Grav-CMS-RCE-Authenticated

Grav CMS Remote Code Execution Autenticado - CVE-2024-28116 Información Este código es una adaptación delrepositorio de GitHub Graver con algunas mejoras basadas en este video. Exploit contra Grav CMS para versiones anteriores a 1.7.45 basado en vulnerabilidades SSTI + RCE, etiquetado como...

CVE-2020-35846

Cockpit CMS NoSQL Injection to Remote Code Execution : CVE-2020-35846 Description Cockpit CMS has some NoSQL Vulnerabilities which can be used to dump users' information, This information disclosures can be chained together to change users' passwords and which leads to Remote Code Execution on th...

CVE-2023-49052

CVE-2023-49052 - Microweber CMS v2.0.4 - Subida de Archivos Maliciosos Descripción En la versión 2.0.4 de Microweber CMS, cuando la opción de subida de archivos está activa en los formularios creados, es posible enviar archivos HTML maliciosos, incluso cuando se aplican ciertos tipos de...

CraftCMS_CVE-2023-41892

Craft CMS CVE-2023-41892 There is a Unauthenticated Remote Code Execution RCE affecting CraftCMS 4.0.0-RC1 - 4.4.14. Usage root@kitploit: python3 craft-cms.py http://target Requirements The exploit make use of requests. Install it with : root@kitploit: python3 -m pip install requests...

CVE-2018-10517

CVE-2018-12613 Authenticated remote command execution by uploading a fake module, dropping PHP files on remote web server. Software Affected 1. CMS Made Simple 2.2.7; How to use This PowerShell scripts need two parameters to craft a exploit HTTP request: root@kitploit: 1. CMS Made Simple URL...

Ghost-5.58-Arbitrary-File-Read-CVE-2023-40028

Ghost Arbitrary File Read Exploit CVE-2023-40028 Overview This script exploits a vulnerability in Ghost CMS CVE-2023-40028 to read arbitrary files from the server. By leveraging a symlink in an uploaded ZIP file, an attacker can gain unauthorized access to sensitive files on the system. Features ...

CVE-2020-15906

CVE-2020-15906 Writeup of CVE-2020-15906. Special Thanks to Frederic MohrLastbreach for your Backend Support. Tiki Wiki Cms Groupware 16.x - 21.1 Authentication Bypass by Maximilian Barz I have found a new vulnerability in TikiWiki Cms Groupware 16.x - 21.1. It allows remote unauthenticated...

CVE-2024-31666

Resumen de la vulnerabilidad Existe una vulnerabilidad en Flusity-CMS v.2.33 que permite a atacantes remotos ejecutar código arbitrario a través de scripts especialmente diseñados en el componente editaddonpost.php. Versiones afectadas Flusity-CMS v.2.33 Detalles de la vulnerabilidad Los atacante...

CVE-2025-2304

Camaleon CMS v2.9.1 - Mass Assignment leads to Privilege Escalation Exploit Tool - PoC Description This project is a Python-based exploitation proof of concept tool that demonstrates and analyzes a privilege escalation vulnerability affecting v2.9.1 of Camaleon CMS. The script automates the proce...

CVE-2026-9082-Mass_Scanner

CVE-2026-9082-MassScanner Escáner Masivo para el Exploit de Drupal CVE-2026-9082 Para configurar el script ExploitPOC ejecuta este comando : root@kitploit: pip install requirements.txt Para usar el script ExploitPOC ejecuta este comando : root@kitploit: python exploitpoc.py -t targets.txt -o...

CVE-2023-41892

CVE-2023-41892 A Craft CMS vulnerability that allows Remote Code Execution RCE...

CVE-2022-24227-updated

CVE-2022-24227 Actualizado - BoltWire v8.00 - Cross-site Scripting Almacenado XSS Descripción CVE-2022-24227 Actualizado : En la versión 8.00 de BoltWire CMS , los campos First Name y Last Name de la página de finalización del registro de miembros también son vulnerables a ataques de cross-site...

CVE-2019-9053-port-py3

CVE-2019-9053 Exploit - Python 3 This is a Python 3 port of the CVE-2019-9053 exploit, which targets CMS Made Simple CMSMS versions before 2.2.10. The vulnerability allows for SQL injection through the News module interface. Example Output Tested on the TryHackMe Simple CTF Challenge. Description...

CVE-2023-43877-RiteCMS-Stored-XSS---Home

Rite CMS v3.0 Múltiples XSS Almacenados Autor: Sergio Descripción: Rite CMS 3.0 está afectado por una vulnerabilidad múltiple de Cross-Site Scripting XSS almacenado que permite a los atacantes ejecutar código arbitrario mediante un payload manipulado en los campos de la página de inicio Home Page...

CVE-2025-41088

CVE-2025-41088: Xibo CMS 中的存储型XSS 我在 Xibo CMS v4.1.2 中发现了一个 存储型跨站脚本（XSS） 漏洞。由于对用户提供的输入验证不当，该漏洞允许经过身份验证的攻击者将恶意脚本注入应用程序中。 问题出在“模板”功能中。攻击者可以构造一个包含带有恶意负载的文本元素的模板。当其他用户查看此模板时，该脚本会在他们的浏览器中执行，可能导致数据窃取或其他恶意操作。 概念验证（PoC） 要利用该漏洞，经过身份验证的用户必须执行以下步骤： 1. 导航到 设计 模板 部分并创建一个新模板。 2. 转到 全局元素 部分并添加一个新的文本元素。 3. 在编辑器的...

CVE-2022-41544

CVE-2022-41544 Exploit Script This repository contains a script to exploit CVE-2022-41544 vulnerability in GetSimple CMS. The script performs several steps to check for vulnerabilities, leak API keys, set cookies, obtain CSRF tokens, upload a shell, and trigger the shell. Changes and Improvements...

Vulnerability-Research

🛡️ Vulnerability Research Here, I catalog the vulnerabilities I've discovered, the corresponding write-ups containing details of the weaknesses, and insights into their impact and remediation. 🏆 Assigned CVEs...

CVE-2024-45265

CVE-2024-45265 Suggested description A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3132 allows remote attackers to execute arbitrary SQL commands via the psid parameter. Vulnerability Type CWE-89 | SQL Injection Vendor of Product SkySystem https://skyss.ru/...

CMS_Detector

CMSDetector Python2 Donation : BTC : 31mtLHqhaXXyCMnT2EU73U8fwYwigiEEU1 Perfect Money : U22270614...

Ghost-CMS-Code-Injection-Audit-CVE-2026-26980

Ghost CMS Code Injection Cleaner Removes injected code from every post and page on a Ghost CMS website via the Admin API. Use this to clean up a compromised Ghost site — for example, one affected by the code injection vulnerability CVE-2026-26980 — by stripping attacker-supplied tags and other...