CVE-2025-56807

CVE-2025-56807 Description A Stored Cross Site Scripting XSS vulnerability was discovered in FairSketch RISE Ultimate Project Manager & CRM v3.9.4 in the File Manager functionality. The vulnerability lies in the title parameter that is submitted when creating new folders. Due to insufficient inpu...

moodle-cve

Challenge creation Inspiration moodle CVE-2025-26529: posoning admin logs to full admin account takeover @ref: https://www.youtube.com/watch?v=dhVF6hQUzWU @ref: https://github.com/NightBloodz/moodleTestingEnv @ref: https://medium.com/@Nightbloodz/admin-account-takeover-in-moodle-093708a0f749...

CVE-2026-104073

A flaw was found in NetBox. An authenticated user with permission to create custom links can exploit a template injection vulnerability to access sensitive session information and Application Programming Interface API tokens. When a victim views an object containing the malicious link, their...

Koi

koi 🎏 &color=rgb\255%2C%20116%2C%200\ This project is my shot at making a fast, easy to use yet feature rich shell handler with a pretty interface. Disclaimer: please note that this is still under development, and I am still working on some of the key features, talked about in this section. 📑 Tab...

CVE-2025-32432

CraftCMS CVE-2025-32432 Exploit Toolkit Exploitation tools for CraftCMS Remote Code Execution vulnerability based on SensePost research. 📁 File Description 🎯 Main Tools 1. finalpoc.py - Final optimized POC Supports information disclosure and remote code execution Automatic asset ID discovery...

pgaudit

pgAudit Журналирование аудита для Open Source PostgreSQL Введение Расширение PostgreSQL Audit Extension pgAudit обеспечивает детальное журналирование аудита сессий и/или объектов через стандартный механизм журналирования PostgreSQL. Цель pgAudit — предоставить пользователям PostgreSQL возможность...

CVE-2019-10008

CVE-2019-10008 ManageEngine Service Desk Plus 9.3 Privilaged account Hijacking Date: 30-03-2019 Exploit Author: Ata Hakçıl, Melih Kaan Yıldız Vendor: ManageEngine Vendor Homepage:www.manageengine.com Product: Service Desk Plus Version: 10.0 Tested On: Windows 10 64 bit CVE : 2019-10008 Complete P...

CVE-2023-41425-RCE-WonderCMS-4.3.2

🚨 WonderCMS RCE Exploit Tool CVE-2023-41425 This Python-based offensive security tool automates the exploitation of a Remote Code Execution RCE vulnerability in WonderCMS 4.3.2 , specifically CVE-2023-41425. It streamlines the process of crafting a malicious ZIP theme module and delivering a...

CVE-2025-51860

CVE-2025-51860 Vulnerability description TelegAI, a web application for constructing and chatting with AI Characters, is vulnerable to Stored Cross-Site Scripting XSS in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by craftin...

PasteJacker

PasteJacker The main purpose of the tool is automating PasteJacking/Clipboard poisoning/whatever you name it attack with collecting all the known tricks used in this attack in one place and one automated job as after searching I found there's no tool doing this job the right way 😄 Now because thi...

Invoke-SessionHunter

Invoke-SessionHunter Retrieve and display information about active user sessions on remote computers. No admin privileges required. The tool leverages the remote registry service to query the HKEYUSERS registry hive on the remote computers. It identifies and extracts Security Identifiers SIDs...

nullinux

nullinux Nullinux is an internal penetration testing tool for Linux that can be used to enumerate OS information, domain information, shares, directories, and users through SMB. If no username and password are provided in the command line arguments, an anonymous login, or null session, is...

CVE-2018-7935

CVE-2018-7935 POC grab vaild Session first curl http://192.168.8.1/html/index.html | grep SessionID Instructions: Edit exploit.py , insert grabbed SessionID Vulnerability Status : Acknowledgemnt Recieved & Patch is released...

CVE-2025-52689-PoC

CVE-2025-52689 PoC Code PoC code for CVE-2025-52689 Alcatel-Lucent Enterprise AP1361D Wi-Fi Access Point Authentication Bypass Vulnerability. This POC was developed for the SpiritCyber 2024 competition held during Singapore International Cyber Week 2024. Usage 1. Install requirements with pip...

evilginx2

Evilginx 3.0 Evilginx est un framework d'attaque man-in-the-middle utilisé pour le phishing d'identifiants de connexion ainsi que des cookies de session, ce qui permet de contourner la protection par authentification à deux facteurs. Cet outil est le successeur d'Evilginx, sorti en 2017, qui...

sack

sack Identify connection of sessions for social engineering attacks. ========== It is the first framework to keep track of victims through social support live attacks. Example of use: python sack.py You must be in mode root to run. Has support to developing simple of modules Something that not ca...

cve-2022-23131-exp

Zabbix SSO Auth Bypass CVE-2022-23131 usage: zabbixsessionexp.py -h -t TARGET -u USERNAME -p PROXY -f FILES optional arguments: -h, --help show this help message and exit -t TARGET, --target TARGET Zabbix Server -u USERNAME, --username USERNAME Zabbix Admin User -p PROXY, --proxy PROXY Proxy for...

POC-CVE-2025-24813

CVE-2025-24813 Apache Tomcat RCE PoC Proof of Concept PoC exploiting CVE-2025-24813, a Remote Code Execution RCE vulnerability in Apache Tomcat. The vulnerability allows an attacker to upload a malicious serialized payload to the server, leading to arbitrary code execution via deserialization whe...

evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

evilginx

Evilginx v.1.1.0 CETTE VERSION EST OBSOLÈTE. VEUILLEZ UTILISER LA DERNIÈRE VERSION ! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx est un framework d'attaque man-in-the-middle utilisé pour le phishing d'identifiants et de cookies de session de n'importe quel service web. Son cœur...