CVE-2026-3055

🔥 NetScalerBleed2: Sobrelectura crítica de memoria no autenticada en Citrix NetScaler CVE-2026-3055 Lectura de memoria fuera de límites no autenticada Fuga de memoria Solo en appliances configurados como Proveedor de identidad SAML IdP 📋 Descripción general CVE-2026-3055 es una vulnerabilidad...

RocketChat-NoSQLi-Chain-CVE-2021-22911

Rocket.Chat NoSQLi Fuga de Token y Restablecimiento de Contraseña Un script de explotación automatizado para Rocket.Chat y aplicaciones basadas en Meteor que aprovecha una Inyección NoSQL mediante la cláusula $where para filtrar tokens de restablecimiento de contraseña a través de excepciones del...

KilledProcessCanary

Windows Killed Process Canary Un servicio de Windows para detectar si ha sido detenido e hibernar si hay múltiples instancias. Publicado como código abierto por NCC Group Plc - http://www.nccgroup.com/ Desarrollado por Ollie Whitehouse, ollie dot whitehouse at nccgroup dot com...

jwt-reauth

JWT Re-auth Plugin de Burp para almacenar en caché tokens de autenticación de una URL "auth" y luego añadirlos como cabeceras en todas las peticiones que vayan a un determinado alcance. Características El plugin permite que se le envíen ajustes mediante menús contextuales desde varios menús. Esto...

CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation

CVE-2026-1529 Herramienta de explotación de Keycloak Keycloak: Registro no autorizado de organizaciones mediante una validación inadecuada del token de invitación Aviso legal Esta herramienta es solo para fines educativos y de pruebas de seguridad. Úsala únicamente en sistemas donde tengas permis...

gh-hijack-runner

gh-hijack-runner Un script en Python para crear un runner falso de GitHub y secuestrar trabajos de pipeline para filtrar secretos de CI/CD. Descubre más detalles en el siguiente artículo: https://www.synacktiv.com/publications/hijacking-github-runners-to-compromise-the-organization Explotación Si...

TATS

TATS — Token Analysis and Tracking System Track OAuth 2.0, OIDC, and Microsoft Entra ID tokens across captured network traffic. Ingests Burp Suite XML exports, mitmproxy flow files, or live Chrome DevTools Protocol streams into a single SQLite database, then serves an interactive web dashboard fo...

CVE-2025-58434

CVE-2025-58434 - Flowise unauthenticated account takeover, chained to CustomMCP RCE Two Flowise 3.0.5 issues, chained: 1. CVE-2025-58434 - password-reset token disclosure. POST /api/v1/account/forgot-password returns the target user's tempToken directly in the JSON response. Feed it to POST...

DefinitelyNotPhishing

⚠️ Disclaimer This repository is intended solely for educational and testing purposes. All tools, configurations, and resources included here such as phishing templates, red team utilities, or offensive security scripts are provided strictly for use in authorized environments , such as labs, demos...

CVE-2026-73309

CVE-2026-73309: Empty OAuth2 credentials bypass XenForo before 2.3.13 can skip OAuth2 client-secret and PKCE verification when an empty string reaches the token endpoint. What happens The endpoint checks whether clientsecret and codeverifier keys exist, then performs the comparisons only when the...

CVE-2026-82329-JFrog-Artifactory-Auth-Bypass

artifactory.py ╔══════════════════════════════════════════════════════════╗ ║ artifactory · CVE-2026-82329 unauth admin takeover ║ ║ mitsec · https://x.com/ynsmroztas ║ ╚══════════════════════════════════════════════════════════╝ CVE-2026-82329 — JFrog Artifactory self-hosted unauthenticated...

CVE-2026-55040-Mass-Exploit

JWT Token Bypass Exploit for Microsoft SharePoint CVE-2026-55040, CVSS 9.1. Forge authentication tokens using three attack vectors: Algorithm "none" skips signature verification Weak HS256 secrets with brute-force dictionary support RS256 key substitution Impersonate any user including...

CVE-2026-48060

CVE-2026-48060 - Litestar HTML Injection Through CSRF Token This repo contains the proof of concept exploit and vulnerable application to demonstrate the HTML injection vulnerability present in version 2.21.0 of Litestar. How to Run git clone https://github.com/Blinky-Keys/CVE-2026-48060 cd...

cPanel-CVE-2026-41940-Scanner

cPanel-CVE-2026-41940-Scanner This high-performance security tool is designed to identify and exploit CVE-2026-41940 , a critical CRLF injection vulnerability in cPanel & WHM. It automates the entire process from Shodan discovery to administrative token creation. Key Features Automated Shodan...

CVE-2026-41940

CVE-2026-41940 Auto Exploit Overview CVE-2026-41940 is a proof-of-concept PoC exploit targeting cPanel/WHM. This exploit demonstrates an unauthenticated authentication bypass using CRLF injection to leak security tokens and gain root-level access to the WHM interface, allowing for actions such as...

CVE-2026-29000

CVE-2026-29000 CVE-2026-29000: Critical Authentication Bypass in pac4j-jwt - Using Only a Public Key CVSS 10 pac4j-jwt Authentication Bypass Exploit CVE-2026-29000 Vulnerability Summary CVE-2026-29000 is a critical authentication bypass in the pac4j-jwt library versions 6.0.3 and below. When the...

CVE-2025-9485

Exploit: Bypass de Autenticación mediante JWT sin Firma alg: none 1 Forjar un JWT sin firma reclamando el correo del administrador TOKEN=$node -e ' function b64us return Buffer.froms.toString"base64" .replace/+/g,"-" .replace///g,"" .replace/=+$/,"" const header = b64uJSON.stringify alg: "none",...

gcat

Gcat A stealthy Python based backdoor that uses Gmail as a command and control server This project was inspired by the original PoC code from Benjamin Donnelly This is PoC code... ... that was released for orginazations to test their defenses against these type of attacks. In order to detect them...

CVE-2026-25099

CVE-2026-25099 - Bludit CMS API Unrestricted File Upload to RCE Description Bludit CMS versions before 3.18.4 allow an authenticated attacker with a valid API token to upload files of any type and extension via the POST /api/files/ endpoint. The uploadFile function performs no file extension or...

ls-poc

CVE-2026-30368 Proof of concept !IMPORTANT This is patched and now requires credentials, use the workaround to perform actions on yourself. Introduction CVE-2026-30368 allows an attacker to control student devices via a weak authentication flaw in Lightspeed Classroom management. The POC poc.js...