CVE-2023-36845

CVE-2023-36845 Description CVE-2023-36845 represents a notable PHP environment variable manipulation vulnerability that impacts Juniper SRX firewalls and EX switches. While Juniper has categorized this vulnerability as being of medium severity, in this article, we will elucidate how this singular...

Malicious-MCP

Malicious MCP This is a proof-of-concept project that allows you to deploy an MCP server that "disguises" itself as any other MCP server. This MCP acts as an MCP 'Proxy', and simply forwards all incoming requests to an upstream MCP server. What is an MCP? An MCP Server is a program that expose...

CVE-2022-0337-PoC-Google-Chrome-Microsoft-Edge-Opera

🤝 Show your support - give a ⭐️ if you liked the content | SHARE on Twitter | Follow me on CVE-2022-0337 System environment variables leak on Google Chrome, Microsoft Edge and Opera 📝 Description Successful exploitation of this vulnerability can lead to the leak of user's secrets stored inside a...

CVE-2022-0847

CVE-2022-0847 Dirty Pipe Linux Kernel Privilege Escalation Analysis toc This article was first published on Huawei Security's official account, this is the blog version more complete First published link: https://mp.weixin.qq.com/s/6VhWBOzJ7uu80nzFxe5jpg Vulnerability Introduction Vulnerability I...

bash-apocalypse

Bash Apocalypse Automated exploitation toolkit for CVE-2014-6271 Shellshock A complete security research project demonstrating the Shellshock vulnerability that affected millions of servers in 2014. Includes automated scanning, exploitation capabilities, and defensive recommendations. Demo What i...

CVE-2020-8250

CVE-2020-8250: Privilege Escalation via Command Injection in Pulse Secure VPN Linux Client The root SUID executable pulsesvc, has a function “doupload” that unsafely passes the “HOME” environmental variable to “system”. By altering the “HOME” variable to contain special shell characters Ex: “” or...

deepsecrets

DeepSecrets - a better tool for secret scanning !WARNING Active development was switched to the creator's fork at https://github.com/ntoskernel/deepsecrets. This repository will not receive any updates...

Out-FINcodedCommand

Out-FINcodedCommand v1.0 Introduction Out-FINcodedCommand is a PowerShell v2.0+ compatible PowerShell POC script designed to highlight several obfuscation techniques used by FIN threat actors. The primary obfuscation techniques highlighted in this tool are: 1. cmd.exe's variable char/string...

CVE-2026-24061

CVE-2026-24061 Telnet RCE Exploit - By SafeBreach Labs This script exploits the CVE-2026-24061 vulnerability in Telnet servers using a malformed USER environment variable. Usage Run the script with a target host: python telnetrce.py -p Arguments host: Target IP address or hostname required -p,...

CVE-2014-6271-Shellshock-

Exploiting Shellshock CVE-2014-6271: A Complete, Modern Demonstration Lab Shellshock CVE-2014-6271 is one of the most influential remote code execution vulnerabilities ever discovered. The flaw affects Bash and allows attackers to execute arbitrary commands simply by injecting crafted payloads in...

CVE-2023-22809

Linux Privilege Escalation Exploit for CVE-2021-3560 Sudoedit a.k.a -e - Local Privilege Escalation For educational and authorized security research purposes only Original Exploit Authors n3m1dotsys Vulnerability Description In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra...

instrumentation_callbacks

instrumentationcallbacks Instrumentation callbacks are quite a fun undocumented part of Windows. All the code in this repository is released under the MIT license. This repository uses google style C++ spacing. PRs are welcome if you find issues, bugs, or believe a specific feature should be adde...

JObfuscator

JObfuscator — Java Source Code Obfuscation & Protection JObfuscator is a source code obfuscator for the Java programming language. It can protect your Java source code and algorithms from hacking, cracking, reverse engineering, decompilation, and technology theft. JObfuscator employs a variety of...

CVE-2026-50979

CVE-2026-50979: Authenticated Remote Code Execution in oPanel Overview CVE ID: CVE-2026-50979 Product: oPanel Affected Versions: v1.19.50 and earlier Vulnerability Type: Authenticated Command Injection / Remote Code Execution RCE Vulnerable Component: /advanced/curl endpoint Severity: Critical...

Gepetto

Gepetto Gepetto is a Python plugin which uses various large language models to provide meaning to functions decompiled by IDA Pro ≥ 7.6. It can leverage them to explain what a function does, and to automatically rename its variables. Here is a simple example of what results it can provide in mere...

CVE-2026-24061-GNU-InetUtils-telnetd

CVE-2026–24061 : GNU InetUtils telnetd Authentication Bypass Vulnerability CVE-2026–24061 is a critical weakness in the telnetd service of GNU InetUtils CVE ID : CVE-2026–24061 Severity : Critical CVSS 9.8 Attack Vector : Network Authentication Required : None Impact : Full system compromise root...

CVE-2022-42889-RCE

CVE-2022-42889-PoC Proof of Concept for CVE-2022-42889 remote code execution exploit Text4Shell Vulnerability. Give a ⭐ for support ❤️ About this vulnerability CVE-2022-42889 is a new critical vulnerability similar to Spring4Shell and Log4Shell. Its a RCE Remote Code Execution vulnerability with...

CVE-2026-24061

CVE-2026-24061-PoC ⚠ This tool is created solely for educational use only. Unauthorized use outside of controlled environments is strictly prohibited. CVE-2026-24061 is a critical vulnerability CVSS 9.8 in telnetd from GNU Inetutils versions 1.9.3–2.7 that allows a remote attacker to bypass...

CVE-2024-28397-js2py-Sandbox-Escape

Introduction 中文 Analysis Chinese Analysis English js2py is a popular python package that can evaluate javascript code inside python interpreter. It is used by various web scrapers to parse javascript code on the website. There exists a vulnerability in the implementation of a global variable insi...

credactor

Credactor Find the secret. Fix it. Commit clean. Secret scanners are good at sounding the alarm and not much help putting it out. They hand you a list of leaked credentials and leave the cleanup to you. Credactor closes the loop: it finds a hardcoded secret and rewrites it in place, so a leak goe...