p4wned

P4WNED CVE-2026-6043 Perforce Helix Core security research tools and nuclei templates. Research article: https://morganrobertson.net/p4wned/ Please read the above for complete details. Authorised targets only. Use on your own servers or with explicit written permission. Intended audience: Perforc...

CVE-2023-36085_SISQUALWFM-Host-Header-Injection

CVE-2023-36085 SISQUALWFM Host Header Injection Vulnerability This repository contains information related to a host header injection vulnerability discovered in SISQUALWFM version 7.1.319.103, which allows an attacker to manipulate webpage links or redirect users to a malicious site. This...

kernel-exploits

Kernel Exploits Various kernel exploits CVE-2021-22555 Linux local root exploit. Updated version of theflow's exploit for CVE-2021-22555. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain privileges or cause a D...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start Download the Repo = run npm i Afer Installing all dependency just run the application node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4 Broken Session Management ✅5 We...

tookie-osint

Tookie-OSINT V4 is here! Tookie-OSINT has been re-written 100% from scratch for ultimate performance! Translations are still not ready yet. The wiki and readme are going through some changes. 🌐 Language Select your language / 言語を選択してください / 选择你的语言 / Sélectionnez votre langue / Seleccione su idioma...

knowsmore

Knows More KnowsMore officially supports Python 3.8+. Main features Import NTLM Hashes from .ntds output txt file generated by CrackMapExec or secretsdump.py Import NTLM Hashes from NTDS.dit and SYSTEM Import Cracked NTLM hashes from hashcat output file Import BloodHound ZIP or JSON file BloodHou...

CVE-2026-0023-Update-Ownership-PoC

CVE-2026-0023 - Android Update Ownership Trust Bypass PoC A complete Android laboratory environment for reproducing and studying CVE-2026-0023. This repository demonstrates how CVE-2026-0023 allows a regular installer to influence an internal Android installation flag that should only be controll...

CVE-2026-105314

Papermerge 3.5.3 is vulnerable to remote code execution (RCE) due to a directory traversal flaw in the /api/documents/upload endpoint. A standard user can exploit this to write a Python .pth file into the site-packages directory. The malicious code within the .pth file is executed automatically d...

redsnarf

. \ \ | / / / \ | // \ / |\ \ / \ \ \ \ | | \ // // |/ \ | / | | /| | || /\ / /| /| || / / / / / / [email protected] @redsnarf RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and domain controllers...

CVE-2024-23700

PoC for CVE-2024-23700, allowing silently obtain permissions to read/write contacts, SMS, calendar, call log and voicemail, make outgoing calls or answer incoming calls, manipulate call settings, access & control notifications sent by other apps, control nearby devices, access microphone to recor...

decider

Decider This work is licensed under a Creative Commons Attribution 4.0 International License. This project makes use of MITRE ATT&CK® - ATT&CK Terms of Use. 📰 3.0.0 - Kiosk is Here Decider is now login-less and responsive. Content updates have been simplified to copying files and restarting Docke...

nullinux

nullinux Nullinux is an internal penetration testing tool for Linux that can be used to enumerate OS information, domain information, shares, directories, and users through SMB. If no username and password are provided in the command line arguments, an anonymous login, or null session, is...

adidnsdump

Active Directory Integrated DNS dump tool By default any user in Active Directory can enumerate all DNS records in the Domain or Forest DNS zones, similar to a zone transfer. This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks. For mo...

GhostKatz

GhostKatz Extract LSASS credentials directly from physical memory by abusing signed vulnerable drivers with physical memory read primitives via MmMapIoSpace, bypassing traditional user-mode detection capabilities. This tool was developed in collaboration between Julian Peña and Eric Esquivel. Thi...

CVE-2026-7458

🧨 CVE-2026-7458 – PickPlugins User Verification OTP Bypass Unauthenticated Authentication Bypass via Loose Comparison in OTP Verification REST API PickPlugins User Verification ≤ 2.0.46 📖 Description The User Verification plugin by PickPlugins for WordPress versions ≤ 2.0.46 contains a critical...

CVE-2021-25076

CVE-2021-25076-Exploit Wordpress Plugin WP User Frontend 3.5.26 - SQL-Injection Authenticated CVE description: The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL...

wpUsersScan

wpUsersScan About wpUsersScan Enumerate the users list of the wordpress websites through the REST API / CVE-2017-5487,WordPress 4.7.1 - Username Enumeration Usage $ python wpUsersScan.py URL How to install Clone Clone the repository with: $ git clone https://github.com/ihebski/wpUsersScan.git $ c...

CVE-2018-19788

Proof of Concept for the CVE-2018-19788 Ansible role to check the vulnerability tracked as CVE-2018-19788 that impacts PolicyKit version 0.115 which comes pre-installed on a wide range of Linux distributions such as Ubuntu, Red Hat, CentOs, to mention a few. Requirements Minimum required ansible...

CVE-2025-26125

Description The PoC program exploits the IMFForceDelete driver which exposes an ioctl that allows unprivileged users to delete files and folders. We can turn this into a privilege escalation by using a technique explained by ZDI and Halov, which exploits the MSI rollback mechanism which is design...

CVE-2021-44103

CVE-2021-44103 A proof of concept for KONGA 0.14.9 - Privilege Escalation. Intro On November 16, 2021, Fabrício Salomão and I found a vulnerability in Konga API Gateways, allowing any authenticated user to become an administrator. Report Vulnerability Product: KONGA Model: 0.14.9 Vulnerability:...