CVE-2026-109390

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload...

CVE-2026-109390

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload...

CVE-2017-14263

HoneywellNVRvul CVE-2017-14263 xfuturesec Co., Ltd First, obtain the SessionID for a guest user. We can find the SessionID from any http request. Such as: POST https://192.168.1.104/RPC2 HTTP/1.1 Accept: text/javascript, text/html, application/xml, text/xml X-Requested-With: XMLHttpRequest...

CVE-2023-0264

PoC for CVE-2023-0264 Keycloak vulnerability that allows session hijacking during authorization code flow See https://github.com/advisories/GHSA-9g98-5mj6-f9mv Prerequisites Docker curl jq python3 or another tool to serve static files on HTTP Steps to reproduce 1. Start Keycloak container with...

cyber-decoy

cyber-decoy A containerized network decoy honeypot that advertises SSH , RDP , and SMB , observes every inbound connection with eBPF , and reverse-proxies each session into an isolated decoy container. The design separates two concerns: 1. Observation. An eBPF TC classifier attached to the broker...

CVE-2026-109206 LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet /avatar performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compa...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416: One QWORD Too Many in the Desktop Heap On Windows 11 Insider build 10.0.28020.2149, the user mode mapping of the Win32k desktop heap exposed a raw kernel session pool pointer at offset 0x100. The read itself is almost offensively small: ULONG64 leaked = ULONG64 desktopheap + 0x100...

CVE-2024-39090-PoC

CVE-2024-39090 PoC Exploit Script This PoC script exploits CVE-2024-39090, a CSRF to Stored XSS vulnerability in PHPGurukul Online Shopping Portal v2.0. It automates CSRF attacks to inject persistent JavaScript payloads, which execute when a privileged user accesses the affected page, enabling...

CVE-2018-12613

CVE-2018-12613 Local file inclusion bug due to filter bypass using %253f character. Software Affected 1. PHPMyAdmin v.4.8.0 2. PHPMyAdmin v.4.8.1 How to use This PowerShell scripts need three parameters to craft a exploit HTTP request: 1. PHPMyAdmin URL endpoint 2. Cookies for an authenticated us...

rmcp: RMCP: Denial of Service via unauthenticated session table leak

A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. An unauthenticated remote attacker can send specially crafted JSON-RPC POST requests to the stateful Streamable HTTP server. These requests cause the server to create and permanently retain session and channel state without prop...

cve-2020-0688

cve-2020-0688 I made this script for conducting CVE-2020-0688 more rapidly. It helps to improve checking the vuln, reducing hugely steps for that. Modify these inputs before running the file. url = "https://mail.something.com" input 1 command = "cmd /c echo OOOPS!!! c:/truongtn.txt" input2...

CVE-2019-11043

CVE-2019-11043 0th3rs Security Team ====================== In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 Tested under PHP 7.2.20/7.3.10 Instructions 1、较为稳定,只要爆破出query长度和Header头字段长度 2、autosession检测漏洞存在性 3、实现判断目标worker进程数实现健壮性 4、全worker进程污染 Nginx configuration locati...

CVE-2023-48084

CVE-2023-48084 Fixes broken syntax in the POC, primarily incorrect import and incorrect referral to API functions. automates the APIToken retrieval, stores the token as a variable and pipes into the fixed POC. https://github.com/Hamibubu/CVE-2023-48084 If for some reason this does not work,...

XSSFire

XSSFire A standalone Blind XSS Script. How it works: The script is a combination between PHP and JavaScript, it captures the data using JS and send it to the script itself, then it generates report files and deliver them through telegram. Requirements: 1. Web Server running on Linux with a domain...

CVE-2025-41646

CVE-2025-41646 - RevPi Webstatus = 2.4.5 Authentication Bypass Exploit Overview This is a Python3 exploit script for CVE-2025-41646 , an Authentication Bypass vulnerability affecting RevPi Webstatus = 2.4.5. Vulnerability Details: CVE ID : CVE-2025-41646 Affected Product : RevPi Webstatus = 2.4.5...

cve-2017-7269

fixed msf module for cve-2017-7269 fix not work when length of physical path not equal to 19,or has a host binding. add options: PhysicalPathLength,HttpHost for test: host phyiscal path: c:\inetpub\ , length=11 msf use exploit/windows/iis/cve-2017-7269 msf exploitcve-2017-7269 show options Module...

whatsapp-mitd-mitm

WhatsApp MitD & MitM Introduction This repository contains PoC code and tools that were developed as part of our research 01 on remotely exploiting Man-in-the-Disk MitD vulnerabilities on WhatsApp for Android. As discussed in our blog post, the code and accompanying scripts found here, were used ...

pwn-pulse

pwn-pulse.sh Exploit for Pulse Connect Secure SSL VPN arbitrary file read vulnerability CVE-2019-11510 Script authored by braindead @BishopFox. Based on research by Orange Tsai and Meh Chang. Thanks also to Alyssa Herrera and 0xDezzy for additional insights. Huge thanks to bl4ckh0l3z for fixing,...

CVE-2026-66917

IDOR + Stored XSS via Broken Object-Level Authorization in JoomGallery JoomGallery ≤ 4.3.0 — Editor-Role User Hijacks Any Gallery Image and Stores XSS Payload, Enabling Admin Session Takeover SUMMARY UserimageController::save in JoomGallery checks checkACL'edit', ... instead of checkACL'edit.own'...

CVE-2026-48849-Roundcube-Webmail-Stored-XSS

CVE-2026-48849 - Stored XSS, HTML Injection & CSS Injection in Roundcube Webmail Overview This repository contains a Proof-of-Concept PoC for CVE-2026-48849 , a Stored Cross-Site Scripting XSS, HTML Injection, and CSS Injection vulnerability in Roundcube Webmail. The vulnerability allows...