described more from site CVE !!Yes Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the conte...

POC-CVE-2025-6554

CVE-2025-6554 CVE-2025-6554 is a vulnerability in Chrome's V8 Engine JavaScript interpreter Hole Check 'inadequate control in unintended variables within expressions with optional chaining. POC CVE-2025-6554-POC.JS explores a flaw in the "Hole" verification mechanism in variables before use,...

bitlocker-attacks

BitLocker Attacks A list of public attacks on BitLocker. Any public attack with the potential to attack BitLocker but where the exact method is still not public like baton drop is out of scope. Most of the attacks are for where the VMK is sealed by TPM only, which is the default setting, and is...

HackBrowserData

HackBrowserData HackBrowserData is a command-line tool for decrypting and exporting browser data passwords, history, cookies, bookmarks, credit cards, download history, localStorage, sessionStorage and extensions from the browser. It supports the most popular Chromium-based browsers and Firefox o...

CVE-2017-8625_Bypass_UMCI

what is ! Windows Defender Device Guard ! Windows Defender Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity...

CVE-2025-24813-PoC-Apache-Tomcat-RCE

Apache Tomcat CVE-2025-24813 Proof of Concept PoC A proof-of-concept exploit for the Apache Tomcat deserialization vulnerability CVE-2025-24813. This tool demonstrates how attackers could exploit insecure deserialization in Tomcat's session management. WARNING : This tool is for authorized securi...

CVE-2025-39596

CVE-2025-39596 Quentn WP -e options Required Arguments: -u, --url Target WordPress site URL e.g., http://127.0.0.1/wordpress -e, --email Email for the new admin account Optional Arguments: -f, --fname First name default: Pwn -l, --lname Last name default: Admin -r, --role Role to assign default:...

CVE-2025-25257

CVE-2025-25257 CVE‑2025‑25257 is a critical pre-authentication SQL injection vulnerability affecting Fortinet FortiWeb’s Fabric Connector component. It impacts FortiWeb versions: 7.6.0–7.6.3 7.4.0–7.4.7 7.2.0–7.2.10 ≤ 7.0.10 Technical Details The issue resides in the getfabricuserbytoken function...

CVE-2025-32462

CVE-2025-32462 - Sudo Host Bypass Exploit Original Discovery This vulnerability was discovered by Rich Mirch. More details can be found at: https://cxsecurity.com/issue/WLB-2025070022 About This script is an exploit for CVE-2025-32462, allowing privilege escalation by bypassing sudo's host...

TrickDump

TrickDump TrickDump dumps the lsass process without creating a Minidump file, generating instead 3 JSON and 1 ZIP file with the memory region dumps. In three steps: Lock : Get OS information using RtlGetVersion. Shock : Get SeDebugPrivilege privilege with NtOpenProcessToken and...