LocalAI - Partial Local File Read

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery SSRF and partial Local File Inclusion LFI. The endpoint supports both https-// and file-// schemes, where the latter can lead to LFI. However, the output is limited due to the...

CVE-2022-20818

CVE-2022-20818: Local Privilege Escalation via Partial File Read in Cisco SD-WAN The “config - load” feature from Viptela SSH shell uses “wget” to fetch remote “command” files over FTP. By hosting a malicious FTP server and replacing the local files created by wget with symlinks, an attacker can...

cve-2013-1300

This is non-working, but is most of the way to a working exploit... https://labs.mwrinfosecurity.com/blog/2013/09/06/mwr-labs-pwn2own-2013-write-up---kernel-exploit/...

CVE-2024-22275

CVE-2024-22275: Partial File Read in VMware vCenter Server The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data. Vendor...

eaphammer

by Gabriel Ryan s0lst1c3 Current release: v1.14.1 Supports Python 3.9+. Overview EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on...

Apache-Tomcat-CVE-2025-24813-Lab

CVE-2025-24813: Apache Tomcat Detection & Mitigation Lab A defensive cybersecurity portfolio project demonstrating vulnerability research, detection engineering, log correlation, layered mitigation, and technical documentation in an isolated two-VM environment. Project summary This repository...

keepass-password-dumper

KeePass 2.X Master Password Dumper CVE-2023-32784 Update The vulnerability was assigned CVE-2023-32784 and fixed in KeePass 2.54. Thanks again to Dominik Reichl for his fast response and creative fix! Clarification: the password has to be typed on a keyboard, not copied from a clipboard see the H...

packet_edit_meme

PACKETEDITMEME - aka CVE-2026-46331 net/sched actpedit partial-COW page-cache corruption culprit 899ee91156e5, present v5.18 .. fixed v7.1-rc7. packeteditmeme.c turns it into unprivileged local root: a userns CAPNETADMIN child overwrites the cached ELF entry of setuid-root /bin/su with...

CVE-2025-31258-PoC

CVE-2025-31258-PoC 1day practice - Escape sandbox partial using RemoteViewServices...

BaRMIe

BaRMIe BaRMIe is a tool for enumerating and attacking Java RMI Remote Method Invocation services. RMI services often expose dangerous functionality without adequate security controls, however RMI services tend to pass under the radar during security assessments due to the lack of effective testin...

cve-2025-43564-tomcat_put_rce_reproduction

CVE-2025-43564 — Apache Tomcat Partial PUT Request Handling RCE Field| Value ---|--- CVE ID| CVE-2025-43564 CVSS Score| 9.8 CRITICAL Vector| AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-494 — Download of Code Without Integrity Check Exploitation| Confirmed in the wild within one week of disclosur...

HashCheck

PasswordHashCheck This project aims to assist in the search for leaked passwords while maintaining a high level of privacy using the k-anonymity method. To achieve this, the APIs of different services are used, sending only a part of the Hash of the password we want to check, for example, the fir...

CVE-2024-32004

Create tmp repo, set uploadpack.allowfilter to true git init tmp git -C tmp config uploadpack.allowfilter 1 Clone evil from tmp repo git clone --filter=blob:none --no-local --no-checkout tmp evil rm -rf tmp Configure remote filter script git -C evil config remote.origin.uploadpack...

hotpatch-for-apache-log4j2

Log4jHotPatch This is a tool which injects a Java agent into a running JVM process. The agent will attempt to patch the lookup method of all loaded org.apache.logging.log4j.core.lookup.JndiLookup instances to unconditionally return the string "Patched JndiLookup::lookup". It is designed to addres...

CVE-2025-24813

CVE-2025-24813 — Apache Tomcat Partial PUT Deserialization RCE Severity: Critical CVSS 9.8 Auth required: None Affected: Apache Tomcat 9.0.0.M1 – 9.0.98 / 10.1.0-M1 – 10.1.34 / 11.0.0-M1 – 11.0.2 Patched in: Tomcat 9.0.99 / 10.1.35 / 11.0.3 How It Works Apache Tomcat supports partial PUT chunked...

nuclei-CVE-2025-24813

nuclei-CVE-2025-24813 This repository contains a yaml-template, to scan whether a Service may be vulnerable to CVE-2025-24813, without disrupting the server/causing any form of damage, using the vulnerability scanner nuclei. CVE-2025-24813 CVE-2025-24813 is a vulnerability in the Apache Tomcat...

CVE-2026-36848

CVE-2026-36848 A critical path traversal vulnerability was identified in the web-based management engine on port 8089 of Gigamon-VUE OS GVOS appliances. This flaw exists in the legacy H-VUE subsystem within the persistd daemon and allows an unauthenticated, remote attacker with network access to...

CVE-2025-24813

CVE-2025-24813 - Apache Tomcat Remote Code Execution Exploit This is a proof-of-concept PoC exploit for CVE-2025-24813 , a vulnerability in Apache Tomcat 9.0.80–9.0.83, 10.1.0–10.1.17 that allows remote code execution RCE via session deserialization. The exploit abuses partial PUT requests and th...

CVE-2025-24813-PoC-exploit

CVE-2025-24813-PoC-exploit Apache Tomcat Deserialization RCE ❯ python3 exploit.py http://localhost:8080/ "id" ============================================================ CVE-2025-24813 - Apache Tomcat Partial PUT RCE ============================================================ Target:...

vbSparkle

What is vbSparkle ? vbSparkle is a source-to-source multi-platform Visual Basic deobfuscator based on partial-evaluation and is mainly dedicated to the analysis of malicious code written in VBScript and VBA Office Macro. It is written in native C and provides a .Net Standard library , and works o...