pandorafms_7.44

Pandora FMS 7.44 CVE-2020-13851 Pandora FMS 7.44 CVE-2020-13851 RCE allows an authenticated user to achieve remote command execution via the events feature. Can be done with credentials or a PHP session cookie. Getting Started Executing program Using credentials python3 pandorafms7.44.py -t...

CVE-2023-25261

This repository does not have a README...

CVE-2026-9806

CVE-2026-9806 CVE-2026-9806 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting CTI Transmute versions prior to the patched release.The flaw exists in the notification panel, where notification messages containing user-controlled convert names are rendered in the notification bell...

Swego

Swego Swiss army knife Webserver in Golang. Keep simple like the python SimpleHTTPServer but with many features Usage Run the binary If you don't want to build it, binaries are availables on https://github.com/nodauf/Swego/releases Otherwise, build-essential should be installed and GOPATH...

CVE-2022-26134

CVE-2022-26134 Atlassian Confluence Remote Code Execution Vulnerability CVE-2022-26134 Usage: python CVE-2022-26134.py -u http://127.0.0.1 Batch verification: python CVE-2022-26134.py -f xxx.txt copy URL to txt...

struts2_cve-2017-5638

struts2cve-2017-5638 This is a sort of Java porting of the Python exploit at: https://www.exploit-db.com/exploits/41570/. This software is written to have no external dependencies. DISCLAIMER This tool is intended for security engineers and appsec guys for security assessments. Please use this to...

credcheck

Features Check credentils of given target. Check credentials passivlyusing regex. CMD-line script. Use as library Todos Publish on pypi Inclusion of api docs Pin-pointed regexes for Creds Test cases Multiple subparsers Complete regex Uses pre-requisite 3.6+ Command line usage python main.py...

Koh

Koh Koh is a C and Beacon Object File BOF toolset that allows for the capture of user credential material via purposeful token/logon session leakage. Some code was inspired by Elad Shamir's Internal-Monologue project no license, as well as KB180548. For why this is possible and Koh's approeach, s...

Magisk

This is not an officially supported Google product Introduction Magisk is a suite of open source software for customizing Android, supporting devices higher than Android 7.0. Some highlight features: MagiskSU : Provide root access for applications Magisk Modules : Modify read-only partitions by...

CVE-2025-55182

🔔 ⚠️ Unauthorized penetration testing is prohibited Build Steps go get fyne.io/fyne/v2@latest go build -ldflags="-s -w" . Screenshots...

CVE-2026-56876-POC

This is the orignal PoC for this CVE...

Firmware-CVE-2025-7545

Preparing to download the repository 1. Update packages: sudo apt-get update 2. If necessary, install git: sudo apt install -y git Downloading the repository, installing the vulnerable Binutils, and setting up the environment 1. Download the repository: git clone...

hmac-bcrypt

hmac-bcrypt This repository contains reference implementations of the hmac-bcrypt password hashing function in several languages. Each reference implementation attempts to be a 1:1 port of the original C and Perl implementations created by @epixoip where possible, and are fully compatible with ea...

CVE-1999-1053-PoC

CVE-1999-1053 Proof-of-Concept Exploit Background This Proof-of-ConceptPoC exploit is inspired from a CTF web challenge called CVE 1999 in HKCERT CTF 2022. Writeup link Information Description: In Matt Wright Guestbook The Matt Wright guestbook.pl = v2.3.1 CGI script contains a flaw that may allo...

cve-2024-10914

POC - CVE-2024–10914- Command Injection Vulnerability in name parameter for D-Link NAS Overview A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgiuseradd of the file...

CVE-2021-40374

CVE-2021-40374 - Stored Cross-site Scripting in OpenEyes 3.5.1 Description A stored cross-site scripting XSS vulnerability was identified in OpenEyes 3.5.1, developed by the Apperta Foundation. Improper input handling in the 'Address1' parameter allowed for JavaScript to be injected into a patien...

CVE-2024-12209

CVE-2024-12209 Unauthenticated Local File Inclusion...

darts

Time Series Made Easy in Python Darts is a Python library for user-friendly forecasting and anomaly detection on time series. It contains a variety of models, from classics such as ARIMA to deep neural networks. The forecasting models can all be used in the same way, using fit and predict...

CVE-2025-40629

This repository does not have a README...

CVE-2026-32662

CVE-2026-32662: Active Debug Code in Production Advisory Field| Value ---|--- CVE| CVE-2026-32662 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 5.3 Medium Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE| CWE-489 Active Debug Code Researcher| Michael Groberman — Gr0m Published| 2026-04-02 Updat...

CVE-2021-44228-VULN-APP

CVE-2021-44228-VULN-APP NOTE: This is a vulnerable virtual machine for showing what actually is this vulnerability log4j, and so on! Installation: cd CVE-2021-44228-VULN-APP/ docker build -t log4j-shell-poc . docker run --network host log4j-shell-poc Listening on port 8080...

cve-2020-0688-webshell-upload-technique

Exchange Remote Code Execution cve-2020-0688 - RED TEAM MODE ON require: python3+ UNIVERSAL Python implementation for cve-2020-0688, utilizing ASPX webshell for custom command output This just a POC to facilitate vulnerability demostrations for security reasons. I disapprove every illegal actions...

CVE-2024-0204

CVE-2024-0204: Authentication Bypass in GoAnywhere MFT Script to create a new admin user in GoAnywhere MFT. Blog Post More details here: https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive Usage Password must be at least 8 characters long to meet GoAnywhere...

CVE-2021-35587

CVE-2021-35587 Description - POC for CVE-2021-35587: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. - create by antx at 2022-03-14. Detail - Vulnerability in the Oracle Access Manager product of Oracle Fusion...

Watcher

AI-Powered Automated Cybersecurity Threat Detection Platform Watcher is a Django & React JS platform designed to discover and monitor emerging cybersecurity threats with AI-powered threat intelligence analysis. It can be deployed on webservers or quickly run via Docker. Watcher Capabilities Watch...

ChameleonUltra

ChameleonUltra Authorized Distributors Lyon, France: Lab401 Santa Ana, United States: Hackerwarehouse Hastings, UK: KSEC Montreal, Canada: TechSecurityTools Shenzhen, China: Sneaktechnology Guangdong, China: MTools Tec Lazada One, Singapore: Aliexpress by RRG What is it and how to use ? Read the...

CVE-2021-32161

..| XSStoCommandInjection2 |.. Description : Exploiting a Reflected Cross-Site Scripting XSS attack to get a Command Injection through the Webmin's File Manager feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Command Execution eXploit's C0de P...

CVE-2026-4567-Post-Quantum-KEM-Timing-Side-Channel-Kyber-Decapsulation-

2. CVE-2026-4567 – Post-Quantum KEM Timing Side-Channel Kyber Decapsulation Overview A vulnerable implementation of the Kyber KEM decapsulation leaks secret key bits through timing differences in the ciphertext rejection step, enabling full key recovery. Severity: Critical Private Key Compromise...

Multi-Stage-Exploitation-and-Detection-Engineering-Analysis-of-CVE-2023-34362-in-MOVEit-Transfer

CVE-2023-34362 MOVEit Transfer Vulnerability Analysis Project Overview This repository contains an academic technical analysis of CVE-2023-34362, a critical SQL injection vulnerability affecting MOVEit Transfer. The project was prepared for CYB625 – Ethical Hacking & Penetration Testing. Importan...

LoggerPlusPlus

Logger++ Advanced Logging for Burp Suite Developed by Corey Arthur Originally by Soroush Dalili Released as open source by NCC Group Plc - https://www.nccgroup.com/ Released under AGPL-3.0 see LICENSE for more information Description Logger++ is a multithreaded logging extension for Burp Suite. I...

cve-2022-23131

cve-2022-23131 cve-2022-23131 zabbix-saml-bypass-exp 1. replace zbxsignedsession to cookie 2. sign in with Single Sign-On SAML author: @random-robbie、@jweny and @Mr-xn link: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage...

MobileApp-Pentest-Cheatsheet

Mobile Application Penetration Testing Cheat Sheet The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics and checklist, which is mapped OWASP Mobile Risk Top 10 for conducting pentest. Mobil...

DbDat

DbDat Db Database Assessment Tool DbDat performs numerous checks on a database to evaluate security. The categories of checks performed are configuration, privileges, users, and information. Checks are performed by running queries or reading database configuration files. The goal of this tool is ...

changedetection.io

Detect Website Changes Automatically — Monitor Web Page Changes in Real Time Monitor websites for updates — get notified via Discord, Email, Slack, Telegram, Webhook and many more. Detect web page content changes and get instant alerts. Ideal for monitoring price changes, content edits, condition...

CVE-2026-53075poc

CVE-2026-53075poc POC of CVE-2026-53075...

CVE-2026-9082

CVE-2026-9082 Unauthenticated SQL injection in Drupal Core on PostgreSQL via POST /user/login, escalated to remote code execution through PostgreSQL sessionpreloadlibraries. Unlike existing public exploits that target JSON:API, this uses the login endpoint — always available, no modules or...

CVE-2025-39401

This repository does not have a README...

CVE-2022-24816

Usage of CVE-2022-24816 script Prerequisites 1. Clone the repository : git clone https://github.com/c1ph3rbyt3/CVE-2022-24816.git cd CVE-2022-24816 2. Install dependencies : Ensure you have Python 3 installed. Then, install the required dependencies by running: pip install -r requirements.txt The...

CVE-2019-15107

CVE-2019-15107 Webmin Exploit CVE-2019-15107 An issue was discovered in Webmin =1.920. The parameter old in passwordchange.cgi contains a command injection vulnerability. NVD Compiling $ git clone https://github.com/whokilleddb/CVE-2019-15107 $ cd CVE-2019-15107 $ make Example Usage $ ./exploit...

CVE-2023-38545

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ This script is...

MAAD-AF

MAAD Attack Framework MAAD-AF is an open-source cloud attack tool for Microsoft 365 & Entra IDAzure AD environments. MAAD-AF offers simple, fast and effective security testing. Validate Microsoft cloud controls and test detection & response capabilities with a virutally zero-setup process, comple...

nano-analyzer

Nano-analyzer A minimal LLM-powered zero-day vulnerability scanner byAISLE. Research prototype for demonstration purposes. This is a simple, single-file harness that is able to detect real zero-day vulnerabilities. Note that it is a prototype, biased towards C/C++ memory safety bugs, and will...

thm-cybersec-portfolio

TryHackMe Notes — Cybersecurity Portfolio Personal notes and summaries of completed TryHackMe rooms. Built as a study reference and portfolio for IT security roles. Completed Rooms | Room| Topic ---|---|--- 01| Linux Privilege Escalation| Linux privesc techniques 02| Sudo Buffer Overflow|...

CVE-2025-64459

CTF Challenge: Django ORM Injection CVE-2025-64459 Category: Web Security Difficulty: Medium Vulnerability: CVE-2025-64459 - Django ORM Filter Injection 📝 Description We built a secure merch shop with admin panel. Can you bypass the authentication and find the private admin note URL:...

CVE-2024-1301---Badgermeter-moni-tool-SQL-Injection

CVE-2024-1301 --- Badgermeter moni tool - SQL Injection https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool CVE-2024-1301: 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-89. Software link : https://www.s-can.at/en/product/monitool/...

CVE-2024-20674

CVE-2024-20674 This is my take at an exploit of the public CVE CVE-2024-20674 to achieve Kerberos mutual authentication bypass using a logic bug in the client-side handling of Kerberos U2U TGT-REP. This can be used for instance to serve arbitrary GPOs when spoofing the DC to a client, and take...

cve-2019-9193

CVE-2019-9193 • CVE-2019-9193 Vulnerability PostgreSQL has a vulnerability that allows arbitrary code execution within the DB's operating system via the “COPY TO / FROM PROGRAM” feature. The attack vector involves users who are “SuperUser” or belong to the “pgexecuteserverprogram” group...

s3-account-search

S3 Account Search This tool lets you find the account id an S3 bucket belongs too. For this to work you need to have at least one of these permissions: Permission to download a known file from the bucket s3:getObject. Permission to list the contents of the bucket s3:ListBucket. Additionally, you...

Twitter-Info

Twitter Info A simple python script to grab Twitter account info like: Name Following Followers Likes Account date Profile picture just by username or profile link. Usage python3 twitterinfo.py or Example Input python twitterinfo.py ngll Output Name: Nigella Tweets: 30 Following: 8 Followers: 4...

RSPET

RSPET RSPET Reverse Shell and Post Exploitation Tool is a Python based reverse shell equipped with functionalities that assist in a post exploitation scenario. DISCLAIMER: This software is provided for educational and PenTesting purposes and as a proof of concept. The developers do not endorse,...