exploit-js2py

CVE-2024-28397 - js2py 沙箱逃逸 描述 CVE-2024-28397 漏洞影响 js2py 的 v0.74 及以下版本，这是一个允许在 Python 解释器中执行 JavaScript 代码的 Python 库。 该漏洞存在于 disablepyimport 方法的实现中，该方法本应阻止 JavaScript 代码访问 Python 对象。然而，由于实现缺陷，攻击者可以绕过此限制，在 JavaScript 环境中获取对 Python 对象的引用，从而在主机上执行任意代码。 技术细节 受影响组件： js2py.disablepyimport 受影响版本： 至 v0.7...

detect_bluekeep.py

detectbluekeep.py 用于检测BlueKeep漏洞（CVE-2019-0708）的Python脚本，支持TLS/SSL 本脚本衍生自 @zerosum0x0 编写的Metasploit模块 https://github.com/zerosum0x0/CVE-2019-0708 RC4代码取自 https://github.com/DavidBuchanan314/rc4 前提条件 detectbluekeep.py 需要 pyasn1 和 cryptography 这两个 Python 模块。 可通过以下方式安装： pip install -r requirements.t...

CVE-2023-27350-POC

CVE-2023-27350-POC 一个用于搜索易受攻击版本的PaperCut MF/NG的Python脚本。 更多信息请访问：https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software 注意：此工具仅用于教育目的。使用风险自负。...

crackerjack

!CAUTION This repo is unmaintained, visit https://github.com/sadreck/crackerjack for the latest version. CrackerJack Web Interface for Hashcat by Context Information Security Contents Introduction Architecture Features Limitations Installation Troubleshooting Screenshots License Introduction...

crackerjack

!CAUTION Este repositorio no está mantenido, visita https://github.com/sadreck/crackerjack para la última versión. CrackerJack Interfaz Web para Hashcat de Context Information Security Contenido Introducción Arquitectura Características Limitaciones Instalación Solución de problemas Capturas de...

reverse-ip-new-api

reverse-ip-new-api Esta herramienta se utiliza para realizar búsquedas inversas de IP— buscar todos los dominios alojados en una dirección IP. Características Procesamiento de múltiples hilos Procesamiento basado en API Manejo de errores Personalizar el número de hilos Cómprame un café : Bitcoin ...

CitrixBleedCVE-2026-8452-2025-5777

Herramienta de Explotación CitrixBleed - CVE-2025-5777 y CVE-2026-8452. Lectura remota de memoria no autenticada desde Citrix NetScaler ADC y Gateway. Roba tokens de sesión de administrador, extrae hashes de nsroot, extrae secretos y evita MFA. Exploit en Python 3 con análisis completo de memoria...

CVE-2023-44487

Ataque de restablecimiento rápido HTTP2: CVE-2023-44487 Exploit rápido para probar el ataque de restablecimiento rápido CVE-2023-44487. Nota: Solo con fines educativos Exploit: Exploit rápido para probar el ataque de restablecimiento rápido CVE-2023-44487. Nota: Solo con fines educativos Tabla de...

CVE-2022-1386

git clone https://github.com/satyasai1460/CVE-2022-1386.git cd CVE-2022-1386 apt install python3-pip pip install -r requirements.txt python3 exploit.py...

CVE-2026-100864

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...

CVE-2026-100865

Heym before 0.0.53 evaluates workflow condition expressions using Python's eval with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process use...

PYSEC-2026-4015

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

CVE-2026-100840

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

cve-2023-29357-Sharepoint

CVE 2023 29357 信息 目标 SharePoint（Windows Server 2016 + SharePoint 2019） Login : FSI\Administrateur Password : Admin123! IP : 192.168.56.4 Hostname : WIN-HEVUJ4GJMA6 攻击机 Lubuntu（版本 22.04.3） Login : fsi Password : Admin123! IP : 192.168.56.3 搭建测试环境 启动 SharePoint 虚拟机 cd "Serveur SharePoint" vagrant u...

MySQL-Remote-Root-Code-Execution

MySQL-Remote-Root-Code-Execution 用法 python rcemysql.py -dbuser -dbpass -dbname -dbhost -mycnf...

Wazuh - Unsafe Deserialization Remote Code Execution

A critical Remote Code Execution RCE vulnerability exists in Wazuh server versions = 4.4.0 and = 4.4.0 and 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using...

intel_amt_bypass

intelamtbypass CVE-2017-5689 的简单 POC 用法: python amibypass.py x.x.x.x...

EUVD-2026-87829

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...

CVE-2026-100864 heym before 0.0.91 Remote Code Execution via Expression Engine

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...

CVE-2026-100864 heym before 0.0.91 Remote Code Execution via Expression Engine

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...