CVE-2024-42327

CVE-2024-42327: Zabbix Privilege Escalation - RCE Description This Proof-of-Concept POC can be used to exploit CVE-2024-42327 to leak the admin API authentication token and create an item to achieve a reverse shell on a Zabbix server 6.0.32rc1, 6.4.17rc1, 7.0.1rc1 A non-admin user account on the...

telegram-bot-dumper

telegram-bot-dumper Easy dumping of all Telegram bot stuff. Input : only bot token. Output : bot name & info, all chats text history & media, bot's users info & photos. This is a Python implementation. 🚀 Fast Golang version by ScBoln. Requirements Python = 3.6 Telethon = 1.24.0 Register Telegram...

OneDev < 4.0.3 - User Access Token Leak

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/id, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions. id: CVE-2021-21246...

SharpToken

SharpToken During red team lateral movement, we often need to steal the permissions of other users. Under the defense of modern EDR, it is difficult for us to use Mimikatz to obtain other user permissions, and if the target user has no process alive, we have no way to use "OpenProcessToken" to...

CVE-2021-21551

CVE-2021-21551 Exploit to SYSTEM for CVE-2021-21551 SpoolPrinter Privesc using SeImpersonatePrivileges was made thanks to @ForrestOrr https://github.com/forrest-orr/DoubleStar/tree/main/Payloads/Source/Stage3SpoolPotato I basically just tossed the exploit function in his code and altered it ever ...

CVE-2024-42327_Zabbix_SQLi

🛡️ Zabbix 7.0.0 SQL Injection Exploit Script A Python script to exploit a Zabbix 7.0.0 authenticated SQL injection vulnerability, supporting multiple modes of action including user data extraction, session token leaks, remote command execution RCE, and custom query injection. ⚠️ DISCLAIMER: This...

CitrixBleed-2-CVE-2025-5777

CitrixBleed-2-CVE-2025-5777 checker checker.py httphttpshost:port.txt result.txt 8 better you run OPENSSLCONF=./openssl.cnf checker.py httphttpshost:port.txt result.txt 8 poc this poc automatic exploit CVE-2025-5777 and check token exsist and after valid or not. poc.py -u https://target.example.c...

CVE-2026-21008-Kubernetes-Service-Account-Token-Mounted-in-HostPath

CVE-2026-21008 – Kubernetes Service Account Token Mounted in HostPath Program Code YAML + Python exploit root@kitploit: vulnerable-pod.yaml - Pod that mounts /var/run/secrets/kubernetes.io/serviceaccount into a hostPath apiVersion: v1 kind: Pod metadata: name: sa-token-leak spec: containers: -...

CVE-2026-3055

🔥 NetScalerBleed2: Critical Unauth Memory Overread in Citrix NetScaler CVE-2026-3055 Unauthenticated Out-of-Bounds Memory Read Memory Leak Only on appliances configured as SAML Identity Provider IdP 📋 Overview CVE-2026-3055 is a critical out-of-bounds read vulnerability CWE-125 in Citrix NetScale...

Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Summary When a request returns a 500, jupyterserver/log.py logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. Impact Anyone who can read the server logs can pick tokens out of these 500 entries...

GHSA-C3MW-737P-C7G2 Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Summary When a request returns a 500, jupyterserver/log.py logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. Impact Anyone who can read the server logs can pick tokens out of these 500 entries...

EUVD-2026-82436

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

CVE-2026-86049 Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

trust-boundary-ctf

🐘 Trust Boundary: MCP Session Isolation CTF The console reads Session Active. Every tool call succeeds. The admin OAuth token is in every response. Trust Boundary is a browser-based CTF lab built around a real session isolation failure in a locally-running MCP server. The vulnerability is not...

CVE-2026-39912

CVE-2026-39912 - Xboard / V2Board Unauth Account Takeover Magic Link Token Leak in loginWithMailLink | ---|--- CVE| CVE-2026-39912 CVSS| 9.1 Critical CWE| CWE-201 Insertion of Sensitive Information Into Sent Data Affected| V2Board = 1.6.1 through 1.7.4 / Xboard all versions through 0.1.9+ Fixed|...

CVE-2025-62168

CVE-2025-62168 — Squid Proxy Token Leak PoC The author assumes no liability for misuse or damage caused by this tool. Research is provided strictly for educational and defensive purposes. Description This repository contains a Proof-of-Concept PoC for CVE-2025-62168 , an information-disclosure fl...

CVE-2026-64684

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamablehttpclient.rs builds its defaulthttpclient with reqwest's automatic redirect policy and applies caller-supplied values...

CVE-2025-10035_GoAnywhere

GoAnywhere CVE-2025-10035 Checker Description A lightweight Python checker that detects whether a GoAnywhere instance is vulnerable to CVE‑2025‑10035. This tool sends a crafted GET request with a randomized User-Agent using fake-useragent with a fallback list, does not follow redirects, inspects...

CVE-2026-61559 @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab A...

CVE-2025-58434-PoC

CVE-2025-58434-PoC This repository contains a Proof of Concept PoC Python script for CVE-2025-58434, which enables attackers to change passwords of other users without authentication process in flowise version 3.0.5 and lower due to token leakage. Usage To run the exploit, use the...