CVE-2024-6536

Description This script is a PoC for CVE-2024-6536, where a XSS is possible in the Zephyr Project Manager plugin for Wordpress. It requires authentication and privileges as a project manager administrator. Usage python3 CVE-2024-6536.py -u -p -w Example: python3 CVE-2024-6536.py -u user -p user -...

CVE-2026-22599

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-22599 CVE-2026-22599 Strapi 5.33.1 - Strapi I am @abraxasnull. Loopback lab. CVE-2026-22599-Abraxas-Labs.py chdirs into lab/ and runs run.sh. Content-Type Builder write API database-query injection. Yup...

CVE-2023-40028

CVE-2023-40028: Ghost CMS Symlink Exploitation PoC Overview This repository contains a Proof-of-Concept PoC script designed to demonstrate the exploitation of CVE-2023-40028 , a Local File Inclusion LFI vulnerability affecting Ghost CMS versions prior to 5.59.1. The vulnerability allows...

CVE-2023-40028

Proof of Concept PoC for CVE-2023-40028 CVE-2023-40028 is a vulnerability in Ghost CMS that allows arbitrary file reads through improper file handling. This PoC demonstrates how the exploit works under controlled conditions. Educational use only. Reference: Adapted from the original PoC by...

CVE-2024-54819

CVE-2024-54819 Read more details on: https://www.partywave.site about CVE-2024-54819 POST request to login The attacker must be logged POST /librarian/index.php/authentication HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:128.0 Gecko/20100101 Firefox/128.0 removed...

CVE-2024-37791

CVE-2024-37791 CVE-2024-37791 Project address: Preparatory work: Log in to the backend - get cookie Vulnerability URL: http://127.0.0.1:8093/s/article/Content/index?classid=&keyword= Vulnerability parameter: keyword payload: %27andselectfromselect+ifasciisubstrdatabase,1,1%3E97,sleep1,0a//union/...

demo-CVE-2021-29447-lezione

POC CVE-2021029447 - XXE in WordPress WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 https://vulners.com/cve/CVE-2021-29447 Using Step1. Run WordPress $ make up-wp Step2. Run Attacker web server $ make up-mal Step3. Generate malicious WAV file With wavefile npm $ make make-wav Step4...

CVE-2023-40931-PoC

CVE-2023-40931 The sqlmap payload to exploit CVE-2023-40931 Payload Required Information: Valid Username and Password Domain and path of hosted instance sqlmap -D nagiosxi -T xiusers -u "https:///nagiosxi/admin/bannermessage-ajaxhelper.php?action=acknowledgebannermessage&id=3&token=curl -ksX POST...

exploit-CVE-2019-14530

OpenEMR CVE-2019-14530 exploit OpenEMR --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder Filename of the file to be read Username of the admin Password of the admin --debug Display arguments -h, --help Show this screen Examples: exploit.rb...

POC_CVE-2025-14700

CVE-2025-14700 PoC for CVE-2025-14700 , a Server-Side Template Injection SSTI vulnerability in Crafty Controller = 4.6.1. This vulnerability allows authenticated users to achieve Remote Code Execution RCE by injecting malicious Jinja2 templates into the Webhook configuration. 📦 Installation Clone...

CVE-2025-66837

CVE-2025-66837 Malicious File Upload Description A file upload vulnerability in ARIS allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware CVSS Score: 6.8 Medium Attack Type Remote Authenticated Affected Versions Versions before 10.0.23.0.3587512 Discovered By: Yazan...

CVE-2023-31702

CVE-2023-31702 — eScan Management Console SQL Injection Authenticated Overview CVE-2023-31702 is an authenticated SQL Injection vulnerability discovered in MicroWorld Technologies eScan Management Console version 14.0.1400.2281. The vulnerability exists in the GetUserCurrentPwd endpoint, where th...

CVE-2024-9264

CVE-2024-9264 python CVE-2024-9264.py '' -u '' -p '' -c ''...

CVE-2023-30253-PoC

CVE-2023-30253 CVE-2023-30253 PoC Description This is my PoC for the CVE-2023-30253 Dolibarr 17.0.0 PHP Code Injection, when the CMS Website plugin core is enabled, an authenticated attacker can obtain remote command execution via php code injection bypassing the application restrictions...

CVE-2021-2109

CVE-2021-2109 Weblogic Server Remote Code Execution Vulnerability Reproduction and Analysis In January 2021, Oracle released a security update patch, including 329 new security patches in the Oracle product family. This announcement specifically mentioned the Oracle WebLogic Server security...

CVE-2018-3252

CVE-2018-3252-PoC 1.Generate PoC with YSOSERIAL 2.You should know the USERNAME and PASSWORD of the target weblogic server 3.Send the payload to the URL POST /beawlsdeploymentinternal/DeploymentService HTTP/1.1 Host: 127.0.0.1:7001 Accept:...

perl-CryptX

NAME CryptX - Cryptographic toolkit SYNOPSIS CryptX is the distribution entry point. In normal code, load one of the concrete modules listed below. one-shot hashing use Crypt::Digest qwdigestdatahex; my $sha256 = digestdatahex'SHA256', 'hello world'; classic AES-CBC encryption with padding use...

cve-2019-2618

cve-2019-2618 Weblogic Upload Vulnerability Requires username password - CVE-2019-2618 Python Usage python CVE-2019-2618.py url username password Decrypt Weblogic Password root@f0cb7e674d7e:/Oracle cat...

CVE-2021-29447-POC

CVE-2021-29447 Proof of Concept Proof of Concept for CVE-2021-29447 written in Python. Details about the CVE can be found at https://vulners.com/cve/CVE-2021-29447 Disclaimer This script is a PoC for authorized ethical security testing only. Usage usage: python3 CVE-2021-29447.py -h --url URL...

OpenSTAManager-RCE-Exploit-CVE-2026-38751

OpenSTAManager RCE Exploit CVE-2026-38751 Arbitrary File Upload leading to Remote Code Execution Full-featured proof-of-concept for CVE-2026-38751 , written in Rust. Warning: This tool is intended for authorised security testing and educational purposes only. Use it only on systems you own or hav...