CVE-2019-9053-working-

CVE-2019-9053-working script- CMS Made Simple 2.2.10 - SQL Injection . Actual working version Updated the script to work with latest python versions Added Exception Handling for each function You can also calibrate time.sleep inside the exception handling blocks depending on response and connecti...

CVE-2025-2304-POC

CVE-2025-2304-POC PoC for CVE-2025-2304 — Camaleon CMS 2.9.0 privilege escalation via mass assignment on the password change endpoint. Vulnerability The /admin/users/:id/updatedajax endpoint does not filter the role parameter before passing it to the model update, allowing any authenticated user ...

CVE-2022-28117

CVE-2022-28117 Navigate CMS = 2.9.4 - Server-Side Request Forgery Authenticated Description A Server-Side Request Forgery SSRF in feedparser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed...

CVE-2018-7600-Drupal-0day-RCE

CVE-2018-7600-Drupal-0day-RCE Drupal 0day Remote PHP Code Execution Perl This is a 0day RCE Exploit in Drupal CMS You Can Upload Payload on server. CVE : CVE-2018-7600 Cxsecurity : https://cxsecurity.com/issue/WLB-2018040108 How Run Exploit : 1-git clone...

killshot

This project is no longer maintained ! KILLSHOT A Penetration Testing Framework, Information gathering tool & Website Vulnerability Scanner Why KillShot? You can use this tool to spider your website, gather important information, and automate data collection using tools such as WhatWeb, Host,...

CVE-2020-35846

Cockpit CMS NoSQL Injection to Remote Code Execution : CVE-2020-35846 Description Cockpit CMS has some NoSQL Vulnerabilities which can be used to dump users' information, This information disclosures can be chained together to change users' passwords and which leads to Remote Code Execution on th...

CVE-2025-32432

CVE-2025-32432 - Craft CMS Unauthenticated RCE PoC Working proof-of-concept for CVE-2025-32432 , an unauthenticated remote code execution vulnerability in Craft CMS versions up to and including 5.6.16 also affects 4.x and 3.x trees on equivalent code paths. Search keywords: CVE-2025-32432, Craft...

CVE-2021-38817-Remote-OS-Command-Injection

CVE-2021-38817-Remote-OS-Command-Injection Authenticated Remote OS Command Injection/Remote Code Execution in TastyIgniter v3.0.7 Sendmail web part CVE-2021-38817 An authenticated remote OS command injection vulnerability exists in the TastyIgniter v3.0.7 Restaurtant CMS Sendmail configuration me...

CVE-2026-45332-PoC

CVE-2026-45332: Broken Access Control in Automad CMS Proof of concept for CVE-2026-45332 , a Broken Access Control vulnerability in Automad CMS that allows any unauthenticated attacker to dump the bcrypt password hash and TOTP secret of every administrator account through the setup endpoint, whic...

CVE-2025-65094

CVE-2025-65094: WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation IDOR Overview Field| Details ---|--- CVE ID| CVE-2025-65094 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products WBCE/WBCECMS Details Summary A low-privileged user in WBCE CMS...

nuubi

Nuubi Tools Scanner, Recon. Details Options: -h/--help | Show help message and exit Arguments: -b/--banner | Banner grabing of target ip address -s/--subnet | Subnetlookup of target -c/--cms | Cms detect with headers -d/--dns | Dnslookup of target domain -e/--extract | Extract links from target...

rxerium-templates

A curated collection of 144+ Nuclei templates focusing on zero-day and actively exploited vulnerabilities in the wild with a few miscellaneous templates. Templates use passive detection techniques version/date matching and are organized by year for easy navigation. ⚠️ Note: Date matching may be...

CVE-2022-26265

CVE-2022-26265 Contao CMS RCE This repo is part of the hgrab-framework Affected product Contao CMS v1.5.0 Installation Install the app on the server user@domain: git clone https://github.com/sh4den/CVE-2022-26265.git user@domain: cd ./CVE-2022-26265/ user@domain: python3 main.py The list file mus...

CMSeeK

What is a CMS? A content management system CMS manages the creation and modification of digital content. It typically supports multiple users in a collaborative environment. Some noteable examples are: WordPress, Joomla, Drupal etc. Release History - Version 1.1.3 25-07-2020 - Version 1.1.2...

ICG-AutoExploiterBoT

ICG-AutoExploiterBoT ❗ Edit Line 44 Add your Email Address for Add admin joomla Exploit Use outlook.com Mail! ✔️ :warning:Note! : We don't Accept any responsibility for any illegal usage. AutoExploiter Not working for now! please Wait for update This software! AutoExploiter Not working for now!...

CVE-2025-61505

CVE-2025-61505 – PHP Object Injection in e107 CMS 2.x Reported: September 18, 2025 CVE Assigned: October 9, 2025 Published: February 02, 2026 CVE ID: CVE-2025-61505 Discoverer: Anas Abderrahman Benbarek Summary A PHP Object Injection vulnerability CWE-502: Deserialization of Untrusted Data was...

cmsms-sqli

CMS Made Simple = 2.2.9 SQL Injection CVE-2019-9053 - Python3 Exploit Pure Python3 port of the original Exploit-DB 46635 by Daniele Scanu. Time-based blind SQLi to dump admin credentials from vulnerable CMS Made Simple installations. 🎯 Features: ✅ No external dependencies only requests ✅ Python...

CVE-2023-40028

Proof of Concept PoC for CVE-2023-40028 CVE-2023-40028 is a vulnerability in Ghost CMS that allows arbitrary file reads through improper file handling. This PoC demonstrates how the exploit works under controlled conditions. Educational use only. Reference: Adapted from the original PoC by...

CVE-2025-2304

Camaleon CMS 2.9.0 – Authenticated Privilege Escalation Role Change + Optional S3 Config Leak Target: Camaleon CMS v2.9.0 Type: Authenticated privilege escalation via mass-assignment in updatedajax role field Extras: Optional extraction of S3 configuration from the admin settings page if the...

CVE-2020-15906

CVE-2020-15906 Writeup of CVE-2020-15906. Special Thanks to Frederic MohrLastbreach for your Backend Support. Tiki Wiki Cms Groupware 16.x - 21.1 Authentication Bypass by Maximilian Barz I have found a new vulnerability in TikiWiki Cms Groupware 16.x - 21.1. It allows remote unauthenticated...