Exploits

CVE-2021-3262 - Blind SQL Injection in the editOEN parameter of TripSpark VEO Transportation / NovusEDU. Unauthenticated, internet-facing. Payloads, annotated requests, and evidence.

CVE-2021-26837 - SQL Injection in the SearchTextbox parameter of HelpSystems/Fortra DeliverNow. Payloads, annotated requests, and evidence. Fixed in 1.2.18.

CVE-2026-12960 - Improper Export of Android Application Components in the ASUS Router app (com.asus.aihome). PoC, exploit APK, video, and vendor report. Fixed in 1.0.0.9.74.

🚀 CVE-2026-31431 - Linux Kernel AF_ALG + splice() Privilege Escalation Exploit (Zero-Day → Root Persistence)

CVE-2026-61946: Unauthenticated IDOR in Easy Appointments <= 3.12.27

CVE-2026-43499 per-boot root exploit — core logic (arm64 Android GKI 6.6)

（CVE-2026-43499）内核漏洞利用程序，适用于未解锁 Bootloader 的一加15T.

Manage BitLocker encrypted drives on Windows 10 and 11. Extract recovery keys, check encryption status, and apply security mitigations for CVE-2026-45585.

Manage BitLocker encrypted drives on Windows. Extract recovery keys, check encryption status, and apply security mitigations for CVE-2026-45585.

Security Advisory: Camaleon CMS - Authenticated RCE via `select_eval` Custom Field

is an advanced security research framework designed to model, analyze, and demonstrate Local Privilege Escalation (LPE) mechanics associated with kernel-level race conditions and filesystem structure vulnerabilities (CVE-2026-64600 / RefluXFS)

Security Advisory: Negative Chunk-Size Parsing Causes Memory Corruption in facil.io

Security Advisory: Infinite Loop DoS in facil.io MIME Parser (Partial Boundary)

Security Advisory: Out-of-Bounds Read in facil.io MIME Parser leads to Server crash

👾 CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework ⚡Bash & Python versions. Features: --detect safe check, --exploit combo/unsigned/xsw/nameid/all, --shodan integration, --tor support, mass scanning, JSON/CSV/JSONL output, cookie validation. 🛡️ CVSS 9.9 Critical - Use Ethically, Stay Legal. 🔒

IBM Langflow Unauthenticated RCE via Auto-Login Bypass

Discuz! X5.0 Authentication Bypass Exploit Framework (CVE-2026-49952) - Critical vulnerability allowing unauthenticated database backup access via UC_KEY encryption oracle token reuse. CVSS 9.1. Full-featured tool with version detection, multi-payload attacks, interactive shell, and automated exploitation. Authorized testing only.

Path Traversal vulnerability in TahaBakhtari/SubtitleGenerator - CVE-2026-51592