EUVD-2026-97260

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify...

CVE-2020-6287-exploit

CVE-2020-6287-exploit PoC for CVE-2020-6287 The PoC in python for add user only, no administrator permission set. Inspired by @zeroSteiner from metasploit. Original Metasploit PR module: https://github.com/rapid7/metasploit-framework/pull/13852/commits/d1e2c75b3eafa7f62a6aba9fbe6220c8da97baa8 Thi...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 A fast tool to fetch URLs from HTML attributes by crawl-in. Inspired by the @omespino Tweet, which is possible to extract src, href, url and action values by evaluating JavaScript through Chrome DevTools Protocol. Resources...

CVE-2023-27100

CVE-2023-27100 - pfSense Anti-brute force protection bypass Problem Description The authentication system attempts to be informative and print extra information along with IP addresses to completely identify where a user logs in from when they login using the GUI. This includes the authentication...

phantap

PhanTap Phantom Tap PhanTap is an ‘invisible’ network tap aimed at red teams. With limited physical access to a target building, this tap can be installed inline between a network device and the corporate network. PhanTap is silent in the network and does not affect the victim’s traffic, even in...

Invoke-TheHash

Invoke-TheHash Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege i...

CVE-2026-109080

SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock identified the issue...

CVE-2026-84167

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referenci...

CVE-2026-98385

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Decouple schedcachegroup from mm to fix UAF Currently the sched cache grouping is by mm and the scheduling statistics schedcachestat lives in the mm structure. This ties the life cycle of scheduling stats with mm. In...

CVE-2026-107193

A flaw has been found in permission filters in the foreman package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filte...

CVE-2026-107203

An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on t...

awsEnum

awsEnum Enumrate AWS services! with no nosies awsEnum is a python script enumrate AWS services through the provided credential. :book: Table of Contents Table of Contents 1. Screenshot 2. Disclaimer 3. Features 4. Prerequisites 5. How to Install 6. Results and FQAs 7. To-Do :clapper: Screenshot...

MacHound

What is MacHound MacHound is an extension to the Bloodhound audting tool allowing collecting and ingesting of Active Directory relationships on MacOS hosts. MacHound collects information about logged-in users, and administrative group members on Mac machines and ingest the information into the...

ShellCodeEmulator

Windows shellcode emulation tool based upon unicorn framework. ShellcodeEmulator emulates Windows shellcode with the help of windbg process memory dumps. You can provide shellcode to analyze with any Windows process dump image. The tool will emulate as much as of the userland code using the...

MailRipV2

Mail.Rip V2.1337 Your SMTP checker / SMTP cracker for mailpass combolists including features like: proxy-support SOCKS4 / SOCKS5 with automatic proxy-scraper and checker, e-mail delivery / inbox check and DNS lookup for unknown SMTP-hosts. Made for easy usage and always working! Overview Legal...

ppfuzz

ppfuzz Prototype Pollution Fuzzer A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀 Installation Binary Source Dependencies Demonstration Usage Basic Options Usage Supporting Materials Contributing Attribution Acknowledments License Installation Binary Simply,...

MultiPotato

MultiPotato First of all - credit to @splintercode & @decoderit for RoguePotato as this code heavily bases on it. This is just another Potato to get SYSTEM via SeImpersonate privileges. But this one is different in terms of It doesn't contain any SYSTEM auth trigger for weaponization. Instead the...

CVE-2025-54322-exploit

CVE-2025-54322: XSpeeder SXZOS Pre-Auth RCE Exploit A professional Proof-of-Concept PoC exploit for CVE-2025-54322 , a critical pre-authentication remote code execution vulnerability in XSpeeder SXZOS firmware. This vulnerability was discovered and disclosed by the autonomous AI agent from pwn.ai...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...

BruteLoops

BruteLoops A dead simple library providing the foundational logic for efficient password brute force attacks against authentication interfaces. Documentation Documentation can be found here. If you're looking for the old example modules... See BFG. The examples have been offloaded to a distinct...