CVE-2026-107567

Progressive Robot hMailServer versions 6.0.0 through 6.3.6 are vulnerable to a Use of Less Trusted Source (CWE-348) issue in the DKIM signing process. A remote unauthenticated attacker can send inbound mail with a forged From header belonging to a hosted domain. If DKIM signing is enabled, the se...

CVE-2026-112305

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305 Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305 Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305 Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

EUVD-2026-104397

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305

Semaphore UI versions through 2.19.16 are vulnerable to remote code execution (RCE) due to an improperly controlled modification of dynamically-determined object attributes (CWE-915). Users with the task_runner role can override protected Ansible variables by injecting arbitrary keys into the tas...

CVE-2019-9053

CVE-2019-9053 Improved code of Daniele Scanu SQL Injection exploit Following changes applied: Added time control variable -t or --time that enables user to extend the timing of SQL injection useful if a network connection in between hosts is subject of delays with packet transmission Network...

CVE-2025-57833

Django FilteredRelation Alias SQL Injection Vulnerability CVE-2025-57833 A SQL injection vulnerability in Django that emerged after about a year, at first glance it appears to be caused by an alias since aliases cannot be precompiled. This vulnerability affects the FilteredRelation feature in the...

phantomrecon

PhantomRecon PhantomRecon is a CLI-based, modular, agent-driven red team automation tool designed to demonstrate autonomous offensive security workflows powered by AI Google's Gemini via Agent Development Kit - ADK. Quick Start CLI Run interactive console metasploit-style: python -m phantomrecon...

Dop2Mop

Dop2Mop A proof-of-concept OpenGraph collector for BloodHound that maps attack paths from DevOps to MLOps infrastructure. Based on Pipelines of Privilege: Attack Paths from DevOps to MLOps Infrastructure by Brett Hawkins @h4wkst3r. Table of Contents Acknowledgments Overview Supported Platforms...

PowerShellArmoury

!IMPORTANT This repository is now archived. Though it was a fun journey, I think PSArmoury has outlived its usefulness. PowerShellArmoury The PowerShell Armoury is meant for pentesters, "insert-color-here"-teamers and everyone else who uses a variety of PowerShell tools during their engagements. ...

Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments. The intrusion achieved root code executio...

hdwebmobile-booking-appointments

HDWebmobile Booking & Appointments Sell bookable services and appointments through WooCommerce, with a per-slot capacity that can never be oversold. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ Requires: WordPress 6.9+, WooCommerce, PHP 7.4+ License: GPLv2 or lat...

CVE-2021-38297-Go-wasm-Replication

🚨 Exploiting CVE-2021-38297: A Journey into GO Wasm Buffer Overflow 🚨 🌐 Overview of the Vulnerability 🌐 WebAssembly WASM 🌍, a cutting-edge binary instruction format, enables the seamless execution of high-level languages like C, C++, Rust, and GO in modern web browsers. However, the discovery of...

pyjadx

pyjadx Python bindings for JADX via JPype. Decompile Android APK and DEX files to Java source from Python. from pyjadx import Jadx with Jadx"app.apk" as jadx: for cls in jadx.classes: printcls.fullname printcls.code Why pyjadx? JADX is the leading open-source Android decompiler — it produces clea...

CVE-2023-4911-PoC

GNU C Library's Dynamic Loader Vulnerability CVE-2023-4911 Overview The GNU C Library glibc serves as the C library in the GNU system and is integral to Linux-based systems. At its core, glibc defines essential functionalities for programs, including system calls and common functions like open,...

recipe-blog-encoding

recipe-blog-encoding !WARNING This project is entirely vibe-coded likely partially plagiarized from this repository and the author is a dumb-dumb who just thought the idea was funny Use SEO-gaming recipe preambles as a vehicle for encoding secret messages the prompt can really be anything though,...

envocabulary

envocabulary For every variable in your current shell, find the file and line that set it, or which subsystem direnv, launchd, terminal, SSH, system injected it. Plus a few static-file commands for the moment your shell config has sprawled across N files and backups and you've lost the plot. I...

CVE-2022-22706-poc

CVE-2022-22706 - Page-Cache Write The Arm Mali GPU driver hands userspace a CPU-writable mapping of pages it pinned read-only, so an unprivileged process gets a writable alias of the page cache backing a file it can only open ORDONLY. exploit.c blanks root's password field in the /etc/passwd page...