penelope

Penelope es un moderno manejador de shells para pentesters y jugadores de CTF. Proporciona una alternativa más capaz a los oyentes básicos de netcat, añadiendo actualización automática de PTY, gestión de sesiones, registro, transferencias de archivos y módulos auxiliares. Tabla de contenidos 📥...

CVE-2025-24813-PoC-Apache-Tomcat-RCE

Apache Tomcat CVE-2025-24813 Proof of Concept PoC A proof-of-concept exploit for the Apache Tomcat deserialization vulnerability CVE-2025-24813. This tool demonstrates how attackers could exploit insecure deserialization in Tomcat's session management. WARNING : This tool is for authorized securi...

EUVD-2026-78768

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

crackerjack

!CAUTION Este repositorio no tiene mantenimiento, visite https://github.com/sadreck/crackerjack para la versión más reciente. CrackerJack Interfaz web para Hashcat de Context Information Security Contenido Introducción Arquitectura Características Limitaciones Instalación Solución de problemas...

CVE-2024-44000-LiteSpeed-Cache

Poc LiteSpeed Cache CVE-2024-44000 Exploit CVE-2024-44000 is a vulnerability in the LiteSpeed Cache plugin, a popular WordPress plugin. This vulnerability affects session management in LiteSpeed Cache, allowing attackers to gain unauthorized access to sensitive data. The script works in the...

smb

SMB A Go package for communicating over SMB. Currently only minimal funcationality exists for client-side functions. Here is a sample client that establishes a session with a server: root@kitploit: package main import "log" "github.com/stacktitan/smb/smb" func main host := "172.16.248.192" option...

CVE-2024-44000-LiteSpeed-Cache

CVE-2024-44000-LiteSpeed-Cache CVE-2024-44000は、人気のWordPressプラグインであるLiteSpeed Cacheプラグインの脆弱性です。この脆弱性は、LiteSpeed Cacheのセッション管理に影響を与え、攻撃者が機密データに不正アクセスできるようにします。 プレビュー 使い方？ root@kitploit: git clone https://github.com/ifqygazhar/CVE-2024-44000-LiteSpeed-Cache.git ディレクトリに移動 root@kitploit: cd...

POS Codekop v2.0 - Broken Authentication

A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data. id: CVE-2023-36347 info: name: POS Codekop v2.0 - Broken Authentication author: princechaddha severity: high description: | A broken authentication mechanism ...

Tenda AC1200 V-W15Ev2 - Authentication Bypass

The Tenda AC1200 V-W15Ev2 router is affected by improper authorization/improper session management. The software does not perform or incorrectly perform an authorization check when a user attempts to access a resource or perform an action. This allows the router's login page to be bypassed. The...

openclaw-dashboard

OpenClaw 에이전트 대시보드 OpenClaw 에이전트를 위한 아름답고 안전하며 실시간 모니터링 대시보드입니다. 세션 추적, API 사용량 모니터링, 비용 확인, 메모리 파일 관리, 시스템 상태 확인을 한곳에서 수행할 수 있습니다. 📸 스크린샷 개요| 세션| 비용 ---|---|--- | | 속도 제한| 라이브 피드| 로그 ---|---|--- | |...

CVE-2026-88262

Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. This issue affects xClick: R2, R3, and R3.1...

CVE-2024-2044

PoC CVE-2024-2044: pgAdmin 4 Authenticated RCE Linux/POSIX Repositori ini berisi skrip Proof of Concept PoC untuk CVE-2024-2044 , sebuah kerentanan kritis yang menggabungkan Authenticated Path Traversal dan Unsafe Deserialization pada pgAdmin 4 versi 8.3 ke bawah yang berjalan di lingkungan...

crackerjack

!CAUTION This repo is unmaintained, visit https://github.com/sadreck/crackerjack for the latest version. CrackerJack Web Interface for Hashcat by Context Information Security Contents Introduction Architecture Features Limitations Installation Troubleshooting Screenshots License Introduction...

TornadoRevC2

TornadoRevC2 A lightweight, modular post-exploitation framework for authorized security research, red-team operations, and penetration testing. TornadoRevC2 manages reverse shell sessions on Linux and Windows hosts through a unified operator console, extending core session handling with a...

SecureForce

SecureForce - ペネトレーションテストフレームワーク 認可されたセキュリティテストおよび競技分析用に構築された、簡素化されつつも高性能なペネトレーションテストフレームワークです。SecureForceは、エクスプロイト管理、ペイロード生成、および制御された悪用のための直感的なインターフェースを提供します。 特徴 エクスプロイトライブラリ : さまざまな脆弱性に対応する整理されたエクスプロイトモジュール ペイロード生成 : マルチフォーマットのペイロード作成（シェルコード、リバースシェルなど） 対話型コンソール : 攻撃オーケストレーションのためのコマンド駆動型インターフェース...

CVE-2025-54309__Enhanced_exploit

CVE-2025-54309Enhancedexploit This is a enhanced version of the exploit POC originally created by watchtowrlabs : https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309 massive shoutout to them!! This exploit is meant for research and education purposes and th...

EUVD-2026-75541

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

Exploit-For-CVE-2026-18963

CVE-2026-18963 — Keycloak Unauthenticated Account Takeover CVSS 9.1 Critical · Keycloak 26.0.0 – 26.7.1 · Unauthenticated A critical vulnerability in Keycloak's reset-credentials flow that allows an unauthenticated attacker to take over any user account without email verification by chaining two...

DAEnetIP4 METO v1.25 - Session Hijacking

DAEnetIP4 METO v1.25 contains improper session management in the /loginok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens. id: CVE-2025-28242 info: name: DAEnetIP4 METO v1.25 - Session Hijacking author: 0xAkoko severity: high...

CVE-2026-85105

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function sessnowait of the file s71.py of the component Session Management. This manipulation of the argument sessionid causes authorization bypass. The attack can be initiated remotely. The vendor was...