hackerone

hackerone I have collected all hackerone disclosed reports by brute forcing on their api https://api.hackerone.com/v1/hackers/reports/id from number 1 to 1500000. May be there are more reports, that it's id is more than 1500000. File reports.csv contain more than 10000 disclosed report, every lin...

CVE-2026-6279

CVE-2026-6279 Avada Builder = 3.15.2 — Unauthenticated RCE via calluserfunc without Allowlist Vulnerability Summary Remote Code Execution RCE without authentication in the Avada Builder Fusion Builder plugin version = 3.15.2 used by the Avada WordPress theme — one of the most popular premium...

Nameles

Auditable Invalid Traffic Detection Nameles • Key Features • Performance • Examples • Install • Support • Docs • Issues • License • Download Nameles brings state-of-the-art invalid traffic detection, analysis and real-time filtering to every advertiser, data scientist, advertising technology...

moonwalk

moonwalk Cover your tracks during Linux Exploitation / Penetration Testing by leaving zero traces on system logs and filesystem timestamps. 📖 Table of Contents Introduction Features Installation Usage Contribution License ℹ️ Introduction moonwalk is a 400 KB single-binary executable that can clear...

dns-rebind-toolkit

DNS Rebind Toolkit Demo | Security Advisory | Included Payloads | FAQ DISCLAIMER: This software is for educational purposes only. This software should not be used for illegal activity. The author is not responsible for its use. Don't be a dick. DNS Rebind Toolkit is a frontend JavaScript framewor...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder One hidden field. One changed value. Full access to the entire website. 🧨 What an Attacker Can Do? 🔬 Vulnerability Analysis Vulnerability Location root@kitploit: includes/shared/handlers/FormSubmissionHandler.php → createuser Vulnerable Code root@kitploit: // Lin...

tesla-security-research

Tesla Security Research Vulnerability research on the Tesla Model 3/Y infotainment system Intel Atom MCU, Linux 4.14.235, responsibly disclosed to Tesla via Bugcrowd. Obtained persistent root access on a production Tesla Model 3 through a command injection vulnerability in Tesla's ODIN diagnostic...

M3UAScan

M3UAScan A Scanner for M3UA protocol to detect Sigtran supporting nodes M3UA stands for MTP Level 3 MTP3 User Adaptation Layer as defined by the IETF SIGTRAN working group in RFC 4666 .M3UA enables the SS7 protocol's User Parts e.g. ISUP, SCCP and TUP to run over IP instead of telephony equipment...

CVE-2026-39808

🚨 FortiSandbox Root Sandbox Escape - CVE-2026-39808 🎯 Overview This repository contains a clean and well-documented Proof of Concept for CVE-2026-39808 — a critical unauthenticated command injection vulnerability in Fortinet FortiSandbox that allows sandbox escape and remote code execution as roo...

CVE-2023-49983

CVE-2023-49983 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "name" field/parameter on "/management/class" Description : A cross-site scripting XSS vulnerability in the component "/management/class" of School Fees Management System v1.0 allows attackers to execute...

mitigate-cve-2026-23869-react-server-component-loops

How to Fix CVE-2026-23869: Mitigate React Server Component Loops Securing modern enterprise frontend applications requires continuous monitoring of server-side data fetching layouts and framework component life cycles. With the recent public disclosure of CVE-2026-23869, engineering teams are...

CVE-2025-22785

CVE-2025-22785 Course Booking System = 6.0.5 - Unauthenticated SQL Injection Description The Course Booking System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-29115

CVE-2026-29115 — Dahua Authenticated Remote Denial of Service Advisory type: Vendor-coordinated security disclosure CVE ID: CVE-2026-29115 Vendor: Dahua Technology Published: 2026-06-10T06:08:21 UTC Last Modified: 2026-06-10T06:08:21 UTC Source: Dahua Product Security Incident PSI Trust Center...

attack_monitor

Attack Monitor Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 and all later versions workstations/servers and to automate dynamic analysis of malware. Current modes mutually exclusive: Endpoint detection ED Malware analysis on dedicated...

social_mapper

Social Mapper This tool is no longer actively maintained, parts of it may still work and I will accept pull requests to keep it up to date WARNING: FACEBOOK NOW DETECTS THIS AFTER A FEW 100 SEARCHES, USE ONLY DISPOSABLE FACEBOOK ACCOUNTS A Social Media Mapping Tool that correlates profiles via...

CVE-2026-11374-check

CVE-2026-11374 ManageEngine AD360 Precondition Detection Script A detection script for the exploit precondition of CVE-2026-11374, a predictable SSO-ticket flaw that leads to unauthenticated account takeover across the ManageEngine AD360 suite. The four in-scope products share the...

exploit-react-CVE-2025-55182

FOX-RSC TOOL CVE-2025-55182 & CVE-2025-66478 LEGAL DISCLAIMER EN: This tool is a Proof of Concept PoC intended for security research and educational purposes only. Using this tool on systems without explicit permission is illegal and punishable by law. The author Tiger-Foxx assumes no...

CVE-2026-14762-PoC-Exploit

CVE-2026-14762 – Code‑Projects Hotel & Tourism Reservation 1.0 SQL Injection Exploit -orange -red Fully featured, multi‑threaded, time‑based blind SQL injection exploit for CVE‑2026‑14762. Targets the /admin/rooms.php endpoint of the Code‑Projects Hotel & Tourism Reservation application version...

ams-failopen

Fail-Open Signing in AppleMediaServices Zero-Day Disclosure Summary This issue constitutes a live Zero-Day vulnerability and reflects a systemic design flaw in AppleMediaServices.framework, rather than a regression or version-specific bug. A critical fail-open flaw in Apple’s AppleMediaServices...

CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC Description Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress versions 6.9.0 through 7.0.1. It chains: REST API batch route confusion validation vs dispatch mismatch SQL injection via...