RRC_steganography

RRC Steganography Rotation Range-Coding RRC Steganography — an efficient and provably secure linguistic steganographic method that embeds secret messages into natural-language text generated by large language models. Paper : Efficient Provably Secure Linguistic Steganography via Range Coding ACL...

commons-text-goat

Commons-Text Goat This is a webapp that is intentionally vulnerable to CVE-2022-42889. It uses an embedded Jetty server and Maven to start a servlet listening at port 8080 at URL \api. This endpoint accepts a URL parameter cmd. This is embedded between $ and and passed to the StringSubstitutor...

CVE-2022-42899

CVE-2022-42899 Apache Common Text starting from version 1.5 to 1.9 has Remote code execution vulnerability CVE-2022-42899. final StringSubstitutor interpolator = StringSubstitutor.createInterpolator; interpolator.replace"$script:javascript:java.lang.Runtime.getRuntime.exec'"; // Here you will pas...

CVE-2023-43770-PoC

CVE-2023-43770-PoC PoC for Stored XSS CVE-2023-43770 Vulnerability Description Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcubestringreplacer.php behavior. Attack Chain Crafted...

OpenAttack

Documentation • Features & Uses • Usage Examples • Attack Models • Toolkit Design OpenAttack is an open-source Python-based textual adversarial attack toolkit, which handles the whole process of textual adversarial attacking, including preprocessing text, accessing the victim model, generating...

CVE-2026-113673 GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...

CVE-2026-113673

The GeoDirectory WordPress plugin versions prior to 2.8.194 is vulnerable to Remote Code Execution (RCE) . The root cause is a failure to properly escape administrator-defined text before it is written into a generated PHP file within the plugin's own folder. This flaw allows high-privilege users...

Text4Shell-Scanner

Scanner for CVE-2022-42889 Text4Shell Description This is a scanner for CVE-2022-42889 Text4Shell vulnerability Usage Step 1. Download jar file jar file is on preparedJar/text4shell-scanner.jar 2. Check java version on your system 3. Run jar file with args refer to the following example Sample...

unredactor

Un-Redactor A PDF editing tool that lets you unredact, put your own information over a redaction box, and extract all text. This tool is for forensics purposes. It does not "recover" data truly destroyed by redaction tools. It can process large data sets and convert all at once to a HTML pages wi...

cve-2022-42889-intercept

cve-2022-42889-intercept For versions below Java 11, special attention is required, as higher versions have already removed the Javascript interpreter. This solution targets Java 8. Intercept illegal parameters via JVM startup parameters and jps pid. quick start -----------------------load...

CVE-2025-24893

CVE-2025-24893 Exploit Title: XWiki 15.10.10 - Unauthenticated Remote Code Execution Date: 09/08/2025 Exploit Author: D3Ext Vendor Homepage: https://www.xwiki.org/ Software Link: https://github.com/xwiki/xwiki-platform Version: 15.10.10 Tested on: Kali Linux 2025 CVE: CVE-2025-24893 Explanation...

StealthRL

StealthRL: Reinforcement Learning Paraphrase Attacks for Multi-Detector Evasion of AI-Text Detectors Paper arXiv Demo Model Hugging Face Benchmark Dataset Hugging Face Abstract AI-text detectors are increasingly used in high-stakes settings, yet their robustness to meaning-preserving adversarial...

Apache-Commons-Text-CVE-2022-42889

Apache Commons Text CVE-2022-42889 Overview Apache Text4Shell CVE-2022-42889 The affected Apache Commons Text versions 1.5 through 1.9 and it has been patched in version 1.10. Apache Commons Text is a Java library described as "a library focused on algorithms working on strings". Usage: 1. Copy...

wordlist.rb

Wordlist Source Issues Documentation Description Wordlist is a Ruby library and CLI for reading, combining, mutating, and building wordlists, efficiently. Features Supports reading .txt wordlists, and .gz, .bz2, .xz, .zip, and .7z compressed wordlists. Supports building wordlists from arbitrary...

SMWYG-Show-Me-What-You-Got

SMWYG-Show-Me-What-You-Got This tool allows you to perform OSINT and reconnaissance on an organisation or an individual. It allows one to search 1.4 Billion clear text credentials which was dumped as part of BreachCompilation leak. This database makes finding passwords faster and easier than ever...

riskootext4shell

riskootext4shell text4shell script for Apache Commons Text =1.10 CVE-2022-33980 The Apache Commons Text library is an alternative to the native functionalities of the Java JDK. Versions prior to version 1.10.0 of Apache Commons Similar to CVE-2022-33980 python3 text4shell.py -u...

covert-control

covert-control Control systems remotely by uploading files to Google Drive, OneDrive, Youtube or Telegram using Python to create the files and the listeners. It allows to create text files, images, audio or videos, with the commands in cleartext or encrypted using AES. covert-googledrive.py -...

CVE-2022-42889-text4shell

CVE-2022-42889-text4shell 🔥🔥🔥 Apache commons text - CVE-2022-42889 Text4Shell proof of concept exploit. Details📃 CVE-2022-42889 affects Apache Commons Text versions 1.5 through 1.9. It has been patched as of Commons Text version 1.10 The vulnerability has been compared to Log4Shell since it is an...

CVE-2025-62727-Demo

CVE-2025-62727 Demo Victim Description The target victim of CVE-2025-62727 is a simple FastAPI app that: Serves Hello World at /. Serves static files under /static using Starlette's StaticFiles. Auto-generates text files containing A repeated N times for N in 1024, 2048, 50176 on startup. How to...

rConfig <=3.9.4 - SQL Injection

rConfig 3.9.4 and prior has unauthenticated snippets.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10549 info: name: rConfig 3.9.4 or apply th...