CVE-2021-42561

CVE-2021-42561: Command Injection via the Human Plugin in MITRE Caldera In Caldera versions =2.8.1 the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allow attackers to use shell metacharacters e.g. backticks "" or dollar parenthesis "$" in order to esca...

GrafTraverse-CVE-2021-43798

GrafTraverse - CVE-2021-43798 MiNi Exploitation Framework Command-line automation tool for authorized security testing of Grafana Directory Traversal CVE-2021-43798. Overview CVE-2021-43798 is an unauthenticated directory traversal vulnerability in Grafana 8.x that allows attackers to read...

CVE-2024-10516

CVE-2024-10516 Swift Performance Lite = 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify' Description The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via the 'ajaxify' function. This makes it...

UPGer

UPGer | CVE-2022-4060 - User Post Gallery Automatic Mass Tool for checking vulnerability in CVE-2022-4060 - WordPress Plugin : User Post Gallery install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How To Use bash upger.sh yourlist.txt thread...

cve-2025-1323

cve-2025-1323 WP-Recall Plugin SQL Injection ⚠️ Legal Disclaimer This tool is intended for authorized security testing and educational use only. Do not use against systems without explicit permission. Misuse may be illegal. ✅ Requirements Python 3.x requests module Install dependencies: pip instal...

zeek-community-id

"Community ID" flow hashing for Zeek This Zeek package provides support for Community ID flow hashing, a standardized way of labeling traffic flows in network monitors. When loaded, the package adds a communityid string field to conn.log. Note Zeek 6 and later versions include Community ID suppor...

essential-addons-for-elementor-xss-poc

🔍 Essential Addons for Elementor XSS Vulnerability Detector 🚨 Critical Information This tool is for security research and patching purposes only. Do not use it to harm sites. If you find vulnerable sites, report them responsibly to site owners so they can update immediately. ⚠️ Vulnerability...

expliot

EXPLIoT Noun: /ɛkˈsplʌɪəti:/ A Framework for security testing and exploiting IoT products and IoT infrastructure. It provides a set of plugins test cases which are used to perform the assessment and can be extended easily with new ones. The name EXPLIoT pronounced expl-aa-yo-tee is a pun on the...

wpprobe

"Because why scan blind when WordPress exposes itself?" WPProbe A fast WordPress plugin and theme scanner that detects installed plugins via REST API enumeration and themes from HTML discovery, then maps them to known vulnerabilities. Over 5000 plugins detectable without brute-force, thousands mo...

wordpress-cve-2024-10924-exploit

WordPress CVE-2024-10924 Exploit 📌 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2024-10924, a vulnerability in the Really Simple SSL WordPress plugin that allows bypassing two-factor authentication 2FA. Attackers can exploit this flaw to log in as any user with a valid...

CVE-2024-10793

CVE-2024-10793 PoC Set this lines to your hosts file: 127.0.0.1 goodcms.lab 127.0.0.1 attacker.com Launch Wordpress using docker: $ sudo systemctl start docker $ sudo docker-compose up -d Open http://goodcms.lab:2121 and do installation wordpress steps. Install wp-security-audit-log.5.2.1 or olde...

CVE-2024-1071-PoC-Script

CVE-2024-1071 Exploit Script 🚀 🌟 Disclaimer This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal...

rizin-notebook

Rizin Notebook A notebook for binary analysis with rizin. Keep notes, commands, and scripts organized per binary. Requires rizin 0.7.0 or later. What it does Each notebook page is tied to one binary. It stores the binary itself, its SHA-256 hash, and a list of cells : command cells - a rizin...

CVE-2024-8353

This post is a research article published by EQSTLab. Thanks tocuokon, who discovered this vulnerability. Introduction Further Analysis CVE-2024-5932 EQST Insight R&TPDF file. https://github.com/user-attachments/assets/085c2f81-2894-4bb7-a3f5-62406dcb1021 CVE-2024-8353 ★ CVE-2024-8353 Arbitrary...

CVE-2025-22783

CVE-2025-22783 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name SEO Plugin by Squirrly SEO Vulnerable version = 12.4.01 Component slug squirrly-seo Component link https://wordpress.org/plugins/squirrly-seo/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...

CVE-2026-54806

WP Activity Log PHP Object Injection CVE-2026-54806 PoC 📜 Description CVE-2026-54806 is a critical CVSS 9.8 unauthenticated PHP Object Injection vulnerability in the WP Activity Log WordPress plugin wp-security-audit-log by Melapress. An unauthenticated attacker can inject serialized PHP objects...

LSTAR-EN

LSTAR - Aggressor Translated to English! By Google Translate and Deepl For the purpose of simplifying CS right-click and facilitating self-integration, refer to a large number of post-infiltration plugins Refactored and enriched host-related credential acquisition, multi-level intranet penetratio...

CVE-2024-2879

CVE-2024-2879 Description LayerSlider 7.9.11 - 7.10.0 - Unauthenticated SQL Injection The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the lsgetpopupmarkup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-4882

CVE-2026-4882 User Registration Advanced Fields = 1.6.20 - Unauthenticated Arbitrary File Upload Description : User Registration Advanced Fields = 1.6.20 - Unauthenticated Arbitrary File Upload Description The User Registration Advanced Fields plugin for WordPress versions up to and including...

idenLib

idenLib - Library Function Identification When analyzing malware or 3rd party software, it's challenging to identify statically linked libraries and to understand what a function from the library is doing. idenLib.exe is a tool for generating library signatures from .lib/.obj/.exe files...