Struts2-045-Exp

Struts2 S2-045 CVE-2017-5638 Exp Tools Exp Function: Command Execute Get Target Website's Physical Path File Upload Getshell Default Webshell For Chopper Support HTTP/HTTPS Support URL With Any Port Note: Default Webshell's Password is s2045@exp Notice The Project Is Intended For...

CVE-2025-7766

CVE-2025-7766 PoC Exploit PoC for exploiting XML External Entity vulnerability in CVE-2025-7766. Demonstrates file read /etc/passwd and out-of-band HTTP callbacks. Author : Byte Reaper CVE : CVE-2025-7766 Vulnerability : Remote Code Execution via XML External Entity XXE PoC for exploiting XXE in...

blankspace

Blank Space Blank Space is a refactoring of James Forshaw's original proof of concept for CVE-2021-43893, EFSRPC arbitrary file upload privilege escalation. Blank Space can create arbitrary files on a remote host that is using unconstrained delegation if it isn't patched for CVE-2021-43893. File...

hblock

Improve your security and privacy by blocking ads, tracking and malware domains. What is this for? hBlock is a POSIX-compliant shell script that gets a list of domains that serve ads, tracking scripts and malware from multiple sources and creates a hosts file, among other formats, that prevents...

CVE-2021-43798-grafana_fileread

CVE-2021-43798-grafanafileread If the target is behind a reverse proxy, replace the payload with this one: url1 = url +"/public/plugins/"+str.rstripplugins+"//../..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd" Grafana is a cross-platform, open-source data visualization web application...

CVE-2025-4603

eMagicOne Store Manager for WooCommerce = 1.2.5 - Unauthenticated Arbitrary File Deletion The eMagicOne Store Manager for WooCommerce plugin exposes a remote management protocol endpoint ?connector=bridge that allows file deletion operations on the server. The authentication mechanism relies on a...

Exploit-CVE-2026-18351

Exploit-CVE-2026-18351 Drag and Drop File Upload for Elementor Forms - Unauthenticated Arbitrary File Upload to RCE.🔥 𝘾𝙤𝙣𝙩𝙖𝙘𝙩: 𝙔𝙤𝙧𝙪 يورو 🔥 https://t.me/ChiefYoru — Channel https://t.me/TeamLeets — Group https://t.me/ChiefYoruPoCs...

CVE-2022-30333

A proof of concept for CVE-2022-30333 - a path traversal vulnerability in unRAR versions prior to 6.11. I created this as a demonstration of the exploit for an AttackerKB writeup, and hope to incorporate it in a Metasploit Module soon! Basically, you provide a target including path traversal and...

tryhackme-moniker-link

tryhackme-moniker-link Documentation of my hands-on lab Moniker Link CVE-2024-21413 completed on TryHackMe. Moniker Link CVE-2024-21413 — TryHackMe Lab Overview This repository documents my hands-on study in a TryHackMe room. The goal of this exercise was to understand how the vulnerability works...

DotGit

DotGit An extension for checking if .git is exposed in visited websites Features Check if a .git/.svn/.hg folder exists for each site you visit Check if a .env file exists for each site you visit Check if a .DSStore file exists for each site you visit Check if the site is open source github/gitla...

cve-2020-3452

CVE-2020-3452-Exploit For Educational Purpose ONLY! Just basic exploit abusing CVE-2020-3452 to enumerate the standard files accessible in the Web Directory of CISCO ASA/FTD applicances. Usage: By default this uses a file list constructed from sample output from CVE-2018-0296 in the Metasploit...

Grafana-Plugin-Enumerator-CVE-2021-43798

Grafana CVE-2021-43798 Plugin Enumerator A small Bash-based tool for testing Grafana instances for CVE-2021-43798 , a directory traversal vulnerability affecting vulnerable Grafana versions. The tool enumerates Grafana plugin IDs and uses curl --path-as-is to test whether directory traversal can...

CVE-2022-30190

CVE-2022-30190 Usage Windows only Create docx file: $ PoC.py docx your-host-ip Run server directly: $ PoC.py host...

exploit_cve-2021-29447

exploitcve-2021-29447 For educational purposes only. This exploit is supposed to be really convenient tool to get any file from server running wordpress 5.6.2 and php8. see https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5 All you need is base wp-admin access and ability to...

Diamorphine

Diamorphine Diamorphine is a LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x x86/x8664 and ARM64 Features When loaded, the module starts invisible; Hide/unhide any process by sending a signal 31; Sending a signal 63to any pid makes the module become invisible; Sending a signal 64to any pid...

CVE-2021-29447

Installation and Execution Sequence 0. Run Docker $docker-compose up 1. Execute wordpress.sh Configure the wp-config.php file before installing WordPress. $docker exec -it -u root wordpress /bin/bash -c "/usr/local/bin/wordpress.sh" 2. Install WordPress Access the WordPress site uploaded to the...

CVE-2025-30208-PoC

Disclaimer: The vulnerabilities and reproduction steps described in this article are intended solely for cybersecurity research and educational purposes. No one shall use the information provided in this article for illegal purposes or unauthorized system testing. The author assumes no...

CVE-2023-38831-winrar-exploit

CVE-2023-38831 winrar exploit generator Quick poc test Generate the default poc for test python cve-2023-38831-exp-gen.py poc or python cve-2023-38831-exp-gen.py CLASSIFIEDDOCUMENTS.pdf script.bat poc.rar Custom 1. Place the bait file and evil script file in the current directory, the bait file i...

CVE-2024-0406-POC

CVE-2024-0406 Proof of Concept PoC This repository contains a Proof of Concept PoC exploit for CVE-2024-0406 , a vulnerability involving symlink-based tar archive extraction that allows for path traversal or file overwriting in affected systems. More Details at Path Traversal in mholt/archiver...

Atom-CMS-2.0---File-Upload-Remote-Code-Execution-Un-Authenticated-POC

Atom-CMS-2.0---File-Upload-Remote-Code-Execution-Un-Authenticated- Remote Code Execution RCE Exploit Author: Ashish Koli Shikari Vendor Homepage: https://thedigitalcraft.com/ Software Link: https://github.com/thedigicraft/Atom.CMS Version: 2.0 CVE: CVE-2022-25487 About this: This script uploads...