CVE-2026-50416-writeup-and-poc

CVE-2026-50416: One QWORD Too Many in the Desktop Heap On Windows 11 Insider build 10.0.28020.2149, the user mode mapping of the Win32k desktop heap exposed a raw kernel session pool pointer at offset 0x100. The read itself is almost offensively small: ULONG64 leaked = ULONG64 desktopheap + 0x100...

citrix_adc_netscaler_lfi

citrixadcnetscalerlfiscan !alt textcitrix This Metasploit-Framework module can be use to help companies to check the last Citrix vulnerabilites disclosed July 08, 2020. CVE-2020-8193 CVE-2020-8195 CVE-2020-8196 Public reporting on July 8th, 2020 by Donny Maasland discussed how the vulnerability...

crackerjack

!CAUTION This repo is unmaintained, visit https://github.com/sadreck/crackerjack for the latest version. CrackerJack Web Interface for Hashcat by Context Information Security Contents Introduction Architecture Features Limitations Installation Troubleshooting Screenshots License Introduction...

CVE-2024-39090-PoC

CVE-2024-39090 PoC Exploit Script This PoC script exploits CVE-2024-39090, a CSRF to Stored XSS vulnerability in PHPGurukul Online Shopping Portal v2.0. It automates CSRF attacks to inject persistent JavaScript payloads, which execute when a privileged user accesses the affected page, enabling...

CVE-2018-12613

CVE-2018-12613 Local file inclusion bug due to filter bypass using %253f character. Software Affected 1. PHPMyAdmin v.4.8.0 2. PHPMyAdmin v.4.8.1 How to use This PowerShell scripts need three parameters to craft a exploit HTTP request: 1. PHPMyAdmin URL endpoint 2. Cookies for an authenticated us...

CVE-2022-23131

CVE-2022-23131 CVE-2022-23131Unsafe Session Storage 0x00 Preface Zabbix vulnerability CVE-2022-23131, I accidentally obtained a Zabbix server of a foreign company. Zabbix Sia Zabbix is an open-source monitoring system developed by Zabbix SIA Zabbix Sia from Latvia. This system supports network...

rmcp: RMCP: Denial of Service via unauthenticated session table leak

A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. An unauthenticated remote attacker can send specially crafted JSON-RPC POST requests to the stateful Streamable HTTP server. These requests cause the server to create and permanently retain session and channel state without prop...

cve-2020-0688

cve-2020-0688 I made this script for conducting CVE-2020-0688 more rapidly. It helps to improve checking the vuln, reducing hugely steps for that. Modify these inputs before running the file. url = "https://mail.something.com" input 1 command = "cmd /c echo OOOPS!!! c:/truongtn.txt" input2...

CVE-2019-11043

CVE-2019-11043 0th3rs Security Team ====================== In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 Tested under PHP 7.2.20/7.3.10 Instructions 1、较为稳定,只要爆破出query长度和Header头字段长度 2、autosession检测漏洞存在性 3、实现判断目标worker进程数实现健壮性 4、全worker进程污染 Nginx configuration locati...

cve-2022-23131-exp

Zabbix SSO Auth Bypass CVE-2022-23131 usage: zabbixsessionexp.py -h -t TARGET -u USERNAME -p PROXY -f FILES optional arguments: -h, --help show this help message and exit -t TARGET, --target TARGET Zabbix Server -u USERNAME, --username USERNAME Zabbix Admin User -p PROXY, --proxy PROXY Proxy for...

CVE-2023-48084

CVE-2023-48084 Fixes broken syntax in the POC, primarily incorrect import and incorrect referral to API functions. automates the APIToken retrieval, stores the token as a variable and pipes into the fixed POC. https://github.com/Hamibubu/CVE-2023-48084 If for some reason this does not work,...

XSSFire

XSSFire A standalone Blind XSS Script. How it works: The script is a combination between PHP and JavaScript, it captures the data using JS and send it to the script itself, then it generates report files and deliver them through telegram. Requirements: 1. Web Server running on Linux with a domain...

CVE-2025-41646

CVE-2025-41646 - RevPi Webstatus = 2.4.5 Authentication Bypass Exploit Overview This is a Python3 exploit script for CVE-2025-41646 , an Authentication Bypass vulnerability affecting RevPi Webstatus = 2.4.5. Vulnerability Details: CVE ID : CVE-2025-41646 Affected Product : RevPi Webstatus = 2.4.5...

cve-2017-7269

fixed msf module for cve-2017-7269 fix not work when length of physical path not equal to 19,or has a host binding. add options: PhysicalPathLength,HttpHost for test: host phyiscal path: c:\inetpub\ , length=11 msf use exploit/windows/iis/cve-2017-7269 msf exploitcve-2017-7269 show options Module...

whatsapp-mitd-mitm

WhatsApp MitD & MitM Introduction This repository contains PoC code and tools that were developed as part of our research 01 on remotely exploiting Man-in-the-Disk MitD vulnerabilities on WhatsApp for Android. As discussed in our blog post, the code and accompanying scripts found here, were used ...

pwn-pulse

pwn-pulse.sh Exploit for Pulse Connect Secure SSL VPN arbitrary file read vulnerability CVE-2019-11510 Script authored by braindead @BishopFox. Based on research by Orange Tsai and Meh Chang. Thanks also to Alyssa Herrera and 0xDezzy for additional insights. Huge thanks to bl4ckh0l3z for fixing,...

Remote-Desktop-Caching-

Remote-Desktop-Caching- This tool allows one to recover old RDP mstsc session information in the form of broken PNG files. These PNG files allows Red Team member to extract juicy information such as LAPS passwords or any sensitive information on the screen. Blue Team member can reconstruct PNG...

CVE-2025-24813

Exploitation Conditions DefaultServlet Write Function Enabled: Must configure readonly=false in web.xml Partial PUT Request Support: Tomcat supports chunked upload by default File Session Persistence Enabled: Must configure PersistentManager and FileStore in context.xml Deserialization Exploit...

CVE-2026-66917

IDOR + Stored XSS via Broken Object-Level Authorization in JoomGallery JoomGallery ≤ 4.3.0 — Editor-Role User Hijacks Any Gallery Image and Stores XSS Payload, Enabling Admin Session Takeover SUMMARY UserimageController::save in JoomGallery checks checkACL'edit', ... instead of checkACL'edit.own'...

CVE-2020-9484

CVE-2020-9484 Reproduce Apache Tomcat Session Deserialization Code Execution Vulnerability CVE-2020-9484 with Kali 2.0 Environment: 1. Kali 2.0 2. apache-tomcat-7.0.61-CVE-2020-9484.tar.gz webapp is s2-053, added commons-collections4-4.0.jar under its lib Start /yourtomcatdir/bin/startup.sh...