SpringFramework_CVE-2022-22965_RCE

SpringFrameworkCVE-2022-22965RCE SpringFramework Remote Code Execution Vulnerability CVE-2022-22965 Vulnerability Reproduction Environment docker pull vulfocus/spring-core-rce-2022-03-29 docker run -d -p 8090:8080 --name springrce -it vulfocus/spring-core-rce-2022-03-29 Write webshell Note: The...

PenBox

PenBox – A Penetration Testing Framework A Penetration Testing Framework , The Hacker’s Repo our hope is in the last version we will have evry script that a hacker needs Information Gathering : nmap Setoolkit Port Scanning Host To IP wordpress user enumeration CMS scanner XSStracer - checks remot...

CVE-2025-6563

MikroTik Hotspot Login Page Reflected XSS Vulnerability Advisory Overview A reflected Cross-Site Scripting XSS vulnerability was discovered in the MikroTik RouterOS Hotspot login page. The vulnerability is triggered via the dst URL parameter, which improperly sanitizes input, allowing malicious...

Dirty-Frag-Research-CVE-2026-43284-

CVE-2026-43284 Dirty Frag – Linux Kernel Vulnerability Research Overview This repository documents a complete defensive security research project focused on CVE-2026-43284 Dirty Frag , a Linux kernel vulnerability affecting the XFRM/IPsec networking subsystem. The goal of this project is not to...

CVE-2025-15276-poc

CVE-2025-15276: FontForge SFD PickledData Insecure Deserialization RCE Disclaimer This Proof of Concept PoC is for educational purposes and security auditing only. The author is not responsible for any misuse of this information. Unauthorized access to computer systems is illegal. Always obtain...

CVE-2015-1328

CVE-2015-1328 TryHackMe Walkthrough – Linux Kernel Privilege Escalation CVE-2015-1328 Objective The goal of this walkthrough was to escalate privileges from a low-privileged user karen to root by exploiting a vulnerable Linux kernel. Step 1 – Initial Enumeration After connecting to the target...

SMB-Session-Spoofing

/ | / || \ / | / | / | \ --.| . . || |/ / \ --. \ --. | | --. \ |/| || \ --. / / / | |/ | ' \ --. \ ' \ / \ / | / \ '| // / | | || |/ / // / /\ \ \ | | | | | // / | | | | || / | /| |// / ||//|/|| || /| ./ / /|| || | | || Welcome! This is a utility that can be compiled with Visual...

CVE-2021-44228-Apache-Log4j-Rce

CVE-2021-44228Apache Log4j Remote Code Execution） all log4j-core versions =2.0-beta9 and =2.14.1 The version of 1.x have other vulnerabilities, we recommend that you update the latest version. Security Advisories / Bulletins linked to Log4Shell CVE-2021-44228 Usage: download this project, compile...

conductai

Conduct Governance for AI agents. Ship in 60 seconds. Built for engineering teams. Install in 10 minutes. Evidence for the CISO from day one. 60-second t...

GoRedOps

GoRedOps Telegram: https://t.me/ebytelabs GoRedOps is a collection of Golang projects designed specifically for red teamers and offensive security operations. This repository provides various tools and techniques essential for penetration testing, exploitation, and security research. Table of...

WinPwn

Sponsored by WinPwn In many past internal penetration tests I often had problems with the existing Powershell Recon / Exploitation scripts due to missing proxy support. I also often ran the same scripts one after the other to get information about the current system and/or the domain. To automate...

CVE-2026-66754-Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille-

Security Advisory: Remote Denial of Service via Reachable Assertion in URL Prefix Handling rouille Assigned CVE ID: CVE-2026-66754 Summary Request::removeprefix tests the percent-decoded URL but asserts on the raw one. A request whose decoded path starts with the prefix while its raw path does no...

Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

============================================================================ Quadratic-time DoS in PDF saveall PdfParser.nextobjectid Location: src/PIL/PdfParser.py:629 in nextobjectid Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-JG86-V3JV-HRPM Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

============================================================================ Quadratic-time DoS in PDF saveall PdfParser.nextobjectid Location: src/PIL/PdfParser.py:629 in nextobjectid Commit: a707c6b21c313880d0771e54965d142dd42358b6...

KITT-Lite

KITT Penetration Testing Framework - Lite Version No longer maintained, may need some edits to function The KITT Penetration Testing Framework was developed as an open source solution for pentesters and programmers alike to compile the tools they use with what they know into an open source projec...

CVE-langgraph

cve-id ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone cd Project use python follow below Create a virtual environment python -m venv...

Penetration-Testing-Tools

A collection of my Penetration Testing Tools, Scripts, Cheatsheets This is a collection of more than a 160+ tools, scripts, cheatsheets and other loots that I've been developing over years for Penetration Testing and IT Security audits purposes. Most of them came handy at least once during my...

CVE-2026-33017

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote Code Execution PoC ★ https://github.com/user-attachments/assets/562fc637-6be1-4ab9-a396-bfad56447af7 Environment Setup Use the following commands to build and run the vulnerable Langflow environment: docker build -t...

CVE-2025-59382-QNAP-Password-Reset-Account-Takeover

CVE-2025-59382: QNAP Password Reset to Account Takeover Unauthenticated attacker-controlled password reset URL in /cgi-bin/resetpassword.cgi. Tested against QuTScloud c5.2.4.3041 build 20250211 in a lab. QNAP later published this as CVE-2025-59382 in advisory QSA-26-10. Short version An...

bfac

BFAC Advanced Backup-File Artifacts Testing for Web-Applications BFAC Backup File Artifacts Checker is an automated tool that checks for backup artifacts that may disclose the web-application's source code. The artifacts can also lead to leakage of sensitive information, such as passwords,...