Progress ShareFile Storage Zones Controller - Authentication Bypass

Customer Managed ShareFile Storage Zones Controller SZC contains an authentication bypass Execution After Redirect that allows unauthenticated attackers to access restricted configuration pages. This leads to changing system configuration and potential remote code execution. id: CVE-2026-2699 inf...

centipede

Centipede - a distributed fuzzing engine. Work-in-progress. Why Centipede Why not? We are currently trying to fuzz some very large and very slow targets for which libFuzzer, AFL, and the like do not necessarily scale well. For one of our motivating examples see SiliFuzz. While working on Centiped...

Purpleteam

Purpleteam work in progress Scripts i made to trigger events for SOC detections, mapped to MITRE ATT&CK techniques...

watchTowr-vs-progress-moveit_CVE-2024-5806

CVE-2024-5806 Exploit for Progress MOVEit Transfer CVE-2024-5806. See our blog post at TBD. PoC in Action See --help for, well, help. A typical run should look like this: python CVE-2024-5806.py --target-ip 192.168.1.1 --target-user user2 --ppk id.ppk --pem id / | | |\ \ \ / / \ \ / | | | | / ...

how_to_become_a_malware_analyst

How to Study to Become a Malware Analyst work-in-progress This is @PINKSAWTOOTH's personal opinion and may not necessarily be the best method for you. I hope you can refer to it as one example of a study method. Before reading this, the malware analyst I respect, @hasherezade, has written a blog...

CVE-2026-24061

CVE-2026-24061 Exploit - Work Version v0.1 Usage Run the script with a target host: python3 exploit.py 192.168.1.1 -p 2323 --debug Arguments positional arguments: target IP or hostname of the target options: -h, --help show this help message and exit -p, --port PORT Port default 23 --debug Enable...

Automated-blind-xss-search-for-Burp-Suite

Femida-xss WIP An automated blind-xss search plugin for Burp Suite. Installation Git clone https://github.com/ianxtianxt/Automated-blind-xss-search-for-Burp-Suite.git Burp - Extender - Add - find and select blind-xss.py How to use Settings First of all you need to setup your callback URL in field...

CVE-2023-0386

CVE-2023-0386 WIP...

CVE-2020-25705

CVE-2020-25705 PoC for CVE-2020-25705 POC-2020-25705 This is a work in progress. I'll finish it on Monday :p but there is likely enough here already for you to complete it...

CVE-2019-18935

CVE-2019-18935 Nuclei Template - Bounty Submission This repository contains a complete, validated Nuclei template for detecting CVE-2019-18935 Telerik UI for ASP.NET AJAX Deserialization RCE, created for the ProjectDiscovery bounty program. 🎯 Overview CVE-2019-18935 is a critical .NET...

CVE-2024-1212

CVE-2024-1212 - Progress Kemp LoadMaster Unauthenticated Command Injection This is an exploit script for CVE-2024-1212 , an unauthenticated command injection vulnerability in Progress Kemp LoadMaster. Vulnerability Summary CVE-2024-1212 affects Progress Kemp LoadMaster , allowing unauthenticated...

Telerik UI for ASP.NET AJAX 2010.1.309 < 2026.2.708 Multiple RadAsyncUpload Vulnerabilities

The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is 2010.1.309 or later and prior to 2026.2.708. It is, therefore, affected by multiple vulnerabilities: - In Progress Telerik UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can...

certipy-merged

certipy-merged This repository contains a fork of ly4k/Certipy with many open pull requests merged, made compatible with each other, and tested to a certain degree. As this is a work in progress , some features may or may not work as expected and things might break. Installation Using pipx...

patch-CVE-2026-03200

Patch: CVE-2026-03200 Vulnerability Details CVE : CVE-2026-03200 Product : Progress MOVEit Description : SQL injection Severity : Critical Patch Status: DEPLOYED Field| Value ---|--- Patch Date| 2026-01-15 Status| deployed Deployed To| Production Validated By| SecOps Team References NVD CISA KEV...

CVE-2026-86158

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86157

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

EUVD-2026-88649

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86158

Progress Software Fiddler Everywhere 8.0.2 contains a vulnerability due to missing authentication in its local .NET backend (Fiddler.WebUi ). A local unauthenticated attacker can exploit unauthenticated localhost HTTP and SignalR RPC channels to mint OAuth tokens and read the machine-in-the-middl...

CVE-2026-86158 Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86158 Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...