CVE-2020-0601-spoofkey

CVE-2020-0601-spoofkey To see how to Make Spoofed Key and Signing the code REQ: openssl, main.rbwhich i uplaoded VISIT : https://twitter.com/exploitblizzard...

walletool

walletool a tool for reading wallet.dat files A utility for extracting cryptocurrency wallet data from wallet.dat files. To set up the software on Windows or macOS, Windows and Linux require these instructions; macOS users get a simple DMG file. Verify that Git and Python are set up on Windows...

CVE-2025-45809-PoC

CVE-2025-45809 — LiteLLM SQL Injection via /key/block Time-Based Blind SQLi LiteLLM v1.65.4 versions before v1.81.0 /key/block and /key/unblock endpoints have a SQL injection vulnerability in the key parameter. Attackers can use time-based blind injection techniques to steal database content and...

whatsapp-census

Hey there! You are using WhatsApp This is the github repository for the extended version of the paper Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy. Abstract WhatsApp, with 3.5 billion active accounts as of early 2025, is the world's largest instan...

SYNwall

SYNwall Zero config IoT firewall. SYNwall is a project built for the time being as a Linux Kernel Module, to implement a transparent and no-config/no-maintenance firewall. You may want to have a look to the for an example of usage. Basics Usually IoT devices are out of a central control, with low...

CVE-2026-35030-PoC

CVE-2026-35030 — LiteLLM Authentication Bypass via OIDC Userinfo Cache Key Collision LiteLLM OIDC userinfo cache uses token:20 as the cache key. Two different JWTs signed with the same algorithm produce identical first 20 characters , allowing an unauthenticated attacker to inherit another user's...

malicious-devfile-registry

Malicious Devfile Registry The project contains a malicious Devfile Registry usable to exploit CVE-2024-0402 in Gitlab. The Exploit A nodejs:2.2.1 stack is indexed to expose the archive.tar file exploiting the path-traversal issue in registry-support library before v1.1.0. tar location :...

bbrecon

This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...

SSCMS_Decrypt

sscms siteserver cms database decrypt Introduction: SSCMS is based on .NET Core, enabling you to set up a fully functional, high-performance, large-scale, and easy-to-maintain website platform in the shortest time, at the lowest cost, and with the least manpower. Project address:...

CVE-2026-46395-haxcms-hmac-key-leak

CVE-2026-46395 - HAXcms Node.js Private Key Disclosure via Broken HMAC CWE-321 / CWE-200 Proof-of-concept for authorized security testing and research only. The vulnerability described here is fixed in the latest release of HAXcms. This PoC is published so that defenders and researchers can verif...

Apisix_Crack

ApisixCrack Overview Apisix series vulnerability detection and exploitation tool, including unauthorized access vulnerability CVE-2021-45232 and default secret key vulnerability CVE-2020-13945, supports batch detection and exploitation. Usage Batch detection: Write URLs line by line in a file,...

fips203

NCC Group: FIPS 203 Module-Lattice-Based Key-Encapsulation Mechanism Standard FIPS 203 Initial Public Draft Module-Lattice-Based Key-Encapsulation Mechanism Standard written in pure Rust for server, desktop, browser and embedded applications. The source repository includes examples demonstrating...

CVE-2025-11203-PoC

CVE-2025-11203 — LiteLLM Health Endpoint APIKEY Information Disclosure LiteLLM versions 1.63.14 /health endpoint, when processing the apikey parameter, does not properly filter sensitive information , causing authenticated users to retrieve API Keys stored in other model configurations. The apike...

CVE-2026-0257

CVE-2026-0257: GlobalProtect Authentication Bypass Overview This exploit achieves unauthenticated VPN access to a Palo Alto GlobalProtect gateway/portal by forging an authentication cookie using only the server's publicly available TLS certificate. The Core Vulnerability Why It Works GlobalProtec...

CVE-2022-23529-Exploration

CVE-2022-23529 The JSON Web Token JWT library versions prior to 3.4.6, 4.0.4, and 4.1.5 are vulnerable to RCE. The HMAC hashing functions take any string as input which leads to RCE. Due to the preconditions, this vulnerability is not likly to be exploitable. In order to exploit this vulnerabilit...

CVE-2026-13768

CVE-2026-13768 - Gardyn IoT Hub Owner Key Exposure !WARNING This repository contains a fully functional proof-of-concept for a high-severity IoT vulnerability. This code is provided strictly for educational purposes, authorized security research, and defensive testing. Unauthorized use is illegal...

CVE-2026-4567-Post-Quantum-KEM-Timing-Side-Channel-Kyber-Decapsulation-

2. CVE-2026-4567 – Post-Quantum KEM Timing Side-Channel Kyber Decapsulation Overview A vulnerable implementation of the Kyber KEM decapsulation leaks secret key bits through timing differences in the ciphertext rejection step, enabling full key recovery. Severity: Critical Private Key Compromise...

CVE-2026-46590

CVE-2026-46590 — camel-pqc Key-Lifecycle Unsafe Deserialization Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-pqc 4.18.2 Camel Quarkus|...

CVE-2025-63353

FiberHome Wi-Fi Password Predictor CVE-2025-63353 A Python utility designed for security auditing and proof-of-concept demonstration of the deterministic password generation flaw found in FiberHome HG6145F1 RP4423 routers. 📋 Overview This script exploits CVE-2025-63353, a critical vulnerability...

CVE-2026-82329-poc

CVE-2026-82329 Artifactory Security Assessment Tool PoC and validation tool to identify self-hosted JFrog Artifactory installations affected by CVE-2026-82329. This tool validates the following authentication chain: 1. Create an HS256 JWT join using the default empty signing key. 2. Send the JWT ...