CVE-2025-29927

CVE-2025-29927 - Next.js Middleware Authentication Bypass Advanced Bypass 🔥 Overview An advanced PoC for CVE-2025-29927 , allowing authentication bypass in Next.js Middleware by manipulating specific headers. This template enhances WAF evasion and security bypass techniques. 🚀 Features ✅...

CVE-2024-8949-POC

Broken Access Control Vulnerability was discoverd in Sourcecodester Online Eyewear Shopping Website ID,Cart ID Manipulation Leads to Unwanted Item Addition and Deletion into User's Cart CVE-2024-8949 Vendor: Sourcecodester...

CVE-2025-31161

CrushFTP CVE-2025-31161 Exploit Tool 🔓 Advanced detection and exploitation tool for CVE-2025-31161 vulnerability in vulnerable CrushFTP versions. CVE-2025-31161 is a critical authentication bypass vulnerability in the CrushFTP Web Interface. By manipulating the HTTP Authorization header, an...

CVE-2024-21338

CVE-2024-21338 Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled. Compiling Use Microsoft Visual Studio with the C++ package to successfully compile the PoC on both Release and Debug modes. Post Original blog post:...

CVE-2025-29927

CVE-2025-29927 ★ CVE-2025-29927 Next.js middleware bypass PoC ★ Description CVE-2025-29927 : Next.js middleware bypass PoC description: Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it i...

CVE-2025-32432

CraftCMS CVE-2025-32432 Exploit Toolkit Exploitation tools for CraftCMS Remote Code Execution vulnerability based on SensePost research. 📁 File Description 🎯 Main Tools 1. finalpoc.py - Final optimized POC Supports information disclosure and remote code execution Automatic asset ID discovery...

strutt-cve-2014-0114

CVE-2014-0114 - Vulnerability in Struts 1 Parameters in a POST or GET request are handled as properties to be set with the form as a starting point. Parameters can be a path to a nested object. Apache Struts 1.x can be manipulated to call getClass on Form Beans. For example, one can directly...

byp4xx

/ / // // / / / / / / // /| |// |// / // / // / // / / Some cURL options you may use as example: -L follow redirections 30X responses -x : to set a proxy -m to set a timeout -H for new headers. Escape double quotes. -d for data in the POST requests body -... Built-in options: --all Verbose mode...

hal

¡Bienvenido a HAL! HAL /hel/ es un framework integral de ingeniería inversa y manipulación de netlist. Navegación 1. Introducción 2. Instrucciones de compilación 3. Guía de inicio rápido 4. Contexto académico Introducción ¿Qué demonios es HAL? Prácticamente toda la investigación disponible sobre...

steganographer

Esteganografía en Python Este script ocultará archivos dentro de imágenes y guardará la imagen modificada en el disco. El tamaño máximo de archivo que se puede ocultar dentro de una imagen depende de las dimensiones de la imagen. maxfilesize = heightofimage widthofimage 6 / 8 bytes '100k words.tx...

Pegasus---Forbidden-Buster

Pegasus - Forbidden Buster Author: Letda Kes dr. Sobri, S.Kom. A penetration testing tool for bypassing HTTP 401/403 responses using various header manipulation techniques and path fuzzing. Features Tests various header manipulations X-Forwarded-For, X-Original-URL, X-Rewrite-URL, etc. Unicode pa...

CVE-2024-48910-PoC

CVE-2024-48910-PoC Overview CVE-2024-48910 DOMPurify, a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG, was found to be vulnerable to prototype pollution CVE-2024-48910. The vulnerability was discovered and fixed in version 2.4.2, with the initial disclosure made on...

CVE-2021-44103

CVE-2021-44103 Una prueba de concepto para KONGA 0.14.9 - Escalada de privilegios. Intro El 16 de noviembre de 2021, Fabrício Salomão y yo encontramos una vulnerabilidad en las puertas de enlace de la API de Konga, que permitía a cualquier usuario autenticado convertirse en administrador. Informe...

CVE-2025-32463-PoC

CVE-2025-32463 – Privilege Escalation via Sudo chroot 📝 Overview CVE-2025-32463 is a local privilege escalation vulnerability affecting the sudo utility. It allows a regular user to escalate privileges to root by exploiting the -R option which sets a custom runtime root directory together with...

scapy

Scapy Scapy es un potente programa y biblioteca de manipulación interactiva de paquetes basado en Python. Es capaz de forjar o decodificar paquetes de una amplia variedad de protocolos, enviarlos por la red, capturarlos, almacenarlos o leerlos usando archivos pcap, emparejar solicitudes y...

NextBypass

NextBypass 🚨 Next.js Middleware Authorization Bypass Tool CVE-2025-29927 Features Exploit CVE-2025-29927 via x-middleware-subrequest header Auto-browser integration Proxy/Bookmarklet Vulnerability scanning & log analysis Network traffic monitoring Installation git clone...

CVE-2020-8193

CVE-2020-8193...

aapanel

aapanel aapanel 6.6.6 - CVE-2020-14950 Description : allows remote authenticated users to execute arbitrary commands via the setting menu of Sotfware Store. Affected version : All = 6.6.6 Information To make this PoC, I just installed the software using docker-compose Vulnerability Type : Remote...

cve-2025-57819

🛡️ FreePBX Hunter - CVE-2025-57819 🛡️ A powerful Nuclei toolkit for detecting and validating the critical FreePBX authentication bypass vulnerability. 📖 Table of Contents Click to expand About This Project Key Features Vulnerability Breakdown Templates in Action Finding Targets with Shodan Legal...

cryptovenom

CryptoVenom CryptoVenom: The Cryptography Swiss Army knife What is CryptoVenom? CryptoVenom is an OpenSource tool which contains a lot of cryptosystems and cryptoanalysis methods all in one, including classical algorithms, hash algorithms, encoding algorithms, logic gates, mathematical functions,...