pritunl-CVE-2020-25200

CVE-2020-25200 Pritunl VPN server - Affected version: Pritunl v1.29.2145.25 553bbd ========================= Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username i...

CVE-2019-5420

CVE-2019-5420 A vulnerability can allow an attacker to guess the automatically generated development mode secret token. Ruby-on-Rails when it is running in development mode. In development mode, it is possible for an attacker to guess the key used to secure the sessions. Decryption: Key Generate:...

CVE-2020-9484

This tool is only for security research and internal audits. Using this tool to launch illegal attacks is prohibited. The user shall be responsible for any consequences. This tool is only for security research and internal audits. Using this tool to launch illegal attacks is prohibited. The user...

auth_analyzer

Auth Analyzer Table of Contents What is it? Why should I use Auth Analyzer? GUI Overview Parameter Extraction Auto Extract From To String Static Value Prompt for Input Parameter Replacement Replacement Location Parameter removement Sample Usage Auto extract session Cookie Session Header and CSRF...

CVE-2025-34077

CVE-2025-34077 — WordPress Pie Register ≤ 3.7.1.4 - Admin Privilege Escalation Unauthenticated 💀 Author Mrj Haxcore 🧠 Vulnerability Summary The Pie Register plugin for WordPress version ≤ 3.7.1.4 exposes an unauthenticated endpoint that allows an attacker to hijack admin sessions simply by POSTin...

CVE-2022-43144-Stored-XSS

CVE-2022-43144 : Stored-XSS Description A cross-site scripting XSS vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Impact Allowing an attacker to hijack the user's session and take over the account. To exploit this...

CVE-2016-6271

CVE-2016-6271 CVE-2016-6271 impacts libbzrtp, which is a ZRTP library developped by Belledonne Communications. This library is embedded in end-user applications, for example linphone, which is available as an Android app on Play store. Current version 3.2.7 embeds a version of libbzrtp shall not ...

Termix-research

Termix Security Research Vulnerability research on Termix, a web-based SSH and server management platform 13k+ stars. CVE| Issue| Severity| Fixed| Advisory ---|---|---|---|--- CVE-2026-45746| Session hijacking → RCE| 9.0 Critical| v2.3.2| GHSA-cx2r-843c-vww8 CVE-2026-45750| OS command injection|...

CVE-2024-51179

CVE-2024-51179 : Flooding of Crafted packets from an Attacker can crash UPF/SMF in Open5gs Vulnerability Description Description: An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of servie via the Network Function Virtualizations NFVs such as the User Plane Function UPF and...

CVE-2025-24813-PoC-Apache-Tomcat-RCE

Apache Tomcat CVE-2025-24813 Proof of Concept PoC A proof-of-concept exploit for the Apache Tomcat deserialization vulnerability CVE-2025-24813. This tool demonstrates how attackers could exploit insecure deserialization in Tomcat's session management. WARNING : This tool is for authorized securi...

CVE-2018-18925

CVE-2018-18925 Exploitation of CVE-2018-18925 a Remote Code Execution against the Git self hosted tool: Gogs. Gogs is based on the Macaron framework. The system used to manage session is very similar to what PHP does. The session identifier in the cookie is mapped to a file on the file system. Wh...

CVE-2024-33231

Ferozo Webmail XSS Vulnerability via File Upload CVE-2024-33231 Description Ferozo Webmail version 1.1 is vulnerable to Cross-Site Scripting XSS through the file upload functionality. An attacker can exploit this vulnerability by uploading a specially crafted file containing malicious JavaScript...

citrix_adc_netscaler_lfi

citrixadcnetscalerlfiscan !alt textcitrix This Metasploit-Framework module can be use to help companies to check the last Citrix vulnerabilites disclosed July 08, 2020. CVE-2020-8193 CVE-2020-8195 CVE-2020-8196 Public reporting on July 8th, 2020 by Donny Maasland discussed how the vulnerability...

CVE-2023-34845

CVE-2023-34845 Vulnerability POC for CVE-2023-34845 Vulnerability I found a cross-site scripting attack on the new content creating page http://localhost:800/admin/new-content it will execute the script in user context allowing the attacker to access any cookies or sessions tokens retained by the...

CVE-2023-41425-RCE-WonderCMS-4.3.2

🚨 WonderCMS RCE Exploit Tool CVE-2023-41425 This Python-based offensive security tool automates the exploitation of a Remote Code Execution RCE vulnerability in WonderCMS 4.3.2 , specifically CVE-2023-41425. It streamlines the process of crafting a malicious ZIP theme module and delivering a...

CVE-2026-67279

MikroTik RouterOS PoC Collection This repository contains proof-of-concept PoC scripts for several MikroTik RouterOS security issues researched and documented in 2026. The materials are intended for authorized security research, laboratory validation, and controlled testing only. This project is...

tinyshell

tinyshell Small PHP shell, Controlled by Python Client , connecting over protocol method features connect with direct session with no need for reverse connection . support password protection . can be binded to any file with no damage . using GET/POST request with error handling . usage the proje...

CVE-2026-20079-checker

CVE-2026-20079 Cisco FMC Read-Only Checker A small, deliberately limited validation utility for CVE-2026-20079 , the Cisco Secure Firewall Management Center FMC authentication-bypass vulnerability. This repository is a checker, not an exploit. It does not contain the session-upgrade, file-write,...

CVE-2025-14855-POC

CVE-2025-14855: SureForms WordPress Plugin Stored XSS Proof of Concept Target: WordPress Plugin "SureForms" Plugin Wordpress: https://wordpress.org/plugins/sureforms/ Vulnerability Type: Stored Cross-Site Scripting XSS CVE: CVE-2025-14855 Refer:...

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...