CVE-2019-5420

CVE-2019-5420 Exploit for Rails CVE-2019-5420 The issue Until Rails v5.2.2, when secure the sessions in development mode, the application derives the key from the name of the application...

CVE-2026-88997

CVE-2026-88997 JSM Show Post Metadata 4.9.1 — Contributor+ Stored XSS via Custom Field Meta Key | ---|--- CVE ID| CVE-2026-88997 Status| PUBLISHED CNA| WPScan Published| 2026-09-23 Updated| 2026-09-23 CWE| CWE-79: Cross-Site Scripting XSS Description The JSM Show Post Metadata WordPress plugin...

CVE-2024-37759_PoC

CVE-2024-37759 PoC Description DataGear version 5.0.0 and earlier has a SpEL expression injection vulnerability that leads to remote code execution. Exploit CVE Exploit Details When you request the /data/schemaId/tableName/view interface, if the database table does not have a primary key, an...

grafanaExp

grafanaExp Exploit Grafana CVE-2021-43798 arbitrary file read vulnerability to automatically detect vulnerability, existing plugins, extract secret key, decrypt server database file, and output datasourrce info. Usage Provides exp and decode functionality. ➜ ./grafanaExp -h NAME: grafanaExp -...

Bastillion

Bastillion A modern, web-based SSH console and SSH key management tool. Bastillion gives you a clean, browser-based way to manage SSH access across all your systems — like a bastion host with a friendly dashboard. It does two things: 1. Web-based SSH terminal — once a host is registered, authoriz...

sshkey-grab

sshkey-grab This script uses a bug in ssh-agent that allows it to pull the last key added to the agent. This may allow the ability to recover a key that has been removed from ssh-agent via ssh-add -t, -d, or -D, provided that the ssh-agent was not terminated and a new key has not been added since...

CVE-2026-93528

📌 CVE-2026-93528: Unauthenticated Order Data Disclosure in NP Quote Request for WooCommerce • Vulnerability Type: Sensitive Data Disclosure CWE-200 • Affected Software: woo-rfq-for-woocommerce 2.4.16 • Original Researcher: Murad Islamzada • Vendor: Neah Plugins Cyrus 1. Overview & Root Cause The...

wpair-app

WPair CVE-2025-36911 eg WhisperPair Vulnerability Scanner & Research Tool Features • Installation • Usage • How It Works • Vulnerability • Credits Disclaimer This application is an independent implementation created by @ZalexDev in his own capacity. The original KU Leuven researchers discovered a...

CVE-2024-5764

CVE-2024-5764 This repository contains a Python script capable of exploiting CVE-2024-5764 by decrypting encrypted data with the static encryption key. Sonatype announcement available here. Usage usage: cve-2024-5764.py -h -e ENCRYPTEDPAYLOAD -p PASSPHRASE Decrypt data encrypted by the Java...

rack-bug

Rack::Bug Code Climate Repository: http://github.com/brynary/rack-bug Description Rack::Bug adds a diagnostics toolbar to Rack apps. When enabled, it injects a floating div allowing exploration of logging, database queries, template rendering times, etc. Features Password-based security IP-based...

KeyDecoder

KeyDecoder KeyDecoder is a mobile app created for pentesters and security enthusiasts. From the picture of a key, one can measure its bitting easily. Developped by Maxime BEASSE and Quentin CLEMENT. In partnership with FrenchKey and CNS from ESIEA. Powered by Flutter 3.13.6 and OpenCV 4.3.0 Summa...

Doctor Near Telemedicine Premium Authentication Bypass

The vulnerability of the “Doctor Near. Telemedicine Premium” platform relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

QAFA Firmware Authentication Bypass

The vulnerability of the QAFA Firmware for telecommunications equipment relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the administrative web console...

CVE-2026-27944

CVE-2026-27944 - Nginx UI Unauthenticated Backup Download & Decryption https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/PoC-Exploit-red A proof‑of‑concept PoC exploit for CVE‑2026‑27944, a critical vulnerability in Nginx...

ecdsa-private-key-recovery

ecdsa-key-recovery Perform ECDSA and DSA Nonce Reuse private key recovery attacks A cryptographic research tool for analyzing signature vulnerabilities Let's recover the private-key for two signatures sharing the same nonce k. Note how choosing the same nonce k results in both signatures having a...

CVE-2026-79551-Tenda

CVE-2026-79551 Tenda Hardcoded TLS Private Key CNVD ID: CNVD-2026-25884 Vendor: Tenda Technology Co., Ltd. Product: NVR4H network video recorder hardware version CH3V2.1 Firmware: V27.5.58.6 Class: CWE-321 — Use of Hard-coded Cryptographic Key Overview The NVR4H firmware stores an ECDSA key pair ...

bitlocker-bypass-research

BitLocker Bypass Research Personal security research project — bypassing BitLocker full disk encryption using CVE-2023-21563 BitPixie. What This Is In October 2025, I did a physical laptop recovery assessment on a corporate laptop with BitLocker enabled. The employee forgot their password and the...

recipe-blog-encoding

recipe-blog-encoding !WARNING This project is entirely vibe-coded likely partially plagiarized from this repository and the author is a dumb-dumb who just thought the idea was funny Use SEO-gaming recipe preambles as a vehicle for encoding secret messages the prompt can really be anything though,...

about-hmac

About HMAC An Example Implementation of Basic HMAC Hash-based Message Authentication Code Using Flask in Python. What is HMAC?! Hash-based message authentication code HMAC provides the server and the client each with a private key that is known only to that specific server and that specific clien...

Pyrit

Please Read Pyrit is old, is outdated and it's still Python2 I am currently attempting to rewrite it from scratch, so thanks for all the stars but remember to keep an eye for Python3 version. Pyrit Pyrit allows you to create massive databases of pre-computed WPA/WPA2-PSK authentication phase in a...