CVE-2026-41940

CVE-2026-41940: cPanel/WHM Authentication Bypass Single & Multi-Target Disclaimer: This document and the associated script exploit.py are provided strictly for educational purposes, security research, and authorized penetration testing. Do not use this software against systems you do not own or d...

CVE-2025-47812

CVE-2025-47812 — Wing FTP Server Unauth RCE rewrite Python exploit for the unauthenticated Lua-injection RCE in Wing FTP Server ≤ 7.4.3. Designed for shell delivery — one command from check to a working netcat callback. Written some time ago for wingData lab on HTB and open-sourced now. Use only...

CVE-2026-41940

CVE-2026-41940: cPanel/WHM Authentication Bypass Single & Multi-Target Disclaimer: This document and the associated script exploit.py are provided strictly for educational purposes, security research, and authorized penetration testing. Do not use this software against systems you do not own or d...

CVE-2026-41940-PoC-Exploit

CVE-2026-41940 - cPanel/WHM Authentication Bypass Exploit cPanel & WHM Edition - CRLF Injection to Authentication Bypass & Full Session Hijacking Overview This exploit leverages CVE-2026-41940 , a critical authentication bypass vulnerability in cPanel/WHM. By injecting a crafted CRLF payload into...

cpanel-sessionscribe

SessionScribe - CVE-2026-41940 Critical unauthenticated RCE in cPanel & WHM. Four HTTP requests forge a root session via CRLF injection into the password field of a preauth session. No auth, no preconditions, every supported tier affected. Disclosed 2026-04-28 by Sina Kheirkhah / watchTowr Labs...

Metamorph

Metamorph Introduction This tool is a command-line utility for Windows written in C that creates and configures persistent Event Tracing for Windows ETW AutoLogger sessions. AutoLoggers automatically start tracing specific ETW providers upon system boot, making them useful for capturing events th...

CVE-2025-55580

CVE-2025-55580 - SolidInvoice Stored Cross-Site Scripting XSS in Clients Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Client Module. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users' browsers...

Vuln_Exploitation_MegaQuagga_Pentest

Vulnerability Exploitation — MegaQuagga Penetration Test Report Analyst: Samuel Weiss Organization: 0x2A Security Date: April 20, 2026 Client: MegaQuagga Publishing Target: www.megaquagga.local Classification: CONFIDENTIAL Overview This project documents a structured penetration test conducted...

CVE-2023-43326

mooSocial: XSS CVE-2023-43326 A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Note: XXS Also works when these URLs are used in Referer Header. The...

CVE-2026-23550

██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ███████╗ ███████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ╚════██╗╚════██╗██╔════╝ ██╔════╝██╔═████╗ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ █████╔╝ █████╔╝███████╗ ███████╗██║██╔██║ ██║ ╚█...

bucky

Bucky An S3 account ID enumeration and bucket discovery tool Given a single accessible S3 bucket, bucky extracts the 12-digit AWS account ID that owns it, then discovers additional buckets belonging to the same account by fuzzing bucket names against a wordlist — all in one command. What It Does ...

CVE-2025-46173

CVE-2025-46173 - Stored Cross-Site Scripting XSS in Online Exam Mastering System 1.0 📌 Summary CVE-2025-46173 is a stored Cross-Site Scripting XSS vulnerability discovered in the Online Exam Mastering System 1.0 by code-projects. The vulnerability exists in the feedback.php component where user...

CVE-2026-57829

Helix Ultimate Framework — Unauthenticated Stored XSS comajax → Admin Session-Riding → Full Account Takeover This is the strongest finding in this research folder — CRITICAL, fully confirmed end-to-end. Unlike the delete-only bug in helixultimatedeletepoc.md, this one has a real, working path to...

CVE-2026-108969

A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument...

staekka

Stækka Metasploit - Extenting Metasploit This Msf plugin extends Metasploit for some missing features and modules allowing interaction with other/custom exploits/ways of getting shell access. The current focus here is Linux/Unix support. Core features TTY support: starting a shell from Metasploit...

CVE-2025-55579

CVE-2025-55579 - SolidInvoice Stored Cross-Site Scripting XSS in Tax Rates Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Tax Rates Feature. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users'...

cve-2020-13777

Zeek test script for CVE-2020-13777 This script performs a simple test to check if a server is potentially vulnerable to CVE-2020-13777. CVE-2020-13777 causes GnuTLS to create unencrypted session tickets. This seems to be detectable by checking gnutls sets the keyname to zero - for which it uses...

Credential-and-breach-monitoring

Breach / Stealer-Log / Identity Exposure Services Comparison with Scoring This document compares breach intelligence, dark web monitoring, and identity exposure services across practical dimensions relevant to modern security teams. It focuses on: Breach corpus depth Infostealer-log coverage API...

EUVD-2026-98292

A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument...

CVE-2026-108969

A security vulnerability exists in the Session Handler component of the itsmeravitejak Online-Examination-System (up to commit e6208e630b14657999bbfe4c9912302d2a1e2449). The flaw is located in the Session::checkLogin function within the include/session.php file, where manipulation of the cookname...