eero-zero-length-ipv6-options-header-dos

eeroOS Ethernet Interface Denial of Service Vulnerability CVE-2023-5324 If eero Pro 5 devices receive an IPv6 packet where the payload length is zero and contains a hop-by-hop or destination options extension header that refers to another hop-by-hop or destination options extension header that...

rbuster

Rbuster yet another dirbuster Common Command line options -a - specify a user agent string to send in the request -c - use this to specify any cookies that you might need simulating auth. header. -f - force processing of a domain with wildcard results. -l - show the length of the response. -r...

cve-2026-31431-poc

CVE 2026-31431 POC This exploit takes advantage of a flaw in the length validation of authencesn in Linux, causing dirty pages to be written back to locations the user has no permission to access, resulting in privilege escalation. The attack principle is mainly based on this repo, with some...

CRIME-poc

CRIME-poc CRIME attack : a compression oracle attacks CVE-2012-4929 discovered by Juliano Rizzo and Thai Duong; In a compression oracle attack the use of adaptive data compression on a mixture of chosen plaintext and unknown plaintext can result in content-sensitive changes in the length of the...

openssl

Welcome to the OpenSSL Project !openssl logowww.openssl.org !github actions ci badgegithub actions ci OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit for the Transport Layer Security TLS, formerly SSL, Datagram TLS DTLS, and QUIC protocols. The protocol implementations ar...

CLZero

CLZero A project for fuzzing HTTP/1.1 CL.0 Request Smuggling Attack Vectors. About Thank you to @albinowax, @defparam and @d3d else this tool would not exist. Inspired by the tool Smuggler all attack gadgets adapted from Smuggler and...

CVE-2026-42945-POC

CVE-2026-42945 NGINX Rift - HTB-Ready Exploit Standalone exploit for the NGINX heap buffer overflow vulnerability discovered in 2024. This version is optimized for HackTheBox and CTF environments where you can't set up Docker containers. Vulnerability Details CVE-2026-42945 is a critical heap...

w48crash

WebMod Stack Buffer Overflow CVE-2007-1260 by cybermind Kevin Masterson [email protected] WebMod site archived: https://web.archive.org/web/20080517044559/http://djeyl.net/w.php Vulnerable versions: 0.48, both Win32 and Linux. Previous versions may be vulnerable. This should work with any...

cve-2025-39682

CVE-2025-39682 exploit on kernelCTF mitigation instance This is also my first ? idk, this is a variant of CVE-2024-58239 1-day exploit. Patch: tls: fix handling of zero-length records on the rxlist This CVE was used in exp398 and and exp403. kernelCTF spreadsheet. For folder structures and how to...

duplicut

Duplicut :scissors: Quickly dedupe massive wordlists, without changing the order Created by nil0x42 and contributors 📖 Overview Nowadays, password wordlist creation usually implies concatenating multiple data sources. Ideally, most probable passwords should stand at start of the wordlist, so most...

CVE-2025-39682

CVE-2025-39682 — Linux kTLS zero-length rxlist record UAF tracking site Source for the CVE-2025-39682 patch-status tracker: a single-page site recording which distributions have shipped a fix for a use-after-free in the Linux kernel's kTLS receive path net/tls. Where the facts live Everything abo...

CVE-2017-11882

CVE-2017-11882 Overview From the perspective of exploit effectiveness, it can kill all versions of Office from 2003 to 2016, and the entire attack environment is very simple to build. This vulnerability is caused by the Equation Editor in Office software. Because the editor process does not...

CVE-2025-10230

CVE-2025-10230 PoC for CVE-2025-10230 - Samba WINS hook command injection The configuration required for this vulnerability probably affects 0 people. The injection is limited to 15 characters and must be a valid WINS name so no ;...

CVE-2021-37740

Proof of Concept for CVE-2021-37740 Table of Contents Introduction The Vulnerability Executing the PoC Remediation Coordinated Vulnerability Disclosure License Change Log Introduction CVE-2021-37740 is a denial of service DoS vulnerability that affects firmware v3.0.3 of the KNXnet/IP Secure rout...

pgm-attack

PGM-attack Overview Official code for our paper, Poisoning Attacks on the PGM-index. Quick Start 1. Clone and submodules git clone REPOSITORY LINK cd pgm-index-poisoning git submodule update --init --recursive 2. Build ./scripts/build.sh Requires CMake see Dependencies. Outputs go under build/...

SAPGateBreaker-Exploit

CVE-2022-22536: HTTP Smuggling Through SAP's Front Door SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepe...

CVE-2026-38427

CVE-2026-38427: Integer Wraparound → Heap Buffer Overflow in Tasmota fetchjpg CVE: CVE-2026-38427 Severity: Critical CVSS 9.8 Product: Arendst Tasmota Affected Version: = 15.3.0.3 File: tasmota/tasmotaxdrvdriver/xdrv10scripter.ino Function: fetchjpg — case 2 MJPEG frame fetch Author: Saidakbarxon...

CVE-2019-19945_Test

CVE-2019-19945Test This is the code for the first Proposed CVE 1. Install Docker 2. Build & RUN Server cd Server docker build -t server/cve . docker run -d --name server -p 80:80 server/cve 3. Get Server Container IP Linux sudo docker container inspect server | grep -i IPAddress Windows Powershel...

PyPath-Escape-CVE-2025-4517-Exploit-Research

🛡️ PyPath-Escape: Advanced PATHMAX Bypass Toolkit Author: Beriwalarohit Research Target: CVE-2025-4517 / CVE-2025-4138 ██████╗ ███████╗██████╗ ██╗██╗ ██╗ █████╗ ██╗ █████╗ ██████╗ ██╔══██╗██╔════╝██╔══██╗██║██║ ██║██╔══██╗██║ ██╔══██╗██╔══██╗ ██████╔╝█████╗ ██████╔╝██║██║ █╗ ██║███████║██║...

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

Summary fromJSON and fromCrossJSON used two node fields without checking them. - An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node's done index was not...