Apache-Druid-CVE-2021-25646-Exploit

Apache Druid RCE Exploit CVE-2021-25646 Python exploit for Apache Druid Remote Code Execution via JavaScript code injection CVE-2021-25646. Description This script exploits an RCE vulnerability in Apache Druid versions 0.20.1 that allows arbitrary code execution through specially crafted sampler...

CVE-2026-27574-OneUptime-RCE

CVE-2026-27574-OneUptime-RCE Overview Proof-of-Concept exploit for CVE-2026-27574 – a critical code injection vulnerability CWE-94 in OneUptime BOpen Registration B -- CRegister New Accou...

EUVD-2026-111707

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views...

external_v8_AOSP10_r33_CVE-2021-0396

V8 JavaScript Engine V8 is Google's open source JavaScript engine. V8 implements ECMAScript as specified in ECMA-262. V8 is written in C++ and is used in Google Chrome, the open source browser from Google. V8 can run standalone, or can be embedded into any C++ application. V8 Project page:...

Apache-couchdb-CVE-2017-12635

CouchDB Vertical Privilege Escalation Vulnerability CVE-2017-12635 Apache CouchDB is an open-source database that focuses on ease of use and being a "fully web-embracing database." It is a NoSQL database that uses JSON as the storage format, JavaScript as the query language, and MapReduce and HTT...

CVE-2024-28397-Js2Py-RCE-Exploit

💡 Deep Dive: Click here to read the full technical briefing PDF. CVE-2024-28397: Js2Py Sandbox Escape Payload Generator A professional payload generator for CVE-2024-28397. This tool generates malicious JavaScript code designed to escape the js2py sandbox versions = 0.74 and execute arbitrary...

js-driveby-download-CVE-2006-4777

js-driveby-download-CVE-2006-4777 client-side malware exploiting vulnerability in Internet Explorer 6.0 SP1 on Windows XP SP2. Requires no user consent and does not download any file. Shell Code Injection into RAM from JavaScript with IE on Windows XP. Fileless, drive-by-download, client side...

jshound

jshound Recover every request a web app is built to make from the JavaScript it ships: method, URL, body, content type and headers. A single page app's JavaScript bundle contains every API request the app can make. Given a URL, jshound finds the app's bundle, crawls all of it, lazily loaded chunk...

reDOM

reDOM ██████╗ ███████╗██████╗ ██████╗ ███╗ ███╗ ██╔══██╗██╔════╝██╔══██╗██╔═══██╗████╗ ████║ ██████╔╝█████╗ ██║ ██║██║ ██║██╔████╔██║ ██╔══██╗██╔══╝ ██║ ██║██║ ██║██║╚██╔╝██║ ██║ ██║███████╗██████╔╝╚██████╔╝██║ ╚═╝ ██║ ╚═╝ ╚═╝╚══════╝╚═════╝ ╚═════╝ ╚═╝ ╚═╝ A Burp Suite extension that brings full...

CVE-2025-54100

CVE-2025-54100 Powershell's curl uses Invoke-WebRequest underneath. PS C:\Users\melih curl cmdlet Invoke-WebRequest at command pipeline position 1 Supply values for the following parameters: Uri:...

CVE-2026-34621_PDF_SAMPLE

Technical Analysis of a Multi-Stage Adobe Acrobat PDF JavaScript Sample Overview This repository publishes a code-centric reverse-engineering write-up on a malicious PDF sample that embeds staged Adobe Acrobat JavaScript. The analyzed sample uses a hidden form field as its initial loader,...

CVE-2012-1889

CVE-2012-1889 This repository contains the files I used to learn about exploiting the CVE-2012-1889 vulnerability. 1.txt First module info 2.txt Second module info c2javascript.c Used to convert C-form shellcode into JavaScript-form shellcode cve-2012-1889.html Exploit web page...

CVE-2025-52097

CVE-2025-52097 – Reflected XSS in InstantForum.NET v4.1.4 This repository contains the public advisory, proof of concept, and supporting materials for CVE-2025-52097 , a reflected cross-site scripting XSS vulnerability identified in InstantForum.NET v4.1.4. Summary Product: InstantForum.NET v4.1....

JS-Secret-Hunter

JS Secret Hunter V2 🕵️‍♂️ JS Secret Hunter is an advanced Python tool designed for security researchers to automate the detection of hardcoded secrets in client-side JavaScript. Unlike simple scanners, V2 includes a dynamic crawler that parses the HTML of the target website to extract all loaded...

CVE-2026-34621

CVE-2026-34621 : Adobe Acrobat 2026 Prototype Pollution & JS Injection Chain — Research PoC Overview This repository contains research material and proof-of-concept code developed during the analysis of the 2026 Adobe Acrobat Reader in-the-wild exploit chain involving: Prototype Pollution Interna...

CVE-2026-26211

-orange?style=for-the-badge&logo=owasp CVE-2026-26211: Stored XSS in Ekushey Project Manager CRM Product: Ekushey Project Manager CRM Version: 5.0 Vulnerability: Stored Cross-Site Scripting XSS CWE: CWE-79 Researcher: LINDAN TRI SAPUTRA Initial Report: August 1, 2026 Summary A stored Cross-Site...

CVE-2021-40514

CVE-2021-40514 OSCAR McMaster 19.401235 Stored Cross Site Scripting Vulnerability A stored Cross Site Scripting vulnerability exists in multiple pages in version 19.401235 of the OSCAR McMaster application that allows for arbitrary execution of JavaScript commands. Placeholder for CVE mitre...

CVE-2025-56795

CVE-2025-56795 Description Two stored Cross-Site Scripting XSS vulnerabilities were identified in the recipe creation functionality of Mealie , affecting all versions up to and including 3.0.1. Unsanitized user input provided during recipe creation is stored and later rendered in the frontend...

CVE-2025-60374

CVE-2025-60374 CVE-2025-60374: Stored Cross-Site Scripting XSS in Perfex CRM Chatbot ⚠️ Security Advisory A critical Stored Cross-Site Scripting vulnerability in Perfex CRM's chatbot feature 📋 Overview A stored cross-site scripting XSS vulnerability in the chatbot component of Perfex CRM, prior to...

CVE-2026-2964-Lab

CVE‑2026‑2964 Lab – Prototype Pollution to RCE This repository contains a complete lab environment for CVE‑2026‑2964, a prototype pollution vulnerability in the web‑audio‑recorder‑js library that can lead to remote code execution under specific conditions. The lab includes: A vulnerable server...