polkit-auto-exploit

polkit-auto-exploit Automatic Explotation PoC for Polkit CVE-2021-3560 Summary CVE-2021-3560 is an authentication bypass on polkit, which allows unprivileged user to call privileged methods using DBus, in this exploit we will call 2 privileged methods provided by accountsservice CreateUser and...

ghost-cve-2026-26980

CVE-2026-26980 — Ghost CMS Content API SQL Injection Lab Unauthenticated blind SQL injection in Ghost CMS via the Content API's slug filter ordering mechanism, allowing arbitrary database reads from any Ghost instance without credentials. | ---|--- CVE| CVE-2026-26980 Advisory| GHSA-w52v-v783-gw9...

CVE-2025-4389

CVE-2025-4389 Exploit Details Published : May 16, 2025 Updated : May 17, 2025 Severity : Critical CVSS Score: 9.8 CWE : CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type Affected Versions : All versions from n/a through 2.6.8.1 Researcher :...

RCity-CVE-2024-27198

RCity - CVE-2024-27198 RCE & Admin Account Creation & CVE-2024-27199 Auth Bypass Exploiting CVE-2024-27198 & CVE-2024-27199 RCity is a Python script that interacts with a vulnerable TeamCity server. The CVE facilitates for unauthorised admin account creation, bypassing 403's on the domain. Whilst...

apche_unomi_rce

CVE-2020-13942 Original blog post about the vulnerability: https://www.checkmarx.com/blog/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/ There are two RCE vectors: through MVEL injection and through OGNL injection. Both vectors target different code though the payloads look relativel...

Awesome-Pentest

Awesome Pentest Tools and Resources A list of awesome penetration testing tools and resources. Contents Antivirus Evasion Tools AWS File Viewers and Pretty Printers Hardware Security CAN Bus Logic Analyzers Misc Hardware Tools Hash Cracking Tools Hex Editors Lab Setup Mobile Security Android iOS...

CVE-2021-26700

RCE in NPM VSCode Extension Fixed 10th February 2021 in https://github.com/microsoft/vscode-npm-scripts/commit/cdd5e507564e0cc0f60bcccf184822be3fd73e07 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26700 Summary Remote code execution vulnerability in the eg2.vscode-npm-script...

morf

MORF Mobile Reconnaissance Framework A powerful offensive security toolkit for mobile application analysis Find Secrets. Protect Apps. Stay Secure. 📋 Table of Contents 💡 Overview 🚀 Quick Start 🔍 Key Features 🏗️ Architecture 📋 Common Use Cases 📦 Installation Prerequisites Method 1: Docker...

DigiDuck-Framework

DigiDuck Framework Framework for Digiduck Development Boards running ATTiny85 processors and micronucleus bootloader! alt text Screenshot of DDF Welcome Screen Roadmap: Plan to implement a command for Duckyspark translation within the framework. Requirements: - ATTiny85 or other compatible...

CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-

CVE-2025-8088 WinRAR Proof of Concept PoC-Exploit This repository contains a Proof of Concept PoC script for CVE-2025-8088 , a path traversal vulnerability in WinRAR versions up to 7.12. This PoC demonstrates how attackers could exploit the vulnerability to place malicious files outside the...

CVE-2026-28576-poc

CVE-2026-28576: SQL Injection in the Android Contacts Provider One picked contact, every contact: a targetSdk compat gate turns a single-contact picker grant into a full contacts database dump. Android 17 hardened the Contacts Provider against SQL injection with setStrictColumns / setStrictGramma...

CVE-2024-27631

CVE-2024-27631 Vulnerability Details Overview In Savane v3.12 and prior, a lack of CSRF protection on administrative functions can allow for privilege escalation and/or account takeover. In particular, the endpoint /siteadmin/usergroup.php includes the functionality to change the passwords and...

CVE-202122986-EXP

F5 BIG-IP Remote Command Execution Vulnerability CVE-2021-22986 Affected Versions F5 BIG-IP 16.x: 16.1.0.3 F5 BIG-IP 15.x: 15.1.0.4 F5 BIG-IP 14.x: 14.1.2.6 F5 BIG-IP 13.x: 13.1.3.4 F5 BIG-IP 12.x: 12.1.5.2 F5 BIG-IP 11.x: 11.6.5.2 fofa iconhash="-335242539" POC POST /mgmt/tm/util/bash HTTP/1.1...

CVE-2020-36184

Description FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. How to RCE pom.xml 4.0.0 com.jacksonTest jacksonTest 1.0-SNAPSHOT com.fasterxml.jackson.core...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE Exploit An automated exploit and scanner for CVE-2025-34085 , a critical vulnerability in the WordPress Simple File List plugin, enabling unauthenticated remote code execution through arbitrary file upload and rename functionalities....

CVE-2026-42945

CVE-2026-42945 - NGINX Rift Vulnerability Analysis and Reproduction Overview CVE-2026-42945 codename "NGINX Rift" is a heap buffer overflow vulnerability in the NGINX ngxhttprewritemodule, with a CVSS v4 score of 9.2 Critical. Discovered by the depthfirst security research team in April 2026, thi...

expat_2_1_0_CVE-2024-28757

Expat, Release 2.1.0 This is Expat, a C library for parsing XML, written by James Clark. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in the...

tac_plus-pre-auth-rce

tacplus Pre-Auth Remote Command Execution Vulnerability This repository contains information about a pre-auth remote command execution vulnerability in different open-source implementations of tacplus. The following two forks are affected: Shrubbery Networks tacplus Facebook tacplus However, both...

CVE-2025-27591

CVE-2025-27591 introduction below versions v0.9.0 are vulnerable to a local privilege escalation vulnerability duo to the fact that the program creates a world-writable log file, an a world writable log file instead, the attacker can replace the log file with a symblink to any system-critical fil...

CVE-2021-35042

CVE-2021-35042: Django SQL injection vulnerability I. Overview Django is an open-source Web Application Framework written in Python, built on the MVC Model - View - Controller model. It was originally built to manage news content websites owned by the Lawrence publishing corporation, as a CMS...