Fortigate-SSL-VPN-Exploit-Kit

FortiGate SSL-VPN kit recovered in the wild Research archive. Recovered as found. I did not write these files. Released: 1 September 2026 This repository is the orchestrator, second-stage payloads, and operator listeners that sit on top of a per-SKU FortiGate SSL-VPN exploit catalog. The long-for...

CVE-2024-3400-poc

CVE-2024-3400 Vulnerability PoC Proof of Concept Vulnerability Description CVE-2024-3400 is a command injection vulnerability in Palo Alto firewall systems. By crafting a malicious HTTP request, an attacker can execute arbitrary commands on the target server and even gain root privileges...

cve-2024-21762-poc

cve-2024-21762-poc CVE-2024-21762 is a critical vulnerability in Fortinet's FortiOS and FortiProxy products, located in their SSL VPN component. This vulnerability allows unauthenticated remote attackers to execute arbitrary code or commands on the target system through specially crafted HTTP...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...

Astra Linux – Vulnerability in Apache2

Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to log variables...

Astra Linux – Vulnerability in mbedtls

Mbed TLS versions before 3.0.1 have a double-free error under certain out-of-memory conditions, as demonstrated by a failure in the mbedtlssslsetsession function...

CVE-2024-24919

CVE-2024-24919 Checker A simple bash script to check for the vulnerability CVE-2024-24919. Installation Clone the repository: git clone https://github.com/satriarizka/CVE-2024-24919.git cd CVE-2024-24919 chmod +x CVE-2024-24919-scan.sh Usage ./CVE-2024-24919-scan.sh -l ips.txt HUNTER Query...

CVE-2026-58394 OPNsense: Stored XSS in Administration Settings via Certificate Description

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/systemadvancedadmin.php reads certificate records into $acert but omits that array from legacyhtmlescapeformdata before rendering each certificate descr value in the SSL Certificate selector. The...

CVE-2024-24919---Exploit-Script

CVE-2024-24919---Exploit-Script Description CVE-2024-24919 is a vulnerability in Check Point Security Gateway devices that allows unauthorized access to sensitive files through path traversal exploitation. This vulnerability enables an attacker to read the contents of certain files on the target...

SUSE CVE-2026-97629

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

SUSE CVE-2026-105236

Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there. A server that serves several SNI nam...

heartbleed

Patrik Karlsson have implemented ssl-heartbleed and commited into svn.nmap.org. you can get it from https://svn.nmap.org/nmap/scripts/ssl-heartbleed.nse. they have a discussion here: http://seclists.org/nmap-dev/2014/q2/22 . get more details from http://heartbleed.com Credit to author of ssltest....

CVE-2023-46805

CVE-2023-46805 Scanner CVE-2023-46805 Scanner for possible vulnerable Ivanti Connect Secure appliances by country using Shodan. Script version: 1.3 Updated with the recent blog post made by Assetnote ⚠️ This script is for defensive purposes and should be used by cybersecurity professionals to...

openssl_G2.5_CVE-2014-3570

OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. DESCRIPTION The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the...

CVE-2018-13379

🛡️ CVE-2018-13379 - Fortinet SSL VPN Vulnerability 🔍 Overview CVE-2018-13379 is a critical path traversal vulnerability in Fortinet FortiOS SSL VPN. It allows attackers to download VPN web session files and extract sensitive information. Impact: Information disclosure usernames, session tokens...

OpenSSL_1_0_1g_CVE-2015-0205

OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. DESCRIPTION The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the...

CVE-2026-104643

The Easy HTTPS Redirection SSL WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a...

CVE-2018-13379

CVE-2018-13379 - FortiGate SSL-VPN Path Traversal PoC Description Proof-of-Concept script for CVE-2018-13379, a critical path traversal vulnerability in Fortinet FortiGate SSL VPN web portal. This vulnerability allows unauthenticated attackers to download system files via specially crafted HTTP...

CVE-2026-104643

The Easy HTTPS Redirection (SSL) WordPress plugin, in versions before 2.0.2 , contains a vulnerability where it fails to perform capability checks on certain AJAX actions . This flaw allows any authenticated user , such as a Subscriber, to access URLs collected by the plugin's content scanner fro...

EUVD-2026-101850

The Easy HTTPS Redirection SSL WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a...