WP_CROP_RCE

WordPress Image CROP RCE Analysis Report POC & Dockerfile : https://github.com/synod2/WPCROPRCE This document covers CVE-2019-8942 and CVE-2019-8943, known as WordPress Image CROP RCE, which are vulnerabilities found in WordPress versions prior to 4.9.9 and 5.0.1. CVE Number| Disclosure Date|...

CVE-2026-58424

CVE-2026-58424 - Gitea Fork PR Workflow Approval Gate Bypass Severity: High CVSS 8.9 Affected: Gitea ≤ 1.26.2 Fixed in: Gitea 1.26.3 Advisory: GHSA-777r-4v59-6486 Vulnerability Description Gitea Actions enforces an approval gate on workflow runs triggered by fork pull requests. The gate is...

CVE-2026-46645-Analysis-Lab

CVE-2026-46645 - SQLAdmin ajaxlookup Authorization Bypass Executive Summary This repository contains a local Docker lab for reproducing CVE-2026-46645, an authorization bypass vulnerability affecting SQLAdmin's ajaxlookup endpoint. SQLAdmin is an admin interface for SQLAlchemy models in Starlette...

CVE-2024-42327_Zabbix_SQLI

CVE-2024-42327 - Zabbix SQL Injection Vulnerability SQLI Not blind and not time based POC for CVE-2024-42327, an authenticated SQL Injection in Zabbix through the user.get API Method. This POC is not time based like some of the other POCs I have seen out there. CVE Description The vulnerability...

CVE-2025-39596

CVE-2025-39596 Quentn WP -e options Required Arguments: -u, --url Target WordPress site URL e.g., http://127.0.0.1/wordpress -e, --email Email for the new admin account Optional Arguments: -f, --fname First name default: Pwn -l, --lname Last name default: Admin -r, --role Role to assign default:...

trivy

Trivy GitLab CI Component A GitLab CI component for Trivy — the all-in-one security scanner covering container images, filesystems, repositories, Kubernetes clusters, SBOMs, and license compliance. Plug these templates directly into your pipelines to get repeatable scans, GitLab-native reports, a...

CVE-2025-49132

CVE-2025-49132 - Pterodactyl Panel Exploit ⚠️ Disclaimer : This repository is created for educational and research purposes only as part of my security research to understand and document CVE-2025-49132. All credit for the vulnerability discovery goes to the original researchers. / |\ \ / /| | | /...

CVE-2025-25279-Mattermost-Path-Traversal

🔥 CVE-2025-25279 — Mattermost 10.4.1 📤 Path Traversal in Focalboard allowing file exfiltration 🌟 Presentation This proof of concept demonstrates the exploitation of vulnerability CVE-2025-25279 affecting Mattermost 10.4.1. A flaw in Focalboard the board management module allows arbitrary file...

CVE-2019-19204

CVE-2019-19204 An issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function fetchintervalquantifier formerly known as fetchrangequantifier in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read. Researcher: ManhND of The Tarantula Team,...

BlockChainConstruction

Preface In this article, we mainly introduce several aspects of public chain audit which are worthy of attention. For security auditors and public chain developers, this is a project worthy of reference and thinking. Architecture Before introducing the construction of public chain system, let's...

arya

Arya - The Reverse YARA Arya is a unique tool that produces pseudo-malicious files meant to trigger YARA rules. You can think of it like a reverse YARA because it does exactly the opposite - it creates files that matches your rules. You can read more about Arya and how it works in our blog. Intro...

goshs

You're mid-engagement. You need to transfer a file, catch an SMB hash, or stand up a quick HTTPS server — and python3 -m http.server won't cut it. goshs is a single-binary file server built for the moments when you need more than Python's SimpleHTTPServer but don't want to configure Apache. HTTP/...

AllTools

AllTools All reasonably stable tools AccessMask - decode access mask for common object types BgInfo - WPF version of the Sysinternals BgInfo tool BITSMgr - BITS jobs manager application CLR Explorer - View .NET process information / dump file CpuStres - thread/CPU stress testing app CpuStress...

CVE-2025-3248

CVE-2025-3248 Exploit Tool Documentation Introduction This tool is used to exploit the CVE-2025-3248 vulnerability a Python-based code injection vulnerability to achieve remote command execution RCE on the target server by crafting malicious payloads. The vulnerability exists in a web application...

AAMVA-PDF417-Vulnerability-Research

PDF417 ID Validation Vulnerability Research Overview This repository contains comprehensive security research documenting critical vulnerabilities in AAMVA-standard PDF417 barcode validation systems affecting government IDs, enterprise solutions, and consumer applications. The research includes a...

CVE-2014-6271

CVE-2014-6271 - Shellshock.py Shellshock exploit aka CVE-2014-6271. Tested on Bash 3.2 and Bash 4.2. For more information about the vulnerability visit : https://nvd.nist.gov/vuln/detail/CVE-2014-6271 Note The exploit was mainly tested on Hack The Box in the following boxes: Beep box :...

king-phisher

King Phisher Phishing Campaign Toolkit King Phisher is no longer being maintained. Installation For instructions on how to install, please see the INSTALL.md file. After installing, for instructions on how to get started please see the wiki. Overview King Phisher is a tool for testing and promoti...

WPSniper

WPSniper CVE-2026-87902 detector for WordPress Core. getpagetemplate can be steered so page-template resolution includes a readable local .php file outside the active theme. WPSniper fingerprints the site, picks a published pageid, probes the include class, and only prints VULN when a strong PEAR...

Elite

Deprecated Temporarily The parent Covenant project no longer requires a client-side application. Elite has temporarily been deprecated. Please instead use the web interface included with the Covenant project. Elite may eventually be brought up-to-date with the Covenant project as an alternative...

usbsas

usbsas is a free and open source GPLv3 tool and framework for securely reading untrusted USB mass storage devices. Overview Following the concept of defense in depth and the principle of least privilege, usbsas's goal is to reduce the attack surface of the USB stack. To achieve this, most of the...