CVE-2022-1388

BIG-IP iControl REST vulnerability CVE-2022-1388 PoC This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services PoC You can...

CVE-2022-24112-POC

CVE-2022-24112-POC Apache APISIX 2.12.1 Remote Code Execution by IP restriction bypass and using default admin AIP token Full walkthrough https://kavigihan.medium.com/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff...

CVE-2024-11423

CVE-2024-11423 Ultimate Gift Cards for WooCommerce = 3.0.6 - Missing Authorization to Infinite Money Glitch Description The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and U...

io_uring_LPE-CVE-2023-2598

iouringLPE-CVE-2023-2598 LPE exploit for CVE-2023-2598. My write-up of the vulnerability: Conquering the memory through iouring - Analysis of CVE-2023-2598 You can compile the exploit with gcc exploit.c -luring -o exploit Disclaimer For educational and research purposes only. Use at your own risk...

janusec

Janusec Application Gateway / JANUSEC应用网关 English Readme 提供快速、安全的应用交付 介绍PPT： https://www.janusec.com/download/Janusec-Application-Gateway-CN.pdf 主要功能 JANUSEC应用网关的主要功能有： 向Web应用提供统一的安全接入，包括HTTPS、身份认证、安全防御（WAF/CC）等。如Web应用是通过K8S Pods部署的，该网关也可以作为K8S Ingress Controller使用，向Pods提供跟普通Web应用同样的接入和安全特性。...

CVE-2026-29782-OpenSTAManager-RCE

CVE-2026-29782 — OpenSTAManager auth-SQLi → PHP object injection → RCE PoC for remote code execution inOpenSTAManager ≤ 2.10.1. oauth2.php looks up a zzoauth2 row by the attacker-controlled state GET parameter and calls unserialize on its accesstoken column without anallowedclasses restriction...

CVE-2025-41088

CVE-2025-41088: Stored XSS in Xibo CMS I have discovered a Stored Cross-Site Scripting XSS vulnerability in Xibo CMS v4.1.2. This vulnerability allows an authenticated attacker to inject malicious scripts into the application due to improper validation of user-supplied input. The issue resides in...

kit-policy

kit-policy A flexible, composable authorization framework for Kit, inspired by Ruby's Action Policy. TOC Files File| Description ---|--- .editorconfig| Editor formatting configuration .gitignore| Git ignore rules for build artifacts and dependencies .tool-versions| asdf tool versions Zig, Kit...

WSO2RCE

WSO2RCE The CVE-2022-29464 affects some WSO2 products such as WSO2 API Manager and WSO2 Open Banking , allowing arbitrary file upload and remote code execution. Affected Products: WSO2 API Manager 2.2.0, up to 4.0.0 WSO2 Identity Server 5.2.0, up to 5.11.0 WSO2 Identity Server Analytics 5.4.0,...

CVE-2024-35584

CVE-2024-35584 OpenSIS Authenticated SQL Injection Description There exists a SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php. This finding affects OpenSis Community Edition 9.1 to 8.0 and possibly versions below. Proof of Concept In...

CVE-2020-10238

Made by HK CVE-2020-10238: Incorrect Access Control in comtemplates- RCE CVE-2020-10239: Incorrect Access Control in comfields SQL field- RCE Link https://developer.joomla.org/security-centre/804-20200303-core-incorrect-access-control-in-com-templates.html...

hashcrack

hashcrack unpacks some hash types, picks sensible options and invokes hashcat NVIDIA drivers here: http://www.nvidia.co.uk/Download/index.aspx?lang=en-uk alt email: [email protected] if you need support I'm not sure if anyone at NCC will be looking after this, but I'll be doing active dev in...

quokka

Quokka image generated by DALL-E Table of Contents Introduction Installation Usage Building Documentation FAQ Introduction Quokka is a binary exporter: from the disassembly of a program, it generates an export file that can be used without the disassembler. It currently supports IDA Pro , Ghidra...

FruityWifi

FruityWiFi Wireless network auditing tool http://www.fruitywifi.com/ Important Note Debian 11 Bullseye: Please use Use Debian 11 Bullseye based systems. The Installer has been updated for resolving issues with old version. Note : Some modules will not work until they are upgraded to Python3...

CVE-2026-66752-HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-

Security Advisory: HTTP Request Smuggling via Unparsed Transfer-Encoding Values tinyhttp Assigned CVE ID: CVE-2026-66752 Summary tinyhttp checks only whether a Transfer-Encoding header is present. It never looks at the value. Any value, including codings that are not chunked and coding lists whos...

CVE-2026-32202

Zero-click forced authentication: viewing a folder with the crafted .lnk triggers UNC resolution during icon render, coercing the victim into an attacker-directed outbound connection that leaks and enables relay of their Net-NTLMv2 credentials. Emerged due to an incomplete patch of CVE-2026-21510...

s3-bucket-take-0v3r

s3-bucket-take-0v3r S3 Bucket Takeover Scanner & Claim Tool 📌 Description S3 Bucket Takeover Scanner & Claim Tool is a Python 2.7-based utility that: 1. Scans domain names to identify potential Amazon S3 bucket takeover vulnerabilities. 2. Automatically claims unregistered S3 buckets and uploads ...

CVE-2017-7651

Info This repository is used to display the C++ code used by Felipe Balabanian on his discovery https://bugs.eclipse.org/bugs/showbug.cgi?id=529754. You can find the compiled binary in the release section. Disclaimer This is not my code and I do not take credit for any work...

CVE-2021-34470scanner

CVE-2021-34470scanner A Powrshell script to scan for CVE-2021-34470...

CVE-2020-14179

CVE-2020-14179 Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint Priority: High Affects Version/s: 8.6.0 | 8.8.0 | 8.5.5 | 8.9.0 | 8.10.0 | 8.11.0 Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names a...

security-study-plan

A Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps, and so on with free/paid resources, tools, and concepts to excel. It will cover but not limited to: Done 1. Common Skills for Security Study Plan 2. AWS Security...

vendor-android-cves

vendor-android-cves Collections of our POCs/fuzzing scripts/harness for vendor android CVEs, including those on BlackHat ASIA 2022: https://www.blackhat.com/asia-22/briefings/schedule/the-hidden-rce-surfaces-that-control-the-droids-26083 Update: I've received news about the SMT exploit in this...

Sitadel

Sitadel - Web Application Security Scanner | || || | / | | | | | | | | | | || | | | \ | | |/ | | | | || | | | |/ | | | | | | /|| ||\ Sitadel is basically an update for WAScan making it compatible for python = 3.11 It allows more flexibility for you to write new modules and implement new features...

CVE-2019-11043-Vulnerability

Collaberators: Olaf Madejski, Andrew Masone, Nate Desany PHP-FPM Reverse Tunnel Exploitation & Persistence Demonstration CVE-2019-11043 — Debian PHP-FPM Path Handling Vulnerability Project Overview In October 2019, Debian Security Advisory researchers Emil Lerner and Andrew Danau published a noti...

cve-2017-1182-TN

cve-2017-1182-TN Malware Analysis Testing...

CVE-2022-0847

CVE-2022-0847 - Dirty Pipe Exploit A proof-of-concept exploit for CVE-2022-0847 Dirty Pipe, a Linux kernel vulnerability that allows unprivileged users to write to read-only files. Vulnerability Details CVE-2022-0847 affects Linux kernels 5.8 through 5.16. It exploits a race condition in the Linu...

CVE-2020-8958

CVE-2020-8958 CVE-2020-8958 : Authenticated Remote Code Execution Exploit for NetLink Routers using boa server. CVSS Score: 7.2 Vulnerability Types: OS Command Injection Authentication: Required Affected Models: HG323 Description The /boaform/admin/formPing resource in Netlink routers allows remo...

IngressNightmare-PoC

This repository does not have a README...

AndroidDriveSignity

AndroidDriveSignity AndroidDriveSignity is a Python script designed for patching Android kernelARMv8.3 files, enabling the loading of drivers without being subject to various verification checks, specifically signature verifications. This tool aims to facilitate the development and testing proces...

Endurance-Wiper

Endurance-Wiper Beta - Open Source A small wiper malware written in C using the .NET framework. If you are from Twitter or any other source, you can clearly tell this is in active development. You are free to check the updates here...

liffy

Advanced LFI Exploitation Tool A powerful Python tool for Local File Inclusion LFI exploitation with advanced features including WAF bypass, encoding techniques, and comprehensive vulnerability detection. Liffy v2.0 is the significantly enhanced version of liffy which was originally created by...

gitleaks

Gitleaks ┌─○───┐ │ │╲ │ │ │ ○ │ │ ○ ░ │ └─░───┘ !WARNING Gitleaks is feature complete. I'm not merging new features into Gitleaks. Future releases will be security patches only. I'm shifting my focus to Betterleaks Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in g...

CVE-2023-21554-PoC

CVE-2023-21554 — QueueJumper PoC Proof of concept for CVE-2023-21554 , also known as QueueJumper , affecting Microsoft Message Queuing MSMQ. The PoC implements the MSMQ/SRMP protocol interaction associated with the vulnerability and can be used to investigate the behavior of an MSMQ service over...

CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Flow Bypass Lab Overview Lab simulating vulnerability CVE-2026-18963 CVSS 9.1 in Keycloak, allowing an attacker to take over any account through bypassing email verification in the password reset flow. For security research and educational purposes only...

shellshock-victim-host

shellshock-victim-host A docker container vulnerable to Shellshock - CVE-2014-6271 Run podman build -t shellshock-victim . podman run -it -p 80:8080 shellshock-victim Note: Builds with docker as well. The vulnerable app will be deployed on : http://localhost:8080/victim.cgi - Vulnerable endpoint...

CVE-2020-9047

Usage/Help Menu usage: CVE-2020-9047.py -h -p RPORT -s LPORT --command -d WEBDIR -U USERNAME -P PASSWORD WINDOWS,LINUX,CHECK RHOST LHOST PAYLOAD Exploit for exacqVision Web Service as outlined in CVE-2020-9047. This program targets Windows and Linux x86 installations of exacqVision Web Service...

truffleproc

truffleproc — hunt secrets in process memory Usage Run truffleproc.sh against your current Bash shell e.g. $$: $ ./truffleproc.sh $$ coredumping pid 6174 Reading symbols from od... Reading symbols from /usr/lib/systemd/systemd... Reading symbols from /lib/systemd/libsystemd-shared-247.so... Readi...

webkit-vulnerability

webkit-vulnerability CVE-2016-4657 web-kit vulnerability for ios 9.3, nintendo switch browser vulnerability iknow whats running in your mind nintendo switch has no no browser, but when you neetd to use a wifi which needs to be conformed by logging in to the browser CVE-2016-45657 webkit in safari...

unhook-bof

This is a Beacon Object File to refresh DLLs and remove their hooks. The code is from Cylance's Universal Unhooking research: https://blogs.blackberry.com/en/2017/02/universal-unhooking-blinding-security-software To use: Load unhook.cna into Cobalt Strike via Cobalt Strike - Script Manager Run...

halo-record

halo-record Tamper-evident audit trails for AI agents — hash-chained Runtime Records, rendered as a Runtime Report your customers can check themselves. Every action your instrumentation captures tool calls, model calls, data access, approvals becomes one Runtime Record in an append-only,...

Meta_SecAlign

Meta SecAlign: A Secure Foundation LLM Against Prompt Injection Attacks Sizhe Chen, Arman Zharmagambetov, David Wagner, Chuan Guo for equal technical contributions 🔥 Meta-SecAlign models are now licensed for commercial use under the Llama community licenses, despite this codebase being licensed f...

sast-scan-action

Offensive360 SAST Scan — GitHub Action Run a full Offensive360 static application security scan SAST on every push or pull request. Deep taint and data-flow analysis across 60+ languages, results as SARIF for the GitHub code scanning tab, and a severity gate for your pipeline. Free for open sourc...

CVE-2026-12944

CVE-2026-12944: Langflow 1.10.0 — urllib SSRF Langflow OSS ≤ 1.10.0 — vulnerability allowing arbitrary code execution via urllib.request / socket in custom components. The component scanner’s denylist missed these standard library modules. Fixed in 1.10.1 IBM. Severity : PR:L Publicly Reproducibl...

perwendel__spark_CVE-2018-9159_2_7_2_fixed

Spark - a tiny web framework for Java 8 NEWS : Spark 2.7.1 is out. Please try it out and report any bugs. com.sparkjava spark-core 2.7.1 Important - There is a vulnerability in older versions of Spark versions lower than 2.5.2. Please upgrade to the latest version. For documentation please go to:...

CVE-2022-0847

CVE-2022-0847 my personal poc and exploit of CVE-2022-0847dirty pipe Usage POC: write files arbitrarily Just a simply POC of this CVE, compile the file poc.c as follow: $ gcc poc.c -o poc -static You shall run it as follow: ./poc targetfile offsetinfile data You shall make sure the destination fi...

APT-GUID

Project Introduction Organizing materials in the APT field, covering but not limited to the following aspects APT attack tools APT analysis reports APT attack techniques Tool Collection Information Gathering Active Intelligence Gathering EyeWitness can take screenshots of websites, provide some...

jdam

jdam - Structure-aware JSON fuzzing jdam is a Radamsa inspired tool for fuzzing arbitrary JSON objects in a structure-aware fashion, which ensures that fuzzing results will always be valid JSON. Many existing fuzzing tools will blindly alter the input and will often cause the result to be invalid...

Log4jCenter

Log4jCenter Exploiting CVE-2021-44228 in vCenter for remote code execution and more. Blog post detailing exploitation linked below: How to exploit Log4j vulnerabilities in VMWare vCenter Why? Proof of concepts for this vulnerability are scattered and have to be performed manually. This repository...

Netryx-OpenSource-Next-Gen-Street-Level-Geolocation

NETRYX Open-Source Street-Level Geolocation Engine Upload any street photo. Get precise GPS coordinates. Sub-50m accuracy. No landmarks needed. Runs entirely on your hardware. Demos · How It Works · Getting Started · Usage · FAQ THIS VERSION IS OLD, USE THIS INSTEAD NEW REPO What is Netryx? Netry...

studio

ShipSec Studio Open-Source Security Workflow Orchestration Platform. ShipSec is currently in active development. We are optimizing the platform for stable production use and high-performance security operations. ShipSec Studio provides a visual DSL and runtime for building, executing, and...