CVE-2026-29000---pac4j-jwt-Authentication-Bypass-PoC

CVE-2026-29000 - pac4j-jwt Authentication Bypass PoC Note: This is not my original work. I am keeping this here for a reference. Working methodology: python3 exploit.py http://IP:PORT Fetching JWKS... + Got RSA public key kid: enc-key-1 Crafted PlainJWT with sub=admin, role=ROLEADMIN + Forged JWE...

marshalsec-jar

marshalsec-jar Needed the file for a test...

Door404

Door404 Door404 is Open Source Project Developed ByM4DM0E & Rizer This Project Developed For 2 Reasons First " Help Beginners to learn coding . " Second " Help Newbie Servers Managers To Learn New Protection Tricks " Requirements PHP PHP CUrl OS Linux Screen Shots Video : License DWTFPL DO WHAT T...

KittyStager

KittyStager KittyStager is a stage 0 C2 comprising an API, client, and malware. The API is responsible for delivering basic tasks and shellcode to be injected into memory by the malware. The client also connects to the API and allows for interaction with the malware by creating tasks. The goal of...

linux-kernel-exploits

linux-kernel-exploits Introduction linux-kernel-exploits Vulnerability List CVE Description Kernels CVE–2018–18955 mapwrite in kernel/usernamespace.c allows privilege escalation Linux kernel 4.15.x through 4.19.x before 4.19.2 CVE–2018–1000001 glibc glibc 2.6.22 released in 2007 CVE-2016-2384 a...

trunk-recorder

Sponsors Do you find Trunk Recorder and OpenMHz useful? Become a Sponsor to help support continued development and operation! Thank you to everyone who has contributed! 🎉 V5.2 is now... Our Best Release Yet!! Thanks to everyone who contributed, tested and helped collect core dumps! Overview Need...

polaris

Polaris is an open source policy engine for Kubernetes Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the...

challenges

Hex Advent CTF WELCOME TO HEX ADVENT 2025, ‘tis the season to Unwrap Your Potential! 🎁 HEX ADVENT 2025 is a Christmas-themed CTF Advent Calendar, designed for women, by women. 12 Days, 12 Challenges: A structured schedule to build mastery across different CTF categories. Focus Areas - Pwn Binary...

CVE-2026-41089-LongLogon

LongLogon · CVE-2026-41089 LongLogon is an unauthenticated, non-destructive precondition checker for CVE-2026-41089 , a pre-auth stack buffer overflow in the Windows Netlogon service. With no credentials, and without sending the overflow, it reports whether a domain controller's DNS domain name i...

nextcloud_android

Nextcloud Android app Codacy Badge The Android client forNextcloud. Easily work with your data on your Nextcloud. How to contribute If you want to contribute to Nextcloud, you are very welcome: on our IRC channels and on freenode our forum at https://help.nextcloud.com for translations of the app...

CVE-2020-15999

CVE-2020-15999 Here you will all the resources in order to execute the PoC for the CVE-2020-15999 in Google Chrome and Ftview Ubuntu. There are two folders in this repository, one for each program. Google Chrome In order to reproduce the exploit you will have to install a Google Chrome version...

cve-2023-42115

CVE-2023-42115: Exploit and Payload Generator Scripts This repository contains two Python scripts: 1. exploit.py : A script for exploiting CVE-2023-42115. 2. generatepayload.py : A script for generating reverse shell payloads. Prerequisites Before running the scripts, ensure you have Python 3...

slippy-book-exploit

Slippy-book: EPUB File Parsing Directory Traversal Remote Code Execution CVE-2023-44451 Xreader, CVE-2023-52076AtrilReserved: RCE Vulnerability affected popular Linux Distros including Mint, Kali, Parrot, Manjaro etc. EPUB File Parsing Directory Traversal Remote Code Execution A Critical Path...

file-unpumper

file-unpumper file-unpumper is a powerful command-line utility designed to clean and analyze Portable Executable PE files. It provides a range of features to help developers and security professionals work with PE files more effectively. Features PE Header Fixing : file-unpumper can fix and align...

dnspooq

dnspooq DNSpooq PoC - dnsmasq cache poisoning CVE-2020-25686, CVE-2020-25684, CVE-2020-25685 For educational purposes only Requirements Docker compose Docker Exploit Launch containers $ docker-compose up -d Run exploit.py $ docker-compose exec attacker bash bash-5.0 python exploit.py Querying...

mtr

WHAT IS MTR? mtr combines the functionality of the 'traceroute' and 'ping' programs in a single network diagnostic tool. As mtr starts, it investigates the network connection between the host mtr runs on and a user-specified destination host. It sends probes to the destination with successively...

CVE-2026-41303

🔐 CVE-2026-41303: Authorization Bypass in OpenClaw Discord Bot -red?style=flat&logo=owasp Complete technical documentation on the authorization bypass vulnerability in OpenClaw 📋 Table of Contents General Description Technical Details Security Impact Proof of Concept Exploitation Methodology...

CVE-2026-25731

Server-Side Template Injection SSTI in Templite Engine Severity: High CVSS 7.8 Affected Software: calibre Patched In: 9.2.0 Advisory: GHSA-xrh9-w7qx-3gcc Summary A Server-Side Template Injection SSTI vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user...

CVE-2026-26717

CVE-2026-26717: HMAC Timing Attack in OpenFUN Richie LMS Author: Elvin Latifli CVE ID: CVE-2026-26717 Severity: Medium CVSS 3.1: 4.8 — AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Product: OpenFUN Richie all versions prior to commit a1b5bbd Affected Component: src/richie/apps/courses/api.py —...

Iot_Hacking_Camera_0day

IotHackingCamera0day Iot Camera 0day AHD DVR ADN-448 is prone to unauth buffer overflow over the http interface. Simple browse to web server inferface and enter a stupid ammount of data to username and password , and see how the camera reboots. Please see the video for confirmation : Happy IoT-...

7-Zip.chm-Mitigation

7-Zip.chm-mitigiation 7-Zip Mtigation CVE-2022-29072 Explaination : https://user-images.githubusercontent.com/33525376/163654035-d40ca72a-7dbc-425f-ade2-3820cfababb2.mp4 Author CVE Founder : https://github.com/kagancapar/CVE-2022-29072 A vulnerability has been discovered in 7-zip, the popular...

BlobRunner

BlobRunner BlobRunner is a simple tool to quickly debug shellcode extracted during malware analysis. BlobRunner allocates memory for the target file and jumps to the base or offset of the allocated memory. This allows an analyst to quickly debug into extracted artifacts with minimal overhead and...

CVE-2025-34077

CVE-2025-34077 Unauthenticated Admin Session Hijack - Pie Register Plugin ≤ 3.7.1.4 📌 Description This exploit targets a vulnerability in the Pie Register WordPress plugin versions ≤ 3.7.1.4, allowing unauthenticated session hijacking of admin accounts. 🛡️ This tool is for authorized testing and...

SwaggerUI-CVE-2018-25031

Exploit Swagger UI - CVE-2018-25031 Exploit Swagger UI - User Interface UI Misrepresentation of Critical Information CVE-2018-25031. This exploit checks whether the Swagger UI used is susceptible to exploitation of the User Interface UI Misrepresentation of Critical Information vulnerability...

osiris

⬡ OSIRIS Open Source Intelligence & Reconnaissance Integrated System A real-time global intelligence dashboard that aggregates live flight tracking, CCTV networks, earthquake monitoring, conflict zone mapping, and 24/7 news feeds into a single GPU-accelerated interface. Live Demo · Report Bug ·...

appinfo-standalone

Ported UACME method 59 into standalone .C Youtube video demonstration: https://www.youtube.com/watch?v=UZdfh5RtR0&lc=UgxWnzgQ0x2KZBZIq6V4AaABAg...

CVE-2026-20841

CVE-2026-20841 PoC PoC of the "Windows Notepad RCE" vulnerability. Disclaimers 1. I am NOT the one who discovered this vulnerability. Props to the original authors listed on the official disclosure page. I just recreated the PoC according to the description. 2. I personally don't think this...

FuzzingBrain-Bench

FuzzingBrain Bench A benchmark for LLM-driven vulnerability reproduction on 77 real zero-day bugs across 43 open-source projects C / C++ / Java. Each challenge gives the agent only the fuzz harness the target and the project source at the vulnerable revision — no patch, no fix commit, no target...

AlertResponder

AlertResponder NOTE: This repository is obsoleted. New repository is here: https://github.com/m-mizutani/deepalert AlertResponder is a serverless framework for automatic response of security alert. Overview AlertResponder receives an alert that is event of interest from security view point and...

BluetoothDucky

BluetoothDucky CVE-2023-45866 - BluetoothDucky implementation Using DuckyScript Unauthenticated bluetooth remote code execution. In short, run keyboard commands without pairing with their device This is an implementation of the CVE discovered by marcnewlin...

nosqlpot

NoSQL-Honeypot-Framework NoPo NoSQL-Honeypot-Framework NoPo is an open source honeypot for nosql databases that automates the process of detecting attackers,logging attack incidents. The simulation engines are deployed using the twisted framework.Currently the framework holds support for redis. N...

domain_generation_algorithms

Domain Generation Algorithms Domain Generation Algorithms DGAs of Malware reimplemented in Python. Overview banjori aka MultiBanker 2, BankPatcher Links http://johannesbader.ch/2015/02/the-dga-of-banjori/ Example Domains earnestnessbiophysicalohax.com kwtoestnessbiophysicalohax.com...

DFIRArtifactMuseum

DFIR Artifact Museum Description The DFIR Artifact Museum is a community-driven archive of DFIR-related artifacts. It was created to provide a centralized location for examples of artifacts from various operating systems. Purpose To increase accessibility to sample artifacts without individual...

Stevos-AI-Blocklist

Stevo's AI Blocklist A filter list for uBlock Origin and AdGuard that hides specific website features which use Generative AI and content labeled as AI-generated. Available for PC/Linux Firefox, Chrome, Edge, Brave, macOS Firefox, Chrome, Edge, Safari, Android Firefox, and iOS/iPadOS Safari, Brav...

ImHex

A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM. /ˈɪmhɛks/ Supporting If you like my work, please consider supporting me on GitHub Sponsors, Ko-Fi or PayPal. Thanks a lot! Notable Sponsors | ---|--- | JetBrains, providing us with free All...

gibbonlms-filewrite_rce

Gibbon LMS Arbitrary File Write / RCE Vulnerability Information Arbitrary File Write in Gibbon LMS for RCE CVE-2023-45878 GibbonEdu Gibbon LMS version 25.0.1 and earlier allows Arbitrary File Write because rubricsvisualisesaveAjax.php does not require authentication. The endpoint accepts the img,...

CVE-2018-7600

Drupal-CVE-2018-7600 Usage: python3 exploitdrupalcve-2018-7600.py...

ediop3PHP

ediop3PHP A PHP CVE-2025-1219 SCANNER. In bash no root...

shadowhammer

Batch-mode shadowhammer MAC address checker Kaspersky recently discovered and analysed the 'Shadowhammer' attack https://securelist.com/operation-shadowhammer/89992. They did some great analysis and released a tool for sysadmins to use to determine if their systems were targetted. The released...

FastJsonAutoTypeBypass

What's this This project is used for studying how to bypass fastJSON AutoType check. Gadget Info Mapping just for fastjson 1.2.47: package com.FastJson1242; import com.alibaba.fastjson.JSONObject; public class Poc public static void mainString argv String payload ="\n" + " "a": \n" + " "@type":...

Data-Shield_IPv4_Blocklist

Data-Shield IPv4 Blocklists Two complete lists. Clear choices. Controlled updates. Data-Shield provides maintained IPv4 blocklists for inbound filtering on firewalls, gateways and web application firewalls. Choose the policy that fits your environment, import its raw URL, and review its effect on...

CVE-2026-21531

Security Feature Bypass in ASP.NET Core by Microsoft CVE-2026-21531 🌟 Description A vulnerability in the Azure SDK facilitates deserialization of untrusted data, enabling unauthorized attackers to execute arbitrary code over a network. ⚙️ Installation To set up the exploitation tool, follow these...

CVE-2025-62215_Windows_Kernel_PE

CVE-2025-62215 Exploit PoC Original code credit: https://github.com/dexterm300 🧨 Description This repository contains a proof-of-concept exploit for CVE-2025-62215 , a race condition vulnerability in the Windows kernel that can be triggered via concurrent manipulation of kernel object handles...

spark-connect-archive-fragment

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-connect-archive-fragment spark-connect-archive-fragment Class: File write Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation Spark Connect AddArtifacts names of the form archives/ split on th...

cve-2015-0313

CVE-2015-0313 Adobe Flash vulnerability source code cve-2015-0313 from Angler Exploit Kit Reference: http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-new-adobe-flash-zero-day-exploit-used-in-malvertisements/...

lunar

LUNAR Lockdown UNix Auditing and Reporting Version Current version 16.6.1 Refer to lunar.sh and CHANGELOG.md for more up to date version information License CC BY-NC-SA: https://creativecommons.org/licenses/by-nc-sa/4.0/ Fund me here: https://ko-fi.com/richardatlateralblast NOTICE Run this code i...

C2SP

The Community Cryptography Specification Project The Community Cryptography Specification Project C2SP is a project that facilitates the maintenance of cryptography specifications using software development methodologies, applying the successful processes of open source to specification documents...

netsniff-ng

////////////////////////////////////////////////////////////////////////////// netsniff-ng - the packet sniffing beast \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ . . netsniff-ng is a free, performant / Linux network analyzer and .' '. networking toolkit. If you...

scorecard

OpenSSF Scorecard Overview What Is Scorecard? Prominent Scorecard Users View a Project's Score Scorecard's Public Data Using Scorecard Scorecard GitHub Action Scorecard REST API Scorecard Badges Scorecard Command Line Interface Prerequisites Installation Authentication Basic Usage Checks Default...

CVE-2021-41277

CVE-2021-41277 Metabase GeoJSON map local file inclusion Version: x.40.0-x.40.4 Usage : chmod -x CVE-2021-41277.sh ./CVE-2021-41277.sh http://ip:port/ /etc/passwd References https://vulners.com/cve/CVE-2021-41277...