Cisco IOS XE WLC - Arbitrary File Upload

A vulnerability in the Out-of-Band Access Point AP Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.This vulnerability is due to the presence of a hard-coded JSON Web...

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

Strapi-RCE

Strapi-RCE Exploit script showcasing a mixture of CVE-2019-18818 and CVE-2019-19609 for unauthenticated remote code execution in Strapi CMS. Exploit This script exploits a vulnerability in Strapi CMS versions 3.0.0-beta.17.4 and lower, allowing for unauthenticated remote code execution. Descripti...

xattr-oob-swap

xattr-oob-swap CVE-2020-27904: a tfp0 bug for macOS 10.15.x and below. Demo exploit code for my talk at BlackHat ASIA 2021. The vulnerability has been fixed in macOS Big Sur 11.0, and the latest 10.15&10.14 security update. Warranty Use it on your own risk. This will make you macOS panic. I build...

CVE-2023-7028

CVE-2023-7028: CVE-2023-7028 Exploitation Tool Description: This Python script automates the exploitation of a hypothetical security vulnerability CVE-2023-7028 on GitLab instances. It facilitates password reset attacks on specified target email addresses, demonstrating a potential security risk...

ExtendedMacro

ExtendedMacro ExtendedMacro is plug-in for BurpSuite proxy. It provides similar but extended functionality of BurpSuite Macro feature. The main functionality is, that you are able to trigger one or more request before every request triggered from Intruder, Repeater, Scanner, Sequencer or Spider...

CVE-2025-50433

CVE-2025-50433 — Critical Account Takeover Vulnerability Affecting Monnit Cloud Platforms .imonnit.com Summary A critical authentication vulnerability exists across .imonnit.com that allows full Account Takeover ATO on any user account without victim interaction. The backend fails to validate the...

CSRFBrute

CSRFBrute CSRF login brute-force tool - V 0.5.0 Dev It is recommended to prioritize the stable and streamlined version csrfbrute.py 🚀 Features Dynamic CSRF Token refresh - Ensures accuracy on high-security targets Thread-safe session management - Supports high-concurrency operations, up to 100...

CVE-2023-38646

CVE-2023-38646 Original script from securezeron During testing, I found that the reverse shell generated by this POC failed due to the trailing '=' character after base64 encoding. I made a slight modification to fix this issue. Original reverse shell payload generation code base64.b64encode"bash...

CVE-2024-36539

Here’s a README.md for a Proof of Concept PoC demonstrating the insecure permissions vulnerability in Contour v1.28.3: Proof of Concept PoC for Insecure Permissions Vulnerability in Contour v1.28.3 This repository contains a Proof of Concept PoC script demonstrating an insecure permissions...

CVE-2020-7378

CVE-2020-7378 – OpenCRX Predictable Password Reset Token and XXE Exploit This repository contains a combined proof-of-concept PoC exploit for CVE-2020-7378 , a critical vulnerability in OpenCRX versions up to and including 5.0-20200717. The exploit chains two core issues in the application: 1. A...

CVE-2019-19609-POC-Python

The script will try to reset the password to the one declared in the "updatedpass" variable, if it succeeds - it will give a JWT token from Strapi and use it to execute commands. Executing bind commands won't work unless sending a reverse shell payload, with bash or python or whatever. You can...

askWAM

askWAM askWAM requests Microsoft Entra access tokens silently through Windows Web Account Manager WAM. It ships as a .NET Framework client, a standalone native x64 client, and an x64 Beacon Object File with a CNA command adapter. All frontends can enumerate accounts visible to the client and targ...

CVE-2021-24085

Microsoft Exchange Server msExchEcpCanary Cross Site Request Forgery Elevation of Privilege Vulnerability This is a Proof of Concept for CVE-2021-24085. 1. poc.py downloads the targets cert file with private key inside 2. YellowCanary generates the msExchEcpCanary csrf token for a specific user...

CVE-2023-31851

CVE-2023-31851 Reflected cross-site scripting XSS attack exists in web-based management interface of Cudy LT400. The page /cgi-bin/luci/admin/network/wireless/status has reflected XSS via the iface parameter. The methods of exploitation would involve sending a specially crafted request to the...

SnaffPoint

SnaffPoint What is it SnaffPoint is a tool for pointesters who are in need of some sweetness in this world. It should help you find sensitive files available on SharePoint online and on shared OneDrive files for your company or your customer. How does it work There are actually 2 tools:...

CVE-2024-50335

CVE-2024-50335: Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation Summary The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting XSS, allowing an attacker to inject malicious JavaScript code. This can be...

CVE-2025-23040

CVE-2025-23040 - Credential Leak in GitHub Desktop GitHub Desktop 3.4.12 is vulnerable to an attack that allows exfiltration of credentials via malicious remote URLs. An attacker can convince a user to clone a manipulated repository to obtain username and OAuth token...

CVE-2026-108548 AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token

AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's authhandler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-...

CVE-2026-108548

AstronRPA versions through 1.1.6 are vulnerable to an authentication bypass due to a flaw in the OpenResty gateway's auth_handler.lua component. The system fails to validate Bearer tokens , allowing unauthenticated attackers to provide arbitrary values to access the /api/resource/ and /api/rpa-ai...