mht

mht

公众号：棉花糖fans 博客：mhtsec.com

GitHub 44 repos 225 followers

Explained projects

ARTEX: The Pentest Brain That Plans, Remembers, and Asks Permission
ARTEX: The Pentest Brain That Plans, Remembers, and Asks Permission
An open-source autonomous security system that turns reconnaissance, reasoning, and execution into a graph-driven workflow with human approval at the edge.
9 min read · Oct 9, 2026

Yet to be explained

nacos-authscope-poc
Nacos 3.x (3.0.0~3.2.3) auth scope misassignment: unauthenticated admin account creation & full takeover PoC, fixed in 3.2.4
Python55 stars
Explain
GeoServer-jsonArrayContains-PG-RCE
Python16 stars
Explain
CVE-2026-63030
WordPress 未授权RCE EXP | CVE-2026-63030
Python15 stars
Explain
CVE-2026-85706
GitLab CE/EE unauthenticated path traversal (CVE-2026-85706) - PoC
Python12 stars
Explain
jumpserver-accesskey-leak
JumpServer < v4.10.19 LTS AccessKey leakage PoC - row-level scoping inversion via ?_rel=not (NotOrRelFilterBackend)
Python3 stars
Explain
jimureport-2.5.1-rce
JimuReport 2.5.1 pre-auth RCE: auth bypass via hardcoded X-Sign secret + Aviator expression injection + sandbox escape (CVE PoC)
Python3 stars
Explain
showdoc-registerbyverify-rce
Python3 stars
Explain
better-auth-ghsa-965c-763c-88jm
PoC and source analysis for better-auth GHSA-965c-763c-88jm (OAuth state / Magic Link token confusion)
Python2 stars
Explain
CVE-2026-94545
Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC
Python2 stars
Explain
CVE-2026-84645
Jenkins PersistenceRoot Deserialization RCE (SECURITY-3972) — PoC & analysis. Requires Item/Configure; affects weekly <= 2.579 / LTS <= 2.568.2
Python2 stars
Explain
mhtsec
1 stars
Explain