burp_global_match_replace

Global Match & Replace GMR Burp Suite Extension Global Match & Replace GMR extends Burp Suite with match/replace rules to apply globally or across multiple tools of your choice Repeater, Intruder, Proxy, etc.. It provides per-request and response diffs so you can see exactly what changed. This...

poc-cribl-rce

Disclaimer This is for informational/educational purposes only. This was put together to demonstrate an insecurity in the tool, in order for a fix to be verified by the vendor. Info Tested on Cribl v1.5.0 - Previous versions not tested but likely vulnerable. A valid JWT token can be transfered fr...

citrix_adc_netscaler_lfi

citrixadcnetscalerlfiscan !alt textcitrix This Metasploit-Framework module can be use to help companies to check the last Citrix vulnerabilites disclosed July 08, 2020. CVE-2020-8193 CVE-2020-8195 CVE-2020-8196 Public reporting on July 8th, 2020 by Donny Maasland discussed how the vulnerability...

ExploitVeer

CVE-2025-5777: The Ultimate Scanner 🚀 🔐 CVE: CVE-2025-5777 🚨 Severity: Critical 👨‍💻 Author: Virendra Kumar & CyberLeelawat 📜 License: MIT An advanced, powerful, and easy-to-use tool designed to detect and exploit CVE-2025-5777 aka CitrixBleed 2. This script not only identifies the memory leak...

CVE-2023-27524

CVE-2023-27524 Description - POC for CVE-2023-27524: Apache Superset Auth Bypass Vulnerability. - create by antx at 2023-04-27. Detail - Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY...

CVE-2026-79551-Tenda

CVE-2026-79551 Tenda Hardcoded TLS Private Key CNVD ID: CNVD-2026-25884 Vendor: Tenda Technology Co., Ltd. Product: NVR4H network video recorder hardware version CH3V2.1 Firmware: V27.5.58.6 Class: CWE-321 — Use of Hard-coded Cryptographic Key Overview The NVR4H firmware stores an ECDSA key pair ...

CVE-2022-43144-Stored-XSS

CVE-2022-43144 : Stored-XSS Description A cross-site scripting XSS vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Impact Allowing an attacker to hijack the user's session and take over the account. To exploit this...

CVE-2019-5420

CVE-2019-5420 A vulnerability can allow an attacker to guess the automatically generated development mode secret token. Ruby-on-Rails when it is running in development mode. In development mode, it is possible for an attacker to guess the key used to secure the sessions. Decryption: Key Generate:...

citrix-logchecker

citrix-logchecker Parse citrix netscaler logs to check for signs of CVE-2023-4966 exploitation Written by Otmar Lendl. Usage: ./citrix-anomaly.pl -d -v -h -p file -a X logfiles This script parse citrix netscale syslog files and looks for session reconnects that might be the result of a...

CVE-2024-44000

EN GenCookieSessionHijack is a PoC tool designed to exploit insecurely exposed debug logs from WordPress sites and extract session cookies. This allows the attacker to hijack active admin sessions and gain unauthorized access to the WordPress admin dashboard. Features Extract cookies from WordPre...

SessionView

SessionView A lightweight C console application for enumerating and displaying all user sessions on Windows Server, including session GUIDs. Features Complete Session Enumeration : Lists all active sessions on the Windows server Detailed Session Information : Displays Session ID, Station Name,...

CVE-2025-34077

CVE-2025-34077 — WordPress Pie Register ≤ 3.7.1.4 - Admin Privilege Escalation Unauthenticated 💀 Author Mrj Haxcore 🧠 Vulnerability Summary The Pie Register plugin for WordPress version ≤ 3.7.1.4 exposes an unauthenticated endpoint that allows an attacker to hijack admin sessions simply by POSTin...

CVE-2026-11730

Certain NETGEAR Extender models are affected by an insufficient session randomness vulnerability. A network-adjacent attacker with network access, such as valid WiFi credentials, can predict valid session identifiers. This allows the attacker to hijack an authenticated administrator session on th...

CVE-2026-90154

A flaw was found in ksmbd, a server message block SMB protocol implementation within the Linux kernel. This vulnerability arises from improper management of session state changes, which can cause the system to incorrectly associate active network connections with an unintended session. As a resul...

CVE-2026-90152

A flaw was found in the smb/server component of the Linux kernel. A session leak in the ksmbdsessionregister function occurs when a session fails to be stored, leading to its reference count not being properly decremented. This can result in resource exhaustion, potentially allowing a remote...

Superset_auth_bypass_check

Supersetauthbypasscheck Apache-Superset authentication bypass vulnerability CVE-2023-27524 detection tool Fix date: 2023.8.3 Fixed session invalidation caused by hardcoded session expiry time, introduced flasksessioncookiemanager tool to generate real-time sessions for detection. Fixed the bug...

CVE-2024-42009-roundcube-xss

CVE-2024-42009 — Roundcube Webmail 1.6.6 Stored XSS PoC For authorised security testing, CTF environments, and educational research only. Using this tool against systems you do not own or have written permission to test is illegal under the Computer Misuse Act 1990 UK, the CFAA US, and equivalent...

CVE-2019-9193

EN GenPostgresRCEExploit is a PoC tool designed to exploit an authenticated Remote Code Execution RCE vulnerability in certain versions of PostgreSQL 9.3 - 11.7. It allows authenticated users to execute system commands on a PostgreSQL database server vulnerable to CVE-2019-9193. Features...

CVE-2016-6271

CVE-2016-6271 CVE-2016-6271 impacts libbzrtp, which is a ZRTP library developped by Belledonne Communications. This library is embedded in end-user applications, for example linphone, which is available as an Android app on Play store. Current version 3.2.7 embeds a version of libbzrtp shall not ...

POC-CVE-2025-24813

CVE-2025-24813 Apache Tomcat RCE PoC Proof of Concept PoC exploiting CVE-2025-24813, a Remote Code Execution RCE vulnerability in Apache Tomcat. The vulnerability allows an attacker to upload a malicious serialized payload to the server, leading to arbitrary code execution via deserialization whe...