CVE-2024-48910-PoC

CVE-2024-48910-PoC Overview CVE-2024-48910 DOMPurify, a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG, was found to be vulnerable to prototype pollution CVE-2024-48910. The vulnerability was discovered and fixed in version 2.4.2, with the initial disclosure made on...

scapy

Scapy Scapy es un potente programa y biblioteca de manipulación interactiva de paquetes basado en Python. Es capaz de forjar o decodificar paquetes de una amplia variedad de protocolos, enviarlos por la red, capturarlos, almacenarlos o leerlos usando archivos pcap, emparejar solicitudes y...

NextBypass

NextBypass 🚨 Next.js Middleware Authorization Bypass Tool CVE-2025-29927 Features Exploit CVE-2025-29927 via x-middleware-subrequest header Auto-browser integration Proxy/Bookmarklet Vulnerability scanning & log analysis Network traffic monitoring Installation git clone...

CVE-2025-29927-PoC

CVE-2025-29927 - Next.js Middleware Authorization Bypass PoC This repository contains a Proof of Concept PoC exploit for CVE-2025-29927 , a critical vulnerability in Next.js that allows attackers to bypass authorization checks by abusing a middleware-specific HTTP header. Overview CVE ID:...

CVE-2023-30253-Exploit

CVE-2023-30253 Exploit Dolibarr vulnerable to remote code execution via uppercase manipulation Affected version 17.0.1 Usage: pip3 install -r requirements.txt python3 CVE-2023-30253.py...

nextjs-auth-bypass

nextjs-auth-bypass Analysis and exploitation of a Next.js authorization bypass vulnerability CVE-2025-29927 Next.js Authorization Bypass – CVE Analysis Overview This project demonstrates an authorization bypass vulnerability in a Next.js application caused by improper middleware validation...

react2shell-CVE-2025-55182

Attack component contains the attack code. Just uncomment it and press the button to pefrom attach. To run your own code on server exploit simply change the value of prefix key in the payload. See the AttackString file for examples...

CVE-2025-53632

CVE-2025-53632 This repository contains an exploit of CVE-2025-53632 affecting Chall-Manager !WARNING The way Chall-Manager deals with scenarios, it is still completly exploitable without the zip slip: simply tamper the pulumi binary from the scenario such that the next execution runs your...

RIPPL

RIPPL Manipulating PPL protected processes without using a driver This tool implements a userland exploit to manipulate Windows PPL protected processes. The technique was initially discussed by James Forshaw a.k.a. @tiraniddo and Clément Labro a.k.a. @itm4n in the following blogposts. Blog post...

CVE-2021-4034

Proof of Concept PoC: CVE-2021-4034 PwnKit Note: This repository and its content are part of a Final Degree Project FDP, created solely for educational purposes and academic research. Description This repository contains a proof of concept PoC for the CVE-2021-4034 vulnerability, also known as...

CVE-2023-6000-POC

General Details CVE-ID : CVE-2023-6000 CVSS Score : 6.1 Type : Stored XSS Fixed Version : Popup Builder 4.2.3 This vulnerability allows an attacker to exploit a Cross-Site Scripting XSS flaw in the WordPress Popup Builder plugin. The plugin fails to prevent regular visitors from modifying existin...

CVE-2024-33453

CVE-2024-33453 Sensitive Data Exposure via Object Level Access Control in esp-idf Description A Buffer Overflow vulnerability in the esp-idf framework version 5.1, used by some Schoolbox products, allows a remote attacker to obtain sensitive information through improper object-level access contro...

jboss-autopwn-1

jboss-autopwn JBoss Autopwn as featured at BlackHat Europe 2010 - this version incorporates CVE-2010-0738 the JBoss authentication bypass VERB manipulation vulnerability as discovered by Minded Security C. Papathanasiou 2010 INTRODUCTION This JBoss script deploys a JSP shell on the target JBoss A...

CVE-2025-6218-POC

CVE-2025-6218 Proof of Concept POC Overview This repository contains a simple Proof of Concept POC for CVE-2025-6218 , demonstrating the exploitation of a vulnerability involving WinRAR’s handling of archive extraction paths. The POC batch script creates a ZIP archive that places a batch file int...

CVE-2025-29927

Next.js Middleware Authorization Bypass Vulnerability Test Environment CVE-2025-29927 📌 Project Overview This repository provides a local environment for testing the Next.js middleware authorization bypass vulnerability CVE-2025-29927. This vulnerability allows attackers to bypass middleware...

pip3line

Pip3line Codacy Badge Compilaciones Linux / MacOS Compilaciones Windows Utilidad de manipulación de bytes brutos, capaz de aplicar transformaciones conocidas y menos conocidas, búsqueda binaria rápida, interceptación de proxy de red y más. Instalación en Windows: Descargue el zip de la versión aq...

EUVD-2026-96928

A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the attack is possible. The exploit has been released to the...

CVE-2024-53677

CVE-2024-53677: Apache Struts path traversal to RCE vulnerability A critical security vulnerability, identified as CVE-2024-53677 was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution...

yersinia

Árbol de expansión 1: Ataque DoS enviando BPDUs de configuración ¡Enviemos algunos BPDUs de configuración afirmando ser la raíz!!! Al enviar continuamente BPDUs de configuración con root pathcost 0, ID de puente generado aleatoriamente y por lo tanto el mismo ID raíz, y algunos valores...

kekeo

kekeo kekeo es un pequeño conjunto de herramientas que he comenzado para manipular Microsoft Kerberos en C y por diversión Biblioteca ASN.1 En kekeo, utilizo una biblioteca comercial externa para manejar las estructuras ASN.1 de Kerberos: OSS ASN.1/C...