CVE-2023-4966-POC

CVE-2023-4966-POC Proof Of Concept for NetScaler CVE-2023-4966 Vulnerability Description This Python script exploits CVE-2023-4966, a critical vulnerability in Citrix ADC instances that allows unauthenticated attackers to leak session tokens. The vulnerability is assigned a CVSS score of 9.4 and ...

CVE-2024-42327

CVE-2024-42327: Escalada de Privilegios en Zabbix - RCE Descripción Este Proof-of-Concept PoC se puede utilizar para explotar CVE-2024-42327, filtrar el token de autenticación de la API de administración y crear un elemento para obtener una reverse shell en un servidor Zabbix 6.0.32rc1, 6.4.17rc1...

CVE-2025-58434-PoC

CVE-2025-58434-PoC This repository contains a Proof of Concept PoC Python script for CVE-2025-58434, which enables attackers to change passwords of other users without authentication process in flowise version 3.0.5 and lower due to token leakage. Usage To run the exploit, use the...

OneDev < 4.0.3 - User Access Token Leak

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/id, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions. id: CVE-2021-21246...

CVE-2021-21551

CVE-2021-21551 Exploit to SYSTEM for CVE-2021-21551 SpoolPrinter Privesc using SeImpersonatePrivileges was made thanks to @ForrestOrr https://github.com/forrest-orr/DoubleStar/tree/main/Payloads/Source/Stage3SpoolPotato I basically just tossed the exploit function in his code and altered it ever ...

SharpToken

SharpToken Durante el movimiento lateral del equipo rojo, a menudo necesitamos robar los permisos de otros usuarios. Bajo la defensa de un EDR moderno, nos resulta difícil usar Mimikatz para obtener otros permisos de usuario, y si el usuario objetivo no tiene ningún proceso activo, no tenemos for...

CVE-2025-62168

CVE-2025-62168 — PoC de Filtración de Token de Squid Proxy El autor no asume ninguna responsabilidad por el mal uso o daños causados por esta herramienta. La investigación se proporciona estrictamente con fines educativos y defensivos. Descripción Este repositorio contiene una Prueba de Concepto...

CVE-2024-42327_Zabbix_SQLi

🛡️ Script de Explotación de Inyección SQL en Zabbix 7.0.0 Un script en Python para explotar una vulnerabilidad de inyección SQL autenticada en Zabbix 7.0.0 , que admite múltiples modos de acción, incluida la extracción de datos de usuario, fuga de tokens de sesión, ejecución remota de comandos RCE...

CitrixBleed-2-CVE-2025-5777

CitrixBleed-2-CVE-2025-5777 verificador checker.py httphttpshost:port.txt result.txt 8 mejor ejecuta OPENSSLCONF=./openssl.cnf checker.py httphttpshost:port.txt result.txt 8 poc este poc explota automáticamente CVE-2025-5777 y verifica si el token existe y luego si es válido o no. poc.py -u...

CVE-2026-21008-Kubernetes-Service-Account-Token-Mounted-in-HostPath

CVE-2026-21008 – Token dell'account di servizio Kubernetes montato in HostPath Codice del programma YAML + exploit Python root@kitploit: vulnerable-pod.yaml - Pod that mounts /var/run/secrets/kubernetes.io/serviceaccount into a hostPath apiVersion: v1 kind: Pod metadata: name: sa-token-leak spec:...

CVE-2026-3055

🔥 NetScalerBleed2: Kritischer nicht authentifizierter Speicher-Overread in Citrix NetScaler CVE-2026-3055 Nicht authentifizierter Speicher-Overread Speicherleck Nur auf Appliances, die als SAML-Identity-Provider IdP konfiguriert sind 📋 Übersicht CVE-2026-3055 ist eine kritische...

CVE-2026-39912

CVE-2026-39912 - Xboard / V2Board: Kontoübernahme ohne Authentifizierung Magic-Link-Token-Leak in loginWithMailLink | ---|--- CVE| CVE-2026-39912 CVSS| 9.1 Kritisch CWE| CWE-201 Insertion of Sensitive Information Into Sent Data Betroffen| V2Board = 1.6.1 bis 1.7.4 / Xboard alle Versionen bis 0.1....

CVE-2026-81715

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

CVE-2025-10035_GoAnywhere

فاحص GoAnywhere CVE-2025-10035 الوصف فاحص خفيف بلغة Python يكتشف ما إذا كان مثيل GoAnywhere معرضًا لـ CVE‑2025‑10035. ترسل هذه الأداة طلب GET مصممًا بعناية مع User-Agent عشوائي باستخدام fake-useragent مع قائمة احتياطية، ولا تتبع عمليات إعادة التوجيه، وتفحص ترويسة Location، وتصنّف المثيل على أنه غ...

CVE-2026-81101

Airtable MCP CLI before 0.2.5 contained a credential-disclosure flaw in its configure command. The ConfigureCommand.execute method in src/cli.ts persisted a user-supplied endpoint URL without validating it through createSafeUrl in src/config.ts—the helper that already restricted the equivalent en...

CVE-2026-81101 Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...

trust-boundary-ctf

🐘 Trust Boundary: CTF sull'isolamento delle sessioni MCP La console riporta Session Active. Ogni chiamata strumento ha successo. Il token OAuth dell'amministratore è in ogni risposta. Trust Boundary è un laboratorio CTF basato su browser, costruito attorno a un reale fallimento nell'isolamento...

telegram-bot-dumper

telegram-bot-dumper Einfaches Dumping aller Telegram-Bot-Daten. Eingabe : nur Bot-Token. Ausgabe : Bot-Name & -Info, gesamter Chat-Verlauf Text & Medien, Benutzerinformationen & -fotos des Bots. Dies ist eine Python-Implementierung. 🚀 Schnelle Golang-Version von ScBoln. Voraussetzungen Python = 3...

CVE-2026-80201

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken and getPlainApiToken methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered...

PT-2026-81914

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.53.0 Description The Twig invoice template sandbox fails to block sensitive User methods. This allows users with template creation permissions to call the getApiToken and getPlainApiToken functions, leading to the...