kyubisweep

🦊 KyubiSweep Hunt exposed secrets with the cunning of a fox! A lightweight, cross-platform CLI tool that scans your filesystem to detect exposed secrets, API keys, and tokens. Built with Go for maximum performance and zero dependencies. ✨ Features 🔍 30+ Secret Patterns - Detects AWS, Stripe,...

CVE-2026-111066

A flaw was found in aiohttp. When processing multipart requests, the framework fails to properly limit the number of open file descriptors retained during request handling. An unauthenticated remote attacker can exploit this issue by sending specially crafted multipart requests, exhausting...

CVE-2026-8168

A flaw was found in the Qt SVG module. A remote attacker could trigger this issue by providing a specially crafted SVG Scalable Vector Graphics file containing deeply nested elements. When parsed, this leads to uncontrolled recursion and stack exhaustion, resulting in an application crash and a...

tvm-recover

tvm-recover Related Zenodo record: 10.5281/zenodo.23474767. ⚠️ Disclaimer: This project is intended strictly for authorized security research, interoperability analysis, and education. It does not include or provide any bypass functionality for commercial anti-cheat systems. Users are solely...

CVE-2025-55182-burpscanner

CVE-2025-55182-burpscanner A Burp Suite passive scanning plugin for detecting CVE-2025-55182, using JDK 17 Plugin Usage: Default scanning of history / right-click active scan. When a vulnerability is detected, it automatically goes to the CVE-2025-55182 module. Deduplication Deduplication Mechani...

CVE-2026-112780

The Grav content management system, versions 2.0.15 before 2.2.2 , is vulnerable to an allowlist bypass that enables arbitrary public static method calls. By renaming Flex form fields with replace-name@, an attacker with page-edit permissions can bypass callable checks to smuggle data-*@ directiv...

CVE-2026-112780 Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-@ directives past the callable check to invoke...

EUVD-2026-104586

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-@ directives past the callable check to invoke...

CVE-2026-112780

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-@ directives past the callable check to invoke...

CVE-2026-112780 Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-@ directives past the callable check to invoke...

CVE-2026-111064

A flaw was found in aiohttp. The server does not enforce a timeout during the initial phase of a request before any data is received. A remote attacker can exploit this vulnerability by keeping idle connections open indefinitely, exhausting available connection capacity and resulting in a Denial ...

CVE-2022-34962

OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS Vulnerability Explanation: OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting XSS vulnerability via the Group Timeline module. Attack Vectors: The attacker must post something on t...

wifisting

wifisting A GTK4 wireless security toolkit for Linux. 57 modules covering Wi-Fi, Bluetooth, RF, router-side and network MITM work behind one interface. Every module is a standalone shell script. The GUI is a view over them, not a container — nothing is locked behind the interface. Early...

CVE-2016-0752

Exploiting CVE-2016-0752 This app serves as a vulnerable Proof of Concept for exploiting CVE-2016-0752. For more information refer to this blog post, which explains the vulnerability, the steps required to exploit, the fix, and a link to a metasploit module. Getting Started echo ""...

CVE-2026-84176

CVE-2026-84176 — camel-platform-http-vertx: CORS credential exposure reflected origin + credentials Runnable proof-of-concept reproducer for the Apache Camel vulnerability where VertxPlatformHttpServerSupport. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check —...

CVE-2026-85245

CVE-2026-85245 — camel-thrift: cross-exchange data disclosure shared defaultInstance Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the Thrift data format unmarshalled into the shareddefaultInstance of the target type rather than into a fresh copy, and returned that...

CVE-2026-85246

CVE-2026-85246 — camel-mina: consumer information disclosure exception written over the socket Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the Mina consumer wroteexchange.getException straight back over the socket to the remote peer when processing of an exchange...

CVE-2023-33410

CVE-2023-33410 Minical 1.0.0 is vulnerable to CSV Injection. Vendor: https://github.com/minical/minical Demo Application: https://demo.minical.io/ PoC Step 1: Navigate to the Accounting module and click on Create New Customer. Step 2: Enter the payload in the Name field and Click on Create...

CVE-2024-27665

CVE-2024-27665 Unifiedtransform v2.X is vulnerable to Stored Cross-Site Scripting XSS via file upload feature in Syllabus module. Vendor: https://github.com/changeweb/Unifiedtransform PoC Step 1: Log in to the Application and Navigate to Academic module. Step 2: Create Session,Semester,Class,Cour...

CVE-2020-1938-MSF-MODULE

CVE-2020-1938-MSF-MODULE Modified version of auxiliary/admin/http/tomcatghostcat, Read any file Overwrite the file/metasploit-framework/modules/auxiliary/admin/http/tomcatghostcat.rb and restart msfconsole to execute reloadall. Then you can use the module...