CVE-2026-90507

CVE-2026-90507 affects the vvbbnn00 WARP-Clash-API (up to commit c7bf236), specifically the get_surge_subscription function in services/subscription.py (Subscription Handler component). Improper manipulation of the key argument leads to improper access control , exploitable remotely without authe...

kubebot

Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...

Stormspotter

Stormspotter creates an “attack graph” of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work. Installation With...

CVE-2022-RCE

CVE-2022-XXXX Reverse junk data injection CVE subscription tools exploitation tutorials Exploit POC RCE LOG4j deserialization JNDI Payload CVE-2022-20550 CVE-2022-20551 CVE-2022-20552 CVE-2022-20553 CVE-2022-20554 CVE-2022-20555 CVE-2022-20556 CVE-2022-20557 CVE-2022-20558 CVE-2022-20559...

Gpt-Agreement-Payment

简体中文 | English Gpt-Agreement-Payment End-to-end replay tool for ChatGPT Plus / Team subscription agreements: reverse-engineered from packet capture the entire chain Stripe Checkout → PayPal / GoPay / QRIS → ChatGPT manual-approval → Codex OAuth + PKCE and implemented as a runnable client. Include...

LiquidSnake

Liquid Snake Liquid Snake is a program aimed at performing lateral movement against Windows systems without touching the disk. The tool relies on WMI Event Subscription in order to execute a .NET assembly in memory, the .NET assembly will listen for a shellcode on a named pipe and then execute it...

SharpStay

SharpStay - .NET Persistence Building To compile open Visual Studio project and compile for release. Options Elevated Registry Keys Elevated UserInit Registry Key Elevated Scheduled Task Elevated Create Service Elevated WMI Event Subscription Non-Elevated InitMprLogonScript Registry Key...

OffensiveCSharp

OffensiveCSharp This is a collection of C tooling and POCs I've created for use on operations. Each project is designed to use no external libraries. Open each project's .SLN in Visual Studio and compile as "Release". Project| Description| Minimum .NET Version ---|---|--- AbandonedCOMKeys|...

EDRUnChoker

EDRUnChoker Fileless WMI remediation forEDRChoker counters QoS abuse pacer.sys that throttles EDR agents to near-zero network bandwidth. Registers a permanent subscription in root\subscription no files on disk. A 5-second timer runs embedded VBScript that enumerates QoS policies with...

wnfexec

Resumen WnfExec es una librería de prueba de concepto en C que inyecta shellcode en un proceso mediante el secuestro de un callback de suscripción WNF y luego desencadenando un cambio de estado. No hay nada novedoso aquí y fue construida basándose en la investigación de otros. Mi intención fue...

PowerLurk

PowerLurk PowerLurk is a PowerShell toolset for building malicious WMI Event Subsriptions. The goal is to make WMI events easier to fire off during a penetration test or red team engagement. Please see my post Creeping on Users with WMI Events: Introducing PowerLurk for more detailed information:...

CVE-2025-24587

CVE-2025-24587 1️⃣ 컴포넌트 유형 WordPress 플러그인 2️⃣ 컴포넌트 세부 정보 컴포넌트 이름 Email Subscription Popup 취약한 버전 prefix . "nlsubscriptions where email='$em'"; $wpdb-query$query; 이 문제를 해결하려면 WordPress에서 제공하는 $wpdb-pre...

CVE-2026-87719

GitLab Enterprise Edition (EE) is affected by an insecure deserialization flaw in the GraphQL subscription serializer . An authenticated user with Duo Chat access can craft a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup, exposing Advance...

Quiksand-CVE-2023-24012

DDS Security Test Entorno de prueba de seguridad DDS para ROS 2, basado en ROS 2 Foxy. Descripción del proyecto Este proyecto demuestra una vulnerabilidad de omisión de permisos en el marco de seguridad SROS2 de ROS 2. Al modificar el archivo de permisos firmados, un atacante puede hacer que un...

CVE-2025-6792

Exploit: Suscripción no autorizada a canales de Pusher Escuchas clandestinas 1 Obtener credenciales de Pusher desde la consola del navegador root@kitploit: console.log window.wpguppyscriptsvars.pusherKey, window.wpguppyscriptsvars.pusherCluster ; 2 Suscribirse al canal privado de una víctima...

artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0

A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBETOPOLOGYV2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore, no credential...

CVE-2026-49363

A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBETOPOLOGYV2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore, no credential...

CVE-2026-49363

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBETOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are...

CVE-2026-49363

Apache Artemis (2.50.0–2.56.0) and ActiveMQ Artemis (1.0.0–2.44.0) contain a pre-authentication information disclosure vulnerability in the CORE protocol. The SUBSCRIBE_TOPOLOGY_V2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket() processes topology subscription requests on channe...

CVE-2026-49363 Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBETOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are...