CVE-2023-4771

CKEditor cross-site scripting vulnerability in AJAX sample CVE-2023-4771 PoC CKEditor 4 Cross-site scripting XSS vulnerability in AJAX sample This document describes how to perform an XSS vulnerability CVE-2023-4771 using CKEditor. Make sure the following is done with great caution to follow...

strot

Reverse-engineer any website's internal API with natural language The Problem Modern websites load data through hidden AJAX calls: Data isn't in the HTML - it's fetched via internal APIs You have to manually inspect network requests Complex pagination logic buried in JavaScript APIs change...

UI_CVE-2017-9248

UICVE-2017-9248 Base64-based encryption oracle exploit for CVE-2017-9248 Telerik UI for ASP.NET AJAX dialog handler...

CVE-2026-3891

CVE-2026-3891 — Pix for WooCommerce Unauthenticated File Upload RCE Nonce Leak → certificatecrtpath Upload → Code Execution Overview CVE-2026-3891 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin by linknacional versio...

CVE-2025-57819-poc

CVE-2025-57819 — FreePBX Unauthenticated SQLi → RCE One-shot exploit for the FreePBX Endpoint Manager unauthenticated SQL injection CVE-2025-57819, chained into remote code execution via the FreePBX cronjobs table. For authorized security testing / CTF use only. Vulnerability The endpoint module'...

CVE-2020-36708

CVE-2020-36708 – WordPress Epsilon Framework Function Injection PoC Overview CVE-2020-36708 is a vulnerability in the Epsilon Framework for WordPress that allows unauthenticated attackers to invoke arbitrary PHP class methods via the AJAX action epsilonframeworkajaxaction. This issue is categoriz...

drupal-exploit

drupal-exploit CVE-2018-7600 This script will exploit the CVE-2018-7600 vulnerability in Drupal 7 : drupal.py https://drupaldomain/drupal/ uid=33www-data gid=33www-data groups=33www-data https://nvd.nist.gov/vuln/detail/CVE-2018-7600 https://www.drupal.org/sa-core-2018-002...

CVE-2021-38314

Unauthenticated Sensitive Information Disclosure CVE-2021-38314 Python exploit for CVE-2021-38314 Use: python3 cve-2021-38314.py http://www.target.com The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users ...

CVE-2019-20059

CVE-2019-20059 Yetishare SQL Injection in sSortDir0 parameter - v3.5.2 - v4.5.4. Apart from an admin being able to exploit this, it could also be used in a CSRF attack to trick an admin user into running malicious queries. Files affected paymentmanage.ajax.php paymentsubscriptionmanage.ajax.php...

CVE-2025-5394

CVE-2025-5394 – WordPress Alone Theme = 7.8.3 - Unauthenticated Arbitrary File Upload via Plugin Installation 🔥 Vulnerability Summary The WordPress theme Alone versions = 7.8.3 is vulnerable to an unauthenticated arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to...

Helix3-Mass-Exploiter

CVE-2026-49049 Scanner & Auto-Write A specialized security research tool for identifying and testing the CVE-2026-49049 vulnerability affecting the JoomShaper Helix3 framework. Educational purposes only. This project is intended for authorized security testing and vulnerability research. Overview...

CVE-2020-12077

CVE-2020-12077 MapPress Maps Pro 2.53.9 - Remote Code Execution RCE due to Incorrect Access Control in AJAX Actions Description The pro version of this plugin registers several AJAX actions that call functions which lack capability checks and nonce checks, specifically the ‘ajaxget’, ‘ajaxsave’,...

CVE-2025-6934

CVE-2025-6934 – WordPress Opal Estate Pro Exploit 📖 Description This repository contains a Proof of Concept PoC exploit for CVE-2025-6934 , a critical vulnerability in the WordPress Plugin: Opal Estate Pro = 1.7.5, which allows creating an administrator account without authentication. ⚠️ Disclaime...

CVE-2025-6934

CVE-2025-6934 – WordPress Opal Estate Pro Exploit 📖 Description This repository contains a Proof of Concept PoC exploit for CVE-2025-6934 , a critical vulnerability in WordPress Plugin: Opal Estate Pro = 1.7.5, allowing unauthenticated administrator account creation. ⚠️ Disclaimer : This tool is...

Qlik-View-12.60-Including-SR-Stored-Cross-Site-Scripting-CVE-2022-42248

QlikView = 12.60 Including SR Stored Cross Site Scripting CVE-2022-42248 Table of Contents 1. Overview 2. Detailed Description 3. Proof of Concept 4. Solution 5. Disclosure Timeline 6. References 7. Credits 8. Legal Notices Overview Revision: 1.0 Impact: Stored cross-site scripting in QlikView Aj...

CVE-2021-38314

CVE-2021-38314 Python Exploit Detail The Gutenberg Template Library & Redux Framework plugin Example PoC - https://youtu.be/n1e4aFmXvOk Links CVE-2021-38314...

CVE_2019_18935

RAUcrypto Combined exploit for Telerik UI for ASP.NET AJAX. File upload for CVE-2017-11317 and CVE-2017-11357 - will automatically upload the file .NET deserialisation for CVE-2019-18935 For exploitation to work, you generally need a version with hard coded keys, or you need to know the key, for...

cve-2021-38314

cve-2021-38314 - Unauthenticated Sensitive Information Disclosure The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a giv...

CVE-2025-24801

CVE-2025-24801 PoC for GLPI RCE This repository contains a proof-of-concept script poc.py that exploits CVE-2025-24801, an LFI-to-RCE vulnerability in GLPI 10.0.17. It automates: Logging into GLPI Enabling .php uploads by updating document type settings Uploading a PHP reverse shell via the AJAX...

CVE-2026-49049

CVE-2026-49049 — Helix3 Joomla Plugin JoomShaper Unauthenticated AJAX Handler — Read-Only Vulnerability Scanner Overview CVE-2026-49049 affects the Helix3 template framework for Joomla versions 1.0 through 3.1.0. The onAjaxHelix3 handler, reachable via Joomla's comajax dispatcher, performs no...