ContextHound

ContextHound Static analysis tool that scans your codebase for LLM prompt-injection and multimodal security vulnerabilities. Runs offline, no API calls required. The ContextHound ecosystem ContextHound is available across your entire development and browsing workflow: Tool| What it does| Install...

CVE-2024-51567

CVE-2024-51567 Exploit Script CVE-2024-51567 is a Python proof-of-concept PoC exploit script for CVE-2024-51567 , a critical command injection vulnerability affecting CyberPanel v2.3.6. This vulnerability, found in the upgrademysqlstatus endpoint, enables remote command execution RCE by bypassing...

CVE-2018-18649

CVE-2018-18649 CVE-2018-18649 EXP For the EXP description, see: Gitlab Wiki API Remote Command Execution Vulnerability CVE-2018-18649...

e9patch

E9Patch - A Powerful Static Binary Rewriter E9Patch is a powerful static binary rewriting tool for x8664 Linux ELF binaries. E9Patch is: Scalable : E9Patch can reliably rewrite large/complex binaries including web browsers 100MB in size. Compatible : The rewritten binary is a drop-in replacement ...

CVE-2026-54433

CVE-2026-54433: Roundcube plain-text email stored XSS This repository contains a configurable Python proof of concept for CVE-2026-54433 , a stored cross-site scripting vulnerability in Roundcube's plain-text email renderer. An unauthenticated sender can deliver a crafted text/plain message. When...

CVE-2026-64638

Requirement Node .js Command node evilngrok.js...

DSpace__DSpace_CVE-2022-31192_5-100

DSpace DSpace Documentation | DSpace Releases | DSpace Wiki | Support Overview DSpace open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources. For more information, visit...

CVE-2026-0594-ListSiteContributors-Plugin-Exploit

CVE-2026-0594-ListSiteContributors-Plugin-Exploit 🛡️ Description CVE-2026-0594 is a critical Reflected Cross-Site Scripting XSS vulnerability found in the List Site Contributors WordPress plugin. This exploit automates the discovery of vulnerable endpoints via the WordPress REST API wp-json and...

CVE-2026-44613

CVE-2026-44613 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments...

CVE-2026-59827

CVE-2026-59827: Metabase Unsafe Deserialization in H2 Native Queries Severity: Critical CVSS 9.9 CVE: CVE-2026-59827 Advisory: GHSA-w95f-x9v9-wv36 Reporter: Matheus Gutierre @Gutierre0x80 Published: June 30, 2026 Vulnerability Summary An authenticated user with access to native SQL queries on an ...

CVE-2026-28956

CVE-2026-28956 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments...

React2Shell-CVE-2025-55182

CVE-2025-55182 — React2Shell Unauthenticated RCE in React Server Components via insecure deserialization of the Flight protocol. A single HTTP request is enough to execute arbitrary code on the server — no credentials, no prior access needed. / / / /| |/ / \ / / / / / / / / // / / // / // | //...

CVE-2022-41852

Remote Code Execution in JXPath Library CVE-2022-41852 Proof of Concept CVE-2022-41852 allows attackers to execute code on the application server. You can read more about this vulnerability here: https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/ Note: I am not ...

NextSploit

🔍 NextSploit: Next.js CVE-2025-29927 Scanner & Exploiter ⚠️ NextSploit is a command-line tool designed to detect and exploit CVE-2025-29927 , a security flaw in Next.js. The tool first identifies if a target website is running Next.js and determines whether its version falls within the vulnerable...

CVE-2019-3396

CVE-2019-3396 Confluence Unauthorized RCE CVE-2019-3396 Vulnerability Pitfall: Some versions require adding Referer to succeed File Read POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: 10.10.20.181 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:55.0 Gecko/20100101 Firefox/55.0 Accept:...

smugglefuzz

SmuggleFuzz SmuggleFuzz, a configurable and rapid HTTP downgrade smuggling scanner. Empowering users with customizable gadget lists, it offers deeper insights into the reasons behind failed smuggling attacks. I am confident that numerous HTTP downgrade-based smuggling vulnerabilities remain...

A-Red-Teamer-diaries

A Red-Teamer diaries Publicly accessible notes about my pentesting/red teaming experiments tested on several controlled environments/infrastructures that involve playing with various tools and techniques used by penetration testers and redteamers during a security assessment. Project in progress...

CVE-2019-13272

CVE-2019-13272 Linux local root exploit Linux 4.10 5.1.17 PTRACETRACEME local root CVE-2019-13272 In the Linux kernel before 5.1.17, ptracelink in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtai...

CVE-2023-33869-RCE-PoC

Center for Energy Security and Reliability - UNC Charlotte CVE-2023-33869 is a command injection vulnerability affecting Enphase Envoy firmware version D7.0.88. This vulnerability allows an attacker to inject and execute arbitrary commands with root privileges on the affected device. The Enphase...

rndis-co

RNDIS-CO Summary The RNDIS USB Gadget may be exploited to dump contents of kernel memory space via packet filter update mechanism. Description The RNDISMSGSET usb control transfer request handler - rndissetresponse calls genndissetresp passing a buffer pointer offset by BufOffset + 8. The BufOffs...