Audit-BlackBox-Web-to-Root

Pentest Lab : Cadena de explotación web y sistema Drupal to Root Disclaimer Este proyecto se realizó en un entorno de laboratorio controlado y aislado con fines educativos y académicos. No se ha atacado ninguna infraestructura real. El objetivo es aprender a asegurar los sistemas comprendiendo lo...

CVE-2025-4428

CVE-2025-4427 & CVE-2025-4428 Scanner de Vulnerabilidades Herramienta avanzada de detección para identificar sistemas vulnerables a la cadena de explotación CVE-2025-4427 y CVE-2025-4428. Este escáner de seguridad ayuda a identificar endpoints vulnerables y demuestra la explotación de prueba de...

CVE-2021-3129

CVE-2021-3129 使用说明： 注：本地需有php环境 python3 CVE-2021-3129.py -u http://127.0.0.1:80 （只检测poc） python3 CVE-2021-3129.py -u http://127.0.0.1:80 -c whoami （命令执行，默认会遍历所有利用链） python3 CVE-2021-3129.py -u http://127.0.0.1:80 -c whoami -chain laravel/rce1 （如检测到可用利用链可直接选择利用）...

NocoBase 2.0.27 - VM Sandbox Escape

Exploit Title: NocoBase 2.0.27 - VM Sandbox Escape Date: 2026-03-26 Exploit Author: Onurcan Genç Vendor Homepage: https://www.nocobase.com/ Software Link: https://github.com/nocobase/nocobase Version: -u -P --cmd "id" python3 exploit.py -t TARGE...

wendor_labs_exploitation

Wendor Vending Machine Exploitation & Security Research Lab T...

CVE-2026-2471 WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field

The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the BaseModel class constructor calling maybeunserialize on all properties retrieved...

SecLeak

SecLeak Assessment This repository contains the s...

CVE-2025-9191

CVE-2025-9191 — Houzez WordPress Theme PHP Object Injection . The Houzez theme (WordPress) is vulnerable to PHP Object Injection via deserialization in saved-search-item.php for all versions up to 4.1.6. Exploitation requires authenticated access at Subscriber level or higher; a POP chain is not ...

CVE-2025-8871

The Everest Forms Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mimecontenttype function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may ...

PT-2024-39061

Name of the Vulnerable Software and Affected Versions: VICIdial affected versions not specified Description: The issue allows an attacker with authenticated access as an "agent" to execute arbitrary shell commands as the "root" user. This can potentially be chained with other exploits to achieve...

WordPress Releases Update 6.4.2 to Address Critical Remote Attack Vulnerability

WordPress has released version 6.4.2 with a patch for a critical security flaw that could be exploited by threat actors by combining it with another bug to execute arbitrary PHP code on vulnerable sites. "A remote code execution vulnerability that is not directly exploitable in core; however, the...

CVE-2021-31201

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability Recent assessments: architect00 at June 09, 2021 6:55am UTC reported: This vulnerability is abused in an exploitation chain. According to the Microsoft advisory it is abused with Adobe Acrobat CVE-2021-28550. gwillcox-...