lenovo-dispatcher-poc

Lenovo Dispatcher PoC This is a basic proof of concept to exploit lenovo dispatcher driver LnvMSRIO.sys CVE-2025-8061. Vulnerabilities found by Luis Casvella source: https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061.html. The main idea of this poc is to exploit the read/write...

Adamantium-Thief

🔓 Adamantium-Thief Get chromium based browsers: passwords, credit cards, history, cookies, bookmarks, autofill. Chrome 80 is supported! Need firefox passwords decryptor? 🌿 Examples: 🔑 Get passwords from browsers: Stealer.exe PASSWORDS 💳 Get credit cards from browsers: Stealer.exe CREDITCARDS 🕘 Ge...

ChromeKatz

ChromeKatz ChromeKatz is a solution for dumping sensitive information from memory of Chromium based browsers. As for now, ChromeKatz consists of three projects: 1. CookieKatz - The cookie dumper 2. CredentialKatz - Deprecated.. for now 3. ElevationKatz - Get the decryption key from the elevation...

CVE-2024-43451-POC

Description Name : CVE-2024-43451 CVSSv3 Score : 6.5 Affected Versions : All Microsoft Windows versions before the Nov 2024 Patch CVE-2024-43451 is a zero-day vulnerability in Microsoft Windows that allows attackers to capture NTLMv2 password hashes with minimal interaction from the user,...

cookie-monster

Cookie-Monster-BOF Steal browser cookies for edge, chrome and firefox through a BOF! Cookie Monster BOF will extract the WebKit Master Key and the App Bound Encryption Key for both Edge and Chrome, locate a browser process with a handle to the Cookies and Login Data files, copy the handles and th...

EvilSelenium

EvilSelenium EvilSelenium is a new project that weaponizes Selenium to abuse Chromium-based browsers. The current features right now are: Steal stored credentials via autofill Steal cookies Take screenshots of websites Dump Gmail/O365 emails Dump WhatsApp messages Download & exfiltrate files Add...

CVE-2020-12629

Title: osTicket 1.14.1 - Persistent Authenticated Cross-Site Scripting Author: Mehmet Kelepce / Gais Cyber Security Date : 2020-03-24 Source Link: https://github.com/osticket/osticket/commit/fc4c8608fa122f38673b9dddcb8fef4a15a9c884 CVE: https://vulners.com/cve/CVE-2020-12629 Exploit-Db :...

CVE-2023-1454-EXP

CVE-2023-1454-EXP CVE-2023-1454 jeecg-boot Unauthorized SQL injection vulnerability JeecgBoot is a low-code development platform based on a code generator. The latest unauthorized SQL injection in the Java low-code platform jeecg-bootv3.5.0 for enterprise web applications. In addition to exploiti...

openclaw-dashboard

OpenClaw Agent Dashboard A beautiful, secure, real-time monitoring dashboard for OpenClaw agents. Track sessions, monitor API usage, view costs, manage memory files, and keep tabs on system health - all in one place. Screenshots Overview| Sessions| Costs ---|---|--- | | Rate Limits| Live Feed| Lo...

KeeFarceReborn

KeeFarce Reborn A standalone DLL that exports databases in cleartext once injected in the KeePass process. Heavily inspired by the great KeeFarce, KeeThief and KeePassHax projects. Yet another KeePass extraction tool, why ? A few years ago, @denandz released KeeFarce, the first offensive tool...

cve-2025-7771

CVE-2025-7771 — ThrottleStop.sys LPE Proof-of-concept for CVE-2025-7771. ThrottleStop.sys exposes two IOCTL handlers that allow arbitrary physical memory read/write with no access control — any admin process can read or write anywhere in physical RAM. Tested on Windows 10 22H2 and Windows 11 23H2...

WiFi-password-stealer

WiFi password stealer Have you ever seen a movie where a hacker plugs a seemingly ordinary USB drive into a computer and instantly steals data? Today, you'll be building a device that does exactly that. ⚠️ Disclaimer : All content in this project is intended for security research purposes only...

physical-bitcoin-attacks

Known Physical Bitcoin Attacks A list of known attacks against Bitcoin / crypto asset owning entities that occurred in meatspace. NOTE: this list is not comprehensive; many attacks are not publicly reported. If you are aware of an attack that is not listed, please open an issue or pull request —...

UpdraftPlus < 1.22.9 - Cross-Site Scripting

The plugin does not sanitise and escape the updraftinterval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting XSS vulnerability. id: CVE-2022-0864 info: name: UpdraftPlus 1.22.9 - Cross-Site Scripting author: DhiyaneshDk severity: medium description...

WordPress TS Poll < 2.4.0 - SQL Injection

WordPress TS Poll plugin 2.4.0 contains a SQL injection caused by lack of sanitization and escaping of a parameter before using it in a SQL statement, letting attackers perform SQL injection attacks, exploit requires admin privileges. id: CVE-2024-8625 info: name: WordPress TS Poll 2.4.0 - SQL...

Tiempo.com <= 0.1.2 - Cross-Site Scripting

Tiempo.com before 0.1.2 is susceptible to cross-site scripting via the page parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to stea...

Magento Server Mass Importer - Cross-Site Scripting

Magento Server Mass Importer plugin contains multiple cross-site scripting vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via the 1 profile parameter to web/magmi.php or 2 QUERYSTRING to web/magmiimportrun.php. id: CVE-2015-2068 info: name: Magento Server Mass...

Netsweeper 4.0.3 - Cross-Site Scripting

A cross-site scripting vulnerability in webadmin/policy/grouptableajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO. id: CVE-2014-9608 info: name: Netsweeper 4.0.3 - Cross-Site Scriptin...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/account-owner.php Owner name field. id: CVE-2018-19749 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...

Monstra CMS 3.0.4 - Cross-Site Scripting

Monstra CMS 3.0.4 contains a cross-site scripting vulnerability via the registration form i.e., the login parameter to users/registration. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal...