Fuel CMS 1.4.7 - SQL Injection

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. id: CVE-2020-17463 info: name: Fuel CMS 1.4.7 - SQL Injection author: Thirukrishnan severity: critical description: | FUEL CMS 1.4.7 allows SQL Injection via the col parameter to...

Strapi-RCE

Strapi-RCE Exploit script showcasing a mixture of CVE-2019-18818 and CVE-2019-19609 for unauthenticated remote code execution in Strapi CMS. Exploit This script exploits a vulnerability in Strapi CMS versions 3.0.0-beta.17.4 and lower, allowing for unauthenticated remote code execution. Descripti...

CVE-2020-18325

Multilple Cross Site Scripting XSS vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel. Description Subrion CMS is easy to install and simple to manage. Use it as a stand-alone application or in conjunction with other applications to create entry level sites, mid-siz...

CVE-2026-105217: Improper Certificate Validation

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

PT-2026-104646

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to site url can present any certificate to steal the worker/web/token value a...

CVE-2026-45332-PoC

CVE-2026-45332: Broken Access Control in Automad CMS Proof of concept for CVE-2026-45332 , a Broken Access Control vulnerability in Automad CMS that allows any unauthenticated attacker to dump the bcrypt password hash and TOTP secret of every administrator account through the setup endpoint, whic...

CMS-Made-Simple-2.2.9-CVE-2019-9053

CMS-Made-Simple-2.2.9 - SQL-Injection-Exploit - CVE-2019-9053 Description This repository contains an exploit for an unauthenticated SQL injection vulnerability in CMS Made Simple versions 2.2.9 and earlier. This vulnerability, identified under CVE-2019-9053 , allows an attacker to retrieve...

CVE-2019-9053-working-

CVE-2019-9053-working script- CMS Made Simple 2.2.10 - SQL Injection . Actual working version Updated the script to work with latest python versions Added Exception Handling for each function You can also calibrate time.sleep inside the exception handling blocks depending on response and connecti...

CVE-2025-32432

CVE-2025-32432 - Craft CMS Unauthenticated RCE PoC Working proof-of-concept for CVE-2025-32432 , an unauthenticated remote code execution vulnerability in Craft CMS versions up to and including 5.6.16 also affects 4.x and 3.x trees on equivalent code paths. Search keywords: CVE-2025-32432, Craft...

CVE-2019-9053

CMS Made Simple Extracts data character by character by checking response delays. Extracts: Salt cmssiteprefs table Admin username cmsusers Admin email cmsusers Admin password hash cmsu...

CVE-2024-33210

CVE-2024-33210 A cross-site scripting XSS vulnerability has been identified in Flatpress 1.3. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by other users. Vulnerability Type: Cross Site Scripting XSS Vendor of Product: flatpress CMS Affected Product Code...

CVE-2026-102261

CVE-2026-102261 This project contains a non-destructive checker to confirm whether an authorized instance of Camaleon CMS enforces the authorization introduced in version 2.9.3. Scope The issue affects POST /admin/media/crop in Camaleon CMS up to 2.9.2. A user with :manage, :media, but without...

mysqli

MySQLi.py - Time-Based Blind SQL Injection for MySQL MySQLi.py is a personal practice project, inspired by Exploit-DB exploit 46635, used during the SimpleCTF room on TryHackMe. What caught my attention in the original exploit was its ability to extract credentials and even crack the password has...

CTF-CVE-2019-9053-GTFOBins

CTF, CVE-2019-9053, GTFOBins I utilized the machines on https://tryhackme.com/ and my own Kali on WSL to do this exercise and it is part of the CTF challenge. The following information helped me solved the challenge: vim on https://gtfobins.github.io/gtfobins/vim/ and https://gtfobins.github.io/...

CVE-2026-93659-writeup

CVE-2026-93659: Stored XSS in Concrete CMS Community Store Leads to Admin Dashboard Takeover Summary | ---|--- CVE| CVE-2026-93659 Component| concretecms-community-store/communitystore Type| Stored Cross-Site Scripting CWE-79 Severity| CVSS v4.0 9.3 Critical / v3.1 8.7 High Affected| All versions...

CVE-2022-37202

CVE-2022-37202 CVE-2022-37202 POC Suggested description JFinal CMS 5.1.0 is vulnerable to SQL Injection. Vulnerability Type SQL Injection Vendor of Product the development group Affected Product Code Base https://github.com/jflyfox/jfinalcms - JFinal CMS 5.1.0 Affected Component These interfaces...

Vvveb-CMS-CVE-2025-8518

Vvveb-CMS-CVE-2025-8518 This repository contains a Proof of Concept PoC demonstrating a critical vulnerability in givanz Vvveb 1.0.5. The vulnerability allows an authenticated user with template editing privileges to write arbitrary PHP code to server files, leading to Remote Code Execution RCE...

CVE-2018-17553

CVE-2018-17553 CVE-2018-17553 PoC Navigate CMS version 2.8 and prior This proof of concept was put together when working on the Black Pearl box from TCM. I couldn't find anyone that put out a PoC other than just using Metasploit. As I'm avoiding Metasploit in my hacking journey to then go back an...

CVE-2015-6967

CVE-2015-6967 An exploit for the Nibbles manager version 4.0.3. This exploit allows RCE to be performed. Requirements optparse, signal, requests Usage python3 CVE-2015-6967.py --url http://10.129.156.150/ --username admin --password nibbles + Login Succesfuly! + Uploading shell... Shell has been...

CVE_2018_16763_Proof_of_Concept

CVE-2018-16763 Proof-of-Concept A Proof-of-Concept PoC exploit for CVE-2018-16763 Fuel CMS - Preauthenticated Remote Code Execution. Description This Python 3 program serves as a PoC for the CVE-2018-16763 vulnerability in the Fuel CMS content management system. Specifically, the vulnerability...