GNUnet P2P Framework 0.26.2

GNUnet is a peer-to-peer framework with focus on providing security. All peer-to-peer messages in the network are confidential and authenticated. The framework provides a transport abstraction layer and can currently encapsulate the network traffic in UDP IPv4 and IPv6, TCP IPv4 and IPv6, HTTP, o...

CVE-2026-90771

joi (the Hapi.js validation library) before versions 17.13.8 and 18.2.9 is affected by a prototype pollution vulnerability in the messages compilation function . The root cause is that the function accepts __proto__ as a valid error code, allowing an attacker to supply __proto__ keys in custom er...

EUVD-2026-76992

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on...

CVE-2025-67733

RESP Protocol Injection PoC Proof-of-concept demonstrating RESP Protocol Injection vulnerability via Lua script error messages in Valkey/Redis. Files backend.py Flask backend simulating a web application with shared Valkey connection connection pooling. Endpoints:...

CVE-2023-51764

CVE-2023-51764 Postfix SMTP Smuggling - POC de script Expect envía un correo electrónico legítimo, pero dentro del correo hay muchos otros correos diferentes remitentes, destinatarios, asunto, etc.. El correo inicial se verifica con SPF/DKIM/DMARC, ¡los demás que están dentro no! uso:...

spring-boot-log4j-cve-2021-44228-docker-lab

Spring Boot Log4j - CVE-2021-44228 The Log4Shell vulnerability CVE-2021-44228 ultimately is a quite simple JNDI Injection flaw, but in a really really bad place. Log4J will perform a JNDI lookup while expanding placeholders in logging messages or indirectly as parameters for formatted messages...

cve-2016-1764

PoC Exploit Code for CVE-2016-1764 Recovery of Plaintext iMessage Data Without Breaking Crypto Authors Shubham Shah from Bishop Fox Joe DeMesy from Bishop Fox Matthew Bryant CVE-2016-1764 Vendor: Apple Release Date: April 8, 2016 Patch Date: March 21, 2016 Systems Affected: Messages on OSX Mounta...

TLS-Attacker

TLS-Attacker TLS-Attacker es un framework basado en Java para analizar bibliotecas TLS. Es capaz de enviar mensajes de protocolo arbitrarios en un orden arbitrario al par TLS, y definir sus modificaciones utilizando una interfaz proporcionada. Esto le brinda al desarrollador la oportunidad de...

Ghost CMS - User Enumeration

Ghost CMS 5.9.4 contains a user enumeration vulnerability in the login functionality. The application reveals whether a user account exists through different error messages, allowing attackers to enumerate valid user accounts via specially-crafted HTTP requests. id: CVE-2022-41697 info: name: Gho...

WordPress User Messages <= 1.2.4 - Reflected XSS

WordPress User Messages plugin = 1.2.4 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires victim to load a...

git-vuln-finder

git-vuln-finder Encontrando posibles vulnerabilidades de software a partir de mensajes de confirmación de git. El formato de salida es un JSON con la confirmación asociada que podría contener una corrección relacionada con una vulnerabilidad de software. La búsqueda se basa en un conjunto de...

twittor

Twittor Un backdoor sigiloso basado en Python que utiliza Twitter Mensajes Directos como servidor de comando y control. Este proyecto ha sido inspirado por Gcat que hace lo mismo pero usando una cuenta de Gmail. Configuración Para que esto funcione necesitas: Una cuenta de Twitter ¡Usa una cuenta...

CVE-2020-17008

CVE-2020-17008 splWOW64 Elevación de Privilegios C:\Windows\splwow64.exe Poc From: https://bugs.chromium.org/p/project-zero/issues/detail?id=2096 0x01 establecer splwow64poc.exe Low cd splwow64poc\x64\Release icacls splwow64poc.exe /setintegritylevel L root@kitploit: /setintegritylevel CIOI nivel...

CFB

¿Qué es? !CAUTION CFB está pensado para fines de investigación y depuración, nunca debe usarse en sistemas de producción. También es posible que ocurra un BSoD. Has sido advertido. Canadian Furious Beaver es una herramienta al estilo ProcMon diseñada únicamente para capturar IRP enviados a...

EvilSlackbot

EvilSlackbot Un marco de ataque para Slack para realizar ejercicios de Red Team y phishing en espacios de trabajo de Slack. Aviso legal Esta herramienta está destinada únicamente a profesionales de la seguridad. No utilice esta herramienta contra ningún espacio de trabajo de Slack sin permiso...

CVE-2025-51400

Exploit Title: LiveHelperChat =4.61 - Stored Cross Site Scripting XSS via Personal Canned Messages Date: 09/06/2025 Exploit Author: Manojkumar J TheWhiteEvil Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/ Software...

DEBIAN-CVE-2026-80986

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has maxrecvsge == 1 there is no shared v2 receive buffer, and smcllcsaveaddlinkrkeys takes the v2 extension from 44 bytes past the start of the...

CVE-2026-80986

CVE-2026-80986 affects the Linux kernel's SMC-Rv2 (Shared Memory Communications over RDMA v2) network subsystem. The flaw is in smc_llc_save_add_link_rkeys() : when a link's device has max_recv_sge == 1 , the v2 extension is read from offset 68 of a 72-byte slab allocation, so ext-&gt;num_rkeys a...

CVE-2026-80985

CVE-2026-80985 is a vulnerability in the Linux kernel's SMC-Rv2 (Server Message and Control over Remote Direct Memory Access) protocol. The functions smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read oversized LLC messages by bounding themselves to the size of the receive buffer ra...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...