CVE-2026-52774-YESWIKI-XSS

CVE-2026-52774-YESWIKI-XSS CVE-2026-52774 is a reflected XSS vulnerability in YesWiki's Bazar widget handler. The query parameter in the NoSuchPage/widget endpoint is inadequately sanitized using striptags, which does not escape double quotes. This allows an attacker to break out of HTML attribut...

CVE-2025-67876

CVE-2025-67876: ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking Overview Field| Details ---|--- CVE ID| CVE-2025-67876 Severity| CRITICAL Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products ChurchCRM/CRM Details Summary A stored cross-site scriptin...

CVE-2025-29015

CVE-2025-29015 - Sistema de Banca por Internet 2.0.0 XSS almacenado en pagesaccount.php Descripción Existe una vulnerabilidad de Cross-Site Scripting XSS almacenado en Code Astro Internet Banking System 2.0.0 a través del parámetro name en /admin/pagesaccount.php. Se puede inyectar y almacenar...

CVE-2026-76581-Detector

CVE-2026-76581 - WPMU DEV Dashboard Vulnerability Detector A safe, passive Python detector for identifying WordPress installations running a version of WPMU DEV Dashboard affected by CVE-2026-76581. The detector does not exploit the authentication bypass, request or replay HMAC values, or create ...

evilginx2

Evilginx 3.0 Evilginx es un framework de ataque de intermediario man-in-the-middle utilizado para el phishing de credenciales de inicio de sesión junto con cookies de sesión, lo que permite eludir la protección de autenticación de dos factores. Esta herramienta es la sucesora de Evilginx, lanzada...

CVE-2022-45436

CVE-2022-45436 Reflected Cross Site Scripting leading to session hijacking in pandorafms Exploit Title: Reflected Cross Site Scripting Date: 15/02/2023 Exploit Author: Damodar Naik Vendor Homepage: https://pandorafms.com/en/ Software Link: https://github.com/pandorafms/pandorafms Version: Tested...

UsoDllLoader

UsoDllLoader ⚠️ 2020-06-06 Update: this trick no longer works on the latest builds of Windows 10 Insider Preview. This means that, although it still works on the mainstream version of Windows 10 , you should expect it to be patched in the coming months. Description This PoC shows a technique that...

PoC-RCE-Rukovoditel

PoC-RCE-Rukovoditel Proof of concept for CVE-2020-11819 and CVE-2020-15946. Tested on Rukovoditel 2.4.x, 2.5.x and 2.6.1 Description: This exploit has two modes of execution, using the session fixation vulnerability CVE-2020-15946 or using the access credentials of any account under any profile...

openclaw-dashboard

Panel de Control del Agente OpenClaw Un panel de monitoreo en tiempo real, seguro y atractivo para agentes OpenClaw. Rastrea sesiones, monitorea el uso de la API, visualiza costos, gestiona archivos de memoria y mantén un seguimiento de la salud del sistema, todo en un solo lugar. Capturas de...

CVE-2025-24813

CVE-2025-24813 Proof of Concept PoC script for CVE-2025-24813, vulnerability in Apache Tomcat. The script has been modified based on the related link and tailored to my needs. Setup Vulnerable Tomcat Environment Given environment based on the official Tomcat 9.0.90 image. It removes the server's...

cowrie

.. SPDX-FileCopyrightText: 2014 Upi Tamminen [email protected] .. SPDX-FileCopyrightText: 2014-2025 Michel Oosterhof [email protected] .. .. SPDX-License-Identifier: BSD-3-Clause Cowrie Qué es Cowrie Cowrie es un honeypot SSH y Telnet de interacción media a alta diseñado para registrar...

CVE-2022-0155-PoC

CVE-2022-0155 Proof-of-Concept PoC This repository contains a demonstration of the CVE-2022-0155 vulnerability. The vulnerability was detected by ranjit-git and is described in detail here. The purpose of this PoC is to demonstrate that the vulnerability doesn't just apply to scenarios where...

cve-2018-11714_POC

cve-2018-11714POC An issue was discovered on TP-Link TL-WR840N. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of "Referer: http://192.168.0.1/mainFrame.htm" then no authentication is required for any action. artigo pt-br:...

CVE-2025-24813-Apache-Tomcat-RCE-PoC

CVE-2025-24813 Apache Tomcat RCE PoC Description This is a Proof of Concept PoC for CVE-2025-24813, a Remote Code Execution RCE vulnerability in Apache Tomcat. The vulnerability arises from unsafe deserialization of crafted session files uploaded via HTTP PUT requests, allowing attackers to execu...

CVE-2025-67875

CVE-2025-67875: ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking Overview Field| Details ---|--- CVE ID| CVE-2025-67875 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products ChurchCRM/CRM Details Summary A critical privilege...

CVE-2024-2044

PoC CVE-2024-2044: pgAdmin 4 Authenticated RCE Linux/POSIX Repositori ini berisi skrip Proof of Concept PoC untuk CVE-2024-2044 , sebuah kerentanan kritis yang menggabungkan Authenticated Path Traversal dan Unsafe Deserialization pada pgAdmin 4 versi 8.3 ke bawah yang berjalan di lingkungan...

sshamble

sshamble SSHamble is a research tool for SSH implementations that includes: Interesting attacks against authentication Post-session authentication attacks Pre-authentication state transitions Authentication timing analysis Post-session enumeration This project is a work-in-progress and likely to...

ssh-mitm

SSH-MITM - auditorías ssh simplificadas Una herramienta interactiva de intercepción SSH para auditorías de seguridad autorizadas. Intercepta sesiones, monitoriza el tráfico en vivo, inyecta comandos y manipula transferencias de archivos — todo en tiempo real. !Follow me on...

Research-CVE-2023-27524

Research-CVE-2023-27524 The ASEAN Information Security Student Competition Jeopardy has temporarily concluded; my team MSECHUNT3R won second place in the Jeopardy bracket. I feel both happy and sad because this year's web challenge didn't meet my expectations, but anyway, I have a CVE to analyze ...

LockBit-Ransomware-Analysis

🔐 LockBit Ransomware Analysis – Citrix Bleed Exploitation 📌 Overview This project presents a detailed threat intelligence and incident response analysis of the October 2023 LockBit ransomware attack targeting Boeing. The attackers exploited CVE-2023-4966 Citrix Bleed to hijack NetScaler session...