CVE-2026-104906

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

VeeamDumper-BOF

Veeam Dumper BOF A credential extraction BOF for Veeam Backup and Replication and Veeam One by Stephen Munro and Logan Kroeger from @MWRCyberSec. The BOF needs to be executed in an Admin beacon on either a Veeam One or Veeam Backup and Replication server and supports Cobalt Strike and Outflank C2...

CVE-2026-48909

CVE-2026-48909 — SP LMS PHP Object Injection → RCE Unauthenticated Remote Code Execution via PHP Object Injection in JoomShaper SP LMS comsplms ≤ 4.1.3 for Joomla CMS. Author: Amin İsayev / Proxima Cyber Security Overview SP LMS is a popular Joomla Learning Management System extension by JoomShap...

Spring4Shell-CTF

Spring4Shell CVE-2022-22965 Vulnerability Environment Setup and CTF Challenge Design Project Overview This project includes dual-track security research implementations: 1. Traditional Vulhub Environment Setup : Leveraging the open-source Vulhub vulnerability database to quickly reproduce the...

InlineExecute-Assembly

InlineExecute-Assembly InlineExecute-Assembly is a proof of concept Beacon Object File BOF that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module. InlineExecute-Assembly will execute any...

CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

EUVD-2026-91742

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

pybof

PyBOF Run Beacon Object files through python in-memory loading and execution of BOFs PyBOF enables Python3 to load Beacon Object Files via bytes and execute a target BOF function in a Python interpreter Basic Usage Run a simple BOF with no required arguments data = openr'c:\path\to\example.o',...

frigate

Frigate NVR™ - IPカメラ向けリアルタイム物体検出 English | 简体中文 AI物体検出機能を備えた、Home Assistant向けに設計された完全なローカルNVRです。OpenCVとTensorflowを使用して、IPカメラ向けにローカルでリアルタイムの物体検出を実行します。 GPUまたはAIアクセラレータの使用を強くお勧めします。AIアクセラレータは、ほんのわずかなオーバーヘッドで最高のCPUをも上回る性能を発揮します。Frigateがサポートする物体検出器をご覧ください。 カスタムコンポーネントによるHome Assistantとの緊密な統合...

nysm

nysm ステルスなポストエクスプロイテーションコンテナ。 目次 1. はじめに 2. インストール 2.1 要件 2.2 Linux ヘッダー 2.3 ビルド 3. 使用方法 3.1 例 4. 仕組み 4.1 全般 4.2 eBPF オブジェクトを隠す 4.3 Auditd ログを隠す 4.4 PID を隠す 4.5 ソケットを隠す 5. 制限事項 はじめに eBPF ベースの攻撃ツール（資格情報窃取ツールから自身の PID を隠すルートキットまで）の人気が高まるにつれ、ある疑問が浮かびました： eBPF を eBPF 自身から不可視にすることは可能だろうか？ そこから nysm...

CVE-2026-93399

CVE-2026-93399 — Bookly IDOR（订单令牌泄露与预约回滚） 针对 Bookly （bookly-responsive-appointment-booking-tool）中 CVE-2026-93399 的 Python 3 PoC。 描述（PoCbit / GitHub） CVE-2026-93399 — Bookly ≤ 28.2 在公开预约 AJAX 接口中存在不安全的直接对象引用 （CWE-639）：booklygetformid 会将攻击者可控的 orderid 存入表单会话，而 booklyrendercomplete...

ysoserial.net

A proof-of-concept tool for generating payloads that exploit unsafe .NET object deserialization. Description ysoserial.net is a collection of utilities and property-oriented programming "gadget chains" discovered in common .NET libraries that can, under the right conditions, exploit .NET...

ermir

Ermir Ermir is an Evil/Rogue RMI Registry, it exploits unsecure deserialization on any Java code calling standard RMI methods on it list/lookup/bind/rebind/unbind. Requirements Ruby v3 or newer. Installation Install Ermir from rubygems.org: $ gem install ermir or clone the repo and build the gem:...

EventViewerUAC_BOF

EventViewerUACBOF This is a Beacon Object File implementation of the Event Viewer deserialization UAC bypass discovered by @orange8361 and the POC put together by CsEnox. Tested on x64 Win10/Win11 OPSEC WARNINGS! This UAC bypass performs the following actions which should be considered in referen...

cve-2017-7494

Basic Setup Install Samba version 4.5.9 https://download.samba.org/pub/samba/stable/samba-4.5.9.tar.gz https://wiki.samba.org/index.php/BuildSambafromSource Get patched version of Impacket pip install -r requirements.txt Usage 1. Start Samba server in interactive mode + debug print sudo...

pylibemu

Pylibemu |version badge| |downloads badge| .. |version badge| image:: https://img.shields.io/pypi/v/pylibemu.svg :target: https://pypi.python.org/pypi/pylibemu/ .. |downloads badge| image:: https://img.shields.io/pypi/dm/pylibemu.svg :target: https://pypi.python.org/pypi/pylibemu/ Pylibemu is a...

haptyc

Haptyc Test Generation Framework What's Haptyc? Haptyc is a python library which was built to add payload position support and Sniper/Clusterbomb/Batteringram/Pitchfork attack types into Turbo Intruder. While Haptyc accomplishes these goals fairly well it also introduces a simpler way to express...

CVE-2025-24813-Scanner

CVE-2025-24813 Scanner A multi-threaded vulnerability scanner to detect Apache Tomcat servers vulnerable to CVE-2025-24813 arbitrary file upload leading to RCE. Description This scanner checks for Apache Tomcat servers vulnerable to CVE-2025-24813 by: 1. Attempting to upload a serialized Java...

the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602 — phpIPAM row id=2, appsecurity=sslcode 2 fetchobject'api','appcode','2' phpipam-token header - OBJECT cache hit! 3 $appid == $apptemp-appid - AUTHENTICATED $ php poccachecollision.php fixed 2 fetchobject'api','appcode','2' phpipam-token header - false 3 Response: 401 Unauthorized ...