DNSHighJackMonitoring

DNS High Jack Monitoring Overview Trade craft scripts to aid with detecting DNS high jacking attempts after the disclosures in January 2019 https://www.us-cert.gov/ncas/alerts/AA19-024A https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html...

Nim_DInvoke

Nim DInvoke D/Invoke implementation in Nim All Nim binaries typically expose the same 58-60 Windows API functions: All other Windows API functions are typically resolved on runtime via GetProcAddress and LoadLibraryA as mentioned in OffensiveNim or this blog post. So, it's not possible to hide AP...

CVE-2025-55182

CVE-2025-55182 RCE Self-use checking tool for CVE-2025-55182 vulnerability Vulnerability Principle React Server Components has a path resolution flaw when decoding payloads sent to server function endpoints. It uses colon-separated object properties to implement nested value access e.g., $1🅰️b...

CVE-2020-8277

CVE-2020-8277 For educational purposes only. Quick Run clone this repository $ git clone https://github.com/masahiro331/CVE-2020-8277 run bind $ docker build -t bind-local ./bind Need TCP fallback $ docker run --rm --name bind -it -p 53:53 -p 53:53/udp bind use " v15.2.1" version If you use fixed...

D1rkLdr

D1rkLdr Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscall instruction address resolving at run time...

hostresolver

==================================================================================== HostResolver Current version: 1.0.0 Send comments and bug reports to: [email protected] ==================================================================================== Contents: 1. Overview 2. Using...

CVE-2026-12227-visualcomposer-lfi-poc

CVE-2026-12227 - Visual Composer Unauthenticated LFI via vcv-template Validation Lab Security-research material for reproducing and validating CVE-2026-12227 : an unauthenticated local file inclusion in Visual Composer Website Builder's page-template resolution CVSS 3.1 9.8, plus a verified...

cve-2025-55182-react2shell_reproduction

CVE-2025-55182 — React2Shell CVSS 10.0 CRITICAL | Pre-Auth Remote Code Execution in React Server Components Discovered by Chinese threat actors. Actively exploited by China-nexus APT groups. Overview Dubbed "React2Shell" , this vulnerability enables unauthenticated remote code execution via unsaf...

CVE-2026-26030-Microsoft-Semantic-Kernel-1.39.4-RCE

Microsoft Semantic Kernel BPassed to VectorStore query/filter B -- CInMemoryVectorStore evaluates filter expression unsafely C -- DUnsafe attribute resolution via class / base / subclasses D -- EAccess to init.globals containing os and builtins E -- FArbitrary code execution e.g. os.system F --...

explain-my-curl

explain-my-curl explain-my-curl is a local-first CLI for understanding what a curl command is doing across DNS, TLS, and HTTP. This repository currently includes: A CLI command to parse and explain a curl input A starter TUI for interactive exploration Execution telemetry for DNS, TCP connect, TL...

Citrix-NetScaler-Memory-Leak-CVE-2025-5777

CVE-2025-5777 – Citrix NetScaler Memory Leak Updated PoC This repository contains an updated Proof-of-Concept PoC for exploiting CVE-2025-5777 – a memory leak vulnerability affecting Citrix NetScaler. The original PoC by 0xgh057r3c0n works perfectly, but some users reported connection errors due ...

CVE-2018-1058

CVE-2018-1058 — PostgreSQL Search Path Demonstration This repository contains the final report and the reproducibility artifacts for: CVE-2018-1058: Privilege Escalation in PostgreSQL through Uncontrolled Search Path The goal is to demonstrate the search-path trust failure behind CVE-2018-1058...

CVE-2026-0776

CVE-2026-0776 - Discord Client Uncontrolled Search Path Element Summary This repository documents CVE-2026-0776, a local code execution issue affecting the Discord Desktop Client on Windows. The vulnerability is related to unsafe module resolution behavior in Node.js-based components, which may...

CVE-2021-22053

CVE-2021-22053 CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability Description Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-115713

Elastic Cloud Enterprise (ECE) is affected by a Symlink Attack (CWE-59) due to improper link resolution before file access. This vulnerability allows an attacker who can already execute code inside an Enterprise Search instance container to gain unauthorized read and write access to data belongin...

CVE-2026-115709 Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss

Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack CAPEC-132...

EUVD-2026-112916

A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlis...

CVE-2026-118425

A flaw exists in the secure-redirect-uris-enforcer client policy of Keycloak , an identity and access management solution. The vulnerability arises when the policy is configured to allow loopback addresses because Keycloak performs DNS resolution during hostname validation. An attacker can bypass...

CVE-2025-32463

CVE-2025-32463 Exploit --- Proof-of-Concept PoC DISCLAIMER: This repository contains a proof-of-concept intended only for educational, defensive research, and authorized penetration testing. Do NOT use this code on systems you do not own or do not have explicit written permission to test...