CVE-2025-4428

CVE-2025-4427 与 CVE-2025-4428 漏洞扫描器 用于识别易受 CVE-2025-4427 和 CVE-2025-4428 漏洞链攻击的系统的先进检测工具。此安全扫描器帮助识别易受攻击的端点，并展示概念验证型利用。 功能特性 🛡️ 漏洞检测 ：通过签名分析识别易受攻击的系统 💻 命令执行 ：允许通过受控命令执行安全测试漏洞 🔄 重试机制 ：自动重试失败的连接 📄 日志系统 ：详细的日志记录，支持文件和终端输出 🌐 代理支持 ：可配置的代理设置，用于流量检查 🔧 多 Shell 支持 ：兼容 bash 和 sh 环境 📊 输出重定向 ：将结果保存到外部文件 安装 1...

Audit-BlackBox-Web-to-Root

Pentest Lab : वेब और सिस्टम एक्सप्लॉइटेशन चेन Drupal to Root अस्वीकरण यह परियोजना शैक्षिक और अकादमिक उद्देश्यों के लिए एक नियंत्रित और पृथक प्रयोगशाला वातावरण में की गई थी। किसी भी वास्तविक बुनियादी ढांचे को लक्षित नहीं किया गया। उद्देश्य हमले के तंत्र को समझकर सिस्टम को सुरक्षित करना सीखना है।...

CVE-2021-3129

CVE-2021-3129 Anleitung: Hinweis: Es wird eine PHP-Umgebung benötigt. root@kitploit: python3 CVE-2021-3129.py -u http://127.0.0.1:80 nur POC-Prüfung python3 CVE-2021-3129.py -u http://127.0.0.1:80 -c whoami Befehlsausführung, standardmäßig werden alle Exploit-Chains durchlaufen python3...

NocoBase 2.0.27 - VM Sandbox Escape

Exploit Title: NocoBase 2.0.27 - VM Sandbox Escape Date: 2026-03-26 Exploit Author: Onurcan Genç Vendor Homepage: https://www.nocobase.com/ Software Link: https://github.com/nocobase/nocobase Version: -u -P --cmd "id" python3 exploit.py -t TARGE...

wendor_labs_exploitation

Wendor Vending Machine Exploitation & Security Research Lab T...

CVE-2026-2471 WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field

The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the BaseModel class constructor calling maybeunserialize on all properties retrieved...

SecLeak

SecLeak Assessment This repository contains the s...

CVE-2025-9191

CVE-2025-9191 — Houzez WordPress Theme PHP Object Injection . The Houzez theme (WordPress) is vulnerable to PHP Object Injection via deserialization in saved-search-item.php for all versions up to 4.1.6. Exploitation requires authenticated access at Subscriber level or higher; a POP chain is not ...

CVE-2025-8871

The Everest Forms Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mimecontenttype function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may ...

PT-2024-39061

Name of the Vulnerable Software and Affected Versions: VICIdial affected versions not specified Description: The issue allows an attacker with authenticated access as an "agent" to execute arbitrary shell commands as the "root" user. This can potentially be chained with other exploits to achieve...

WordPress Releases Update 6.4.2 to Address Critical Remote Attack Vulnerability

WordPress has released version 6.4.2 with a patch for a critical security flaw that could be exploited by threat actors by combining it with another bug to execute arbitrary PHP code on vulnerable sites. "A remote code execution vulnerability that is not directly exploitable in core; however, the...

CVE-2021-31201

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability Recent assessments: architect00 at June 09, 2021 6:55am UTC reported: This vulnerability is abused in an exploitation chain. According to the Microsoft advisory it is abused with Adobe Acrobat CVE-2021-28550. gwillcox-...