CVE-2021-31166

CVE-2021-31166 Description - POC for CVE-2021-31166: Windows HTTP协议栈远程代码执行漏洞 - create by antx at 2021-09-27. Detail - ./trigger.gifPoc-Gif CVE Severity - attackComplexity: LOW - attackVector: NETWORK - availabilityImpact: HIGH - confidentialityImpact: HIGH - integrityImpact: HIGH -...

CVE-2025-15467

CVE-2025-15467: OpenSSL CMS AuthEnvelopedData Stack Buffer Overflow Overview CVE-2025-15467 is a critical stack buffer overflow vulnerability in OpenSSL's CMS Cryptographic Message Syntax parsing code. The vulnerability exists in the evpciphergetasn1aeadparams function when processing AES-GCM...

OWASP-WSTG-Rag

OWASP WSTG RAG A Retrieval-Augmented Generation RAG system that indexes the OWASP Web Security Testing Guide WSTG into a vector database, providing instant access to security testing methodologies via REST API and MCP Model Context Protocol for Claude Code integration. Features Complete WSTG...

confusable-vision

confusable-vision The world's first font-by-font confusables dataset. Which Unicode characters look like which, measured from the fonts' outlines rather than from pixels. The current release, 2026.09.26, compares every letter and digit that each of 322 fonts draws, at the size and baseline positi...

CVE-2023-23397

CVE-2023-23397 Outlook Privilege Escalation Proof of Concept for CVE-2023-23397 in Python Quick and easy "proof of concept" in Python for the Outlook CVE that affects Microsoft Office/365 products. Usage 1. Install pywin by running pip install pywin32 2. Start a SMB server on the attacker machine...

xtrace-sdk

The encrypted vector database. Your data never leaves your machine in plaintext. Documentation | X | LinkedIn Manage your AI memory → mem.xtrace.ai What is XTrace? Every vector database on the market requires you to hand your data to a third party in plaintext. XTrace doesn't. Your documents and...

sentrysearch

SentrySearch Semantic search over video footage. Type what you're looking for, get a trimmed clip back. !IMPORTANT Official source: github.com/ssrajadh/sentrysearch is the only official home of SentrySearch. Other sites republishing or mirroring this project are not affiliated with or endorsed by...

ADCollector

ADCollector ADCollector is a lightweight tool that enumerates the Active Directory environment to identify possible attack vectors. It will give you a basic understanding of the configuration/deployment of the environment as a starting point. Notes: ADCollector is not an alternative to the powerf...

slater

Slater Current version:v0.25.2 — all releases. In one line: Slater serves graphs that don't fit in memory — hundreds of millions of nodes and billions of edges in low hundreds of MB of RAM — over standard Bolt , so any neo4j driver just works, with disk-native vector search sitting next to the...

BWASP

BWASP The BoB Web Application Security Project BWASP is an open-source, analysis tool to support for Web Vulnerability Manual Analysis hackers. The BWASP tool basically provides predicted information through vulnerability analysis without proceeding with an attack. BWASP supports performing...

ProHunter

📋 Overview This project is a core module of the ProHunter system, primarily designed to perform malicious judgment on threat graphs sampled from the PPG module. The main idea of this methods is that uses inexact graph vector matching to calculate vector similarity between threat graphs and attack...

Log4j-JNDIServer

Log4j-JNDIServer This project will help to test the Log4j CVE-2021-44228/CVE-2021-45046 vulnerabilities. Installation and Building Load the project on Intellij Idea Select JDK in "Projects Settings" CTRL + ALT + SHIFT + S In "Project Settings", create the Artifact - "Artifacts" - "Create JAR from...

CVE-2022-21907

CVE-2022-21907 Description - POC for CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability. - create by antx at 2022-01-17. Detail - HTTP Protocol Stack Remote Code Execution Vulnerability. - Similar to https://github.com/antx-code/CVE-2021-31166CVE-2021-31166. - This problem...

Excalibur

Excalibur will soon be updated to utilize Metasploit over the Bashbunny. Excalibur Excalibur is an Eternalblue exploit based "Powershell" for the Bashbunny project. It's purpose is to reflect on how a "simple" USB drive can execute the 7 cyber kill chain. Excalibur may be used only for...

pysqli

PySQLi - Python SQLインジェクションフレームワーク 1. 概要 PySQLiは、複雑なSQLインジェクションの脆弱性を悪用するために設計されたPythonフレームワークです。 専用の構成要素（ブリック）を提供し、これらを使用して高度なエクスプロイトを構築したり、 状況に応じて簡単に拡張・改良することができます。 2. なぜ別のSQLiフレームワークなのか？ 簡単な答え：SQLインジェクションの脆弱性を悪用する方法はHTTPリクエスト以外にも存在するからです！ ほとんどの既存ツールはHTTP GET/POSTメソッドに依存しており、 他の方法を提供することもあります。...

WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Upload

The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Stored Cross-Site Scripting via arbitrary URL injection in versions up to and including 6.1 and 1.0 respectively. Authenticated users with author-level permissions can inject arbitrary remote URLs for SVG map files. When a user...

WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read

WordPress Responsive Vector Maps 6.4.2 contains an arbitrary file read vulnerability because the plugin does not have proper authorization and validation of the rvmuploadregionsfilepath parameter in the rvmimportregions AJAX action, allowing any authenticated user to read arbitrary files on the w...

rep-openai-artifactory

Forensis Lab — AI Agent 权限提升的取证复现（JFrog Artifactory） 对 "Incidente Cero" （OpenAI，2026 年 5 月）的安全、隔离、取证式复现：一个沙箱化的 AI agent 发现了 JFrog Artifactory 软件包代理，从自身配置中提取凭据，在服务器上临时搭建了一个留言板，并从 读取者 提升为管理员 。 研究目标 ：确定有多少 基线配置 促成了该事件。实验在创建管理员用户（即"flag"）时结束。它不涵盖完整事件。 要求 Docker + Docker Compose （已在 Windows/WSL 和 Linu...

CVE-2026-21962

🔥 CVE-2026-21962 — Oracle HTTP Server 检测工具包 安全、非利用性的检测工具，用于识别受 CVE-2026-21962 影响的 Oracle HTTP Server 和 WebLogic Proxy Plug-in 实例。 🧠 漏洞概述 CVE： CVE-2026-21962 严重性： 严重 攻击向量： 网络 所需认证： 无 该漏洞可能允许远程、未认证的攻击者破坏机密性和完整性， 进而可能导致系统完全被攻陷。 🎯 受影响版本 Oracle HTTP Server 12.2.1.4.0 Oracle WebLogic Proxy Plug-in...

CVE-2026-22812-exploit

CVE-2026-22812 漏洞利用工具 针对 CVE-2026-22812（OpenCode 未认证远程代码执行漏洞）的全功能利用工具包 🎯 概述 CVE-2026-22812 漏洞利用工具是一个针对 OpenCode 未认证远程代码执行漏洞的综合性利用框架。该工具提供多种利用方法，包括交互式 Shell、文件操作和系统信息枚举。 漏洞详情 CVE 编号 ：CVE-2026-22812 受影响版本 ：OpenCode 1.0.216 CVSS 评分 ：8.8（高危） 攻击向量 ：网络 认证要求 ：无需认证 影响范围 ：系统完全沦陷 ✨ 功能特性 🔓 利用能力 ✅ 未认证会话创建 ✅...