PWNtaho

PWNentaho Pentaho Authentication Bypass CVE-2021-31602 https://nvd.nist.gov/vuln/detail/CVE-2021-31602...

CVE-2024-47533

CVE-2024-47533 – Cobbler XML-RPC Authentication Bypass Exploit 📜 Description CVE-2024-47533 is a critical authentication bypass vulnerability in Cobbler, a Linux installation server that automates network-based OS installs. The flaw is caused by an issue in utils.getsharedsecret which always...

CVE-2024-51430

CVE-2024-51430 Tipo de Vulnerabilidad Cross-Site Scripting XSS Descripción Existe una vulnerabilidad de Cross Site Scripting en el sistema de gestión de laboratorios de diagnóstico en línea que utiliza PHP v.1.0, la cual permite a un atacante remoto ejecutar código arbitrario a través del parámet...

CVE-2026-19598

🚨 CVE-2026-19598 https://plugins.trac.wordpress.org/browser/pods/tags/3.3.9/includes/general.phpL400 The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 13.0.2 Vulnerability Details CVEID:CVE-2026-44249 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, ...

CVE-2025-25460

FlatPress CMS XSS Almacenado en v1.3.1 CVE-2025-25460 Autor: Athul S Descripción Se identificó una vulnerabilidad de Cross-Site Scripting XSS almacenado en FlatPress 1.3.1 dentro de la función "Añadir entrada". Esta vulnerabilidad permite a atacantes autenticados inyectar cargas útiles maliciosas...

cve-2021-3490-ebpf-analysis

cve-2021-3490-ebpf-analysis Research implementation demonstrating interaction with Linux eBPF subsystem related to CVE-2021-3490. Includes BPF map creation, syscall wrappers, namespace setup, and verifier analysis. For educational and security research purposes only. CVE-2021-3490 – eBPF Verifier...

CVE-2023-43838

CVE-2023-43838 An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar. Additional Information 1. Create alert.svg with the following content: root@kitploit:...

CVE-2025-29927

🕷️ Next.js CVE-2025-29927 🧑🏻‍💼 Legal Disclaimer This project is a Next.js application that has been intentionally configured to be vulnerable to an Authorization Bypass in Next.js Middleware CVE-2025-29927. It is provided solely for lawful, educational, and research purposes. By accessing, using,...

CVE-2021-3138

..| Discourse 2.7.0 - CVE-2021-3138 |.. Description : Rate limit Bypass which leads to 2FA Bypass Tested Version : 2.7.0 Attack Type: Remote Impact : 2FA Bypass Vendor of Product : https://www.discourse.org Additional Information : Discourse is discussion platform built for the next decade of the...

memory-forensic

memory-forensic A memory forensics toolkit that profiles Windows kernels itself — and is cross-checked, process-for-process, against Volatility 3. mem4n6 reads every common dump format LiME, AVML, ELF core, Windows crash dumps, hibernation files, VMware save-states, kdump, raw… and walks processe...

tink

Tink NOTE : Tink moved to github.com/tink-crypto and this repo is no longer active! As planned, we have split Tink into multiple GitHub repositories that are hosted at github.com/tink-crypto. As a consequence, we made this repository read-only and it is not going to be maintained moving forward. ...

YellowKey-Bitlocker-CVE-2026-45585

🛡️ YellowKey-Bitlocker-CVE-2026-45585 - Recover Your BitLocker Keys Safely 📋 What This Software Does YellowKey is a free open-source utility for Windows 10 and Windows 11. It helps you extract, backup, and view your BitLocker recovery keys. This is useful if you lost access to your encrypted drive...

CVE-2024-53255

CVE-2024-53255 boid CMS 2.1.1 - Cross-Site Scripting reflejado XSS Descripción: Existe una vulnerabilidad de XSS reflejado en el endpoint /admin?page=media en el parámetro file, que permite a un atacante inyectar código JavaScript arbitrario. Pasos para explotar: 1- Iniciar sesión en el CMS y...

CVE-2025-52385

CVE-2025-52385 Software : Studio 3T v.2025.1.0 Vulnerability Report : Studio 3T Remote Command Execution Overview A critical vulnerability in Studio 3T version 2025.1.0 and earlier allows a remote attacker to execute arbitrary code via a crafted payload exploiting the childprocess module in the...

CVE-2025-6384

CVE-2025-6384: Groovy Sandbox Bypass 2 in CrafterCMS Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. Vendor Disclosure: The vendor's disclosure and fix for this...

CVE-2021-34646

CVE-2021-34646 PoC para CVE-2021-34646 Título del Exploit: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Bypass de Autenticación Fecha: 2021-09-16 Autor del Exploit: Sebastian Kriesten 0xB455 Contacto: https://twitter.com/0xB455 Plugin Afectado: Booster for WooCommerce Plugin Slug:...

CVE-2024-49379

Proof of Concept PoC for CVE-2024-49379 This repository contains a Python-based Proof of Concept PoC for a critical vulnerability identified in UmbrelOS. The vulnerability allows for Cross-Site Scripting XSS, which can escalate to Remote Code Execution RCE under specific conditions. Overview CVE ...

CVE-2022-1040

CVE-2022-1040-sophos-rce-poc sophos rce poc sophos webmin portal auth bypass and rce all in one script; The vulnerability affects Sophos Firewall v18.5 MR3 18.5.3 and older Mitigation: update to latest version asap https://support.sophos.com/support/s/article/KB-000043853?language=enUS to avoid...

CVE-2025-29927

Next.js Middleware Bypass Checker | CVE-2025-29927 Herramienta automatizada en Bash para detectar aplicaciones Next.js vulnerables al bypass de middleware CVE-2025-29927 , según la investigación de Zhero Web Security. Requisitos bash whatweb curl Instálalos en Debian/Ubuntu con: root@kitploit: su...