xzutils_backdoor_obfuscation

xzutilsbackdoorobfuscation This script recreates the obfuscation technique used for the XZ utils attack CVE-2024-3094. It has been tested for xzutils v5.6.0 only. ⚠️ This code is provided for educational purposes only and should not be used for malicious activities. Use at your own risks. ⚠️...

GLPwn

GLPwn A GLPI hack tool, using Apache directory listing and / or CVE-2020-15175 to dump files and valid sessions. Who is vulnerable? Any GLPI instance that has Apache directory listing already enabled on the /files folder All GLPI instances prior to 9.5.1 running on a default Apache2 server. What...

CVE-2021-43798_exploit

CVE-2021-43798exploit Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 except for patched versions is vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: /public/plugins//, where is the plugi...

CVE-2020-12640

CVE-2020-12640: Local PHP File Inclusion via "Plugin Value" in Roundcube Webmail A Path Traversal vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. Because the "plugins" parameters do not perform sanitization/input filtering, an attacker with access to the Roundcube...

CVE-2025-27136-XXE-LocalS3

CVE-2025-27136 XXE-LocalS3 Proof of Concept for CVE-2025-27136 XXE in Local-S3 └─$ python3 exploit.py http://$ip:8080 /etc/passwd + S3 service detected + Creating bucket: xxe-32d14993 + Server response: ac3aaf20-e59a-4705-9505-3ebb01db7fc1 + Retrieving file via ?location + Response:...

GrafanaDirectoryScanner

PoC for CVE-2021-43798 Grafana is an open-source platform for monitoring and observability. Grafana versions from 8.0.0-beta1 to 8.3.0 except patched versions are vulnerable to directory traversal, allowing access to local files. The vulnerable URL is: /public/plugins//, where is the plugin ID fo...

Ghost-Path-Traversal-CVE-2023-32235-

Bug Bounty Report - Ghost Path Traversal CVE-2023-32235 Summary The Ghost application is vulnerable to a path traversal vulnerability, identified as CVE-2023-32235. This vulnerability allows an attacker to access sensitive files outside the intended directory by manipulating the "package.json" fi...

CVE-2024-52806-PoC

POC for CVE-2024-52596 / CVE-2024-52806 - SimpleSAMLphp pre-auth XXE file read...

CVE-2023-33902_single_file

This repository does not have a README...

SysTracingPoc

SysTracingPoc CVE-2020-0668 - Microsoft Windows Service Tracing Arbitrary File Move Local Privilege Escalation Vulnerability For more information: https://itm4n.github.io/cve-2020-0668-windows-service-tracing-eop/...

enumhandles_BOF

enumhandlesBOF This BOF can be used to identify processes that hold handles to a given file. This can be useful to identify which process is locking a file on disk. Usage Limitations I have found that x86 beacons will crash sometimes when attempting to enumerate handles associated with an x64...

CVE-2024-56064

CVE-2024-56064 WP SuperBackup = 2.3.3 - Unauthenticated Arbitrary File Upload Description The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.3.3. This makes it...

drupal-exploit

drupal-exploit CVE-2018-7600 This script will exploit the CVE-2018-7600 vulnerability in Drupal 7 : drupal.py https://drupaldomain/drupal/ uid=33www-data gid=33www-data groups=33www-data https://nvd.nist.gov/vuln/detail/CVE-2018-7600 https://www.drupal.org/sa-core-2018-002...

WordPress-HT-Contact-CVE-2025-7340-RCE

WordPress HT Contact Form Widget | CVE-2025-7340 File Upload Vulnerability Analysis Vulnerability Location Vulnerability Location: ht-contactform/admin/Includes/Services/FileManager.php Key Function: tempfileupload 1. Main Vulnerability Point: tempfileupload function Line 63 public function...

CVE-2024-21626-POC

CVE-2024-21626-PoC Usage Instructions For educational/research purposes only. Any use unrelated to education/research is at your own risk. Usage docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh 另起一个terminal /bin/bash.copy Note The specific file descriptors used var...

cve-2024-21626

CVE-2024-21626 Overview This repository contains code examples for an app vulnerable to CVE-2024-21626 as well as an eBPF gadget to detect exploitation attempts. This repoistory was created as part of this blog post. The gadget program used to detect this vulnerability is for demonstration purpos...

MoveEdr

MoveEDR If you're admin you can force Windows to delete or move folders and files around immediately after booting before services are started. This can be used to disable EDRs. Usage !CAUTION There is an issue with CrowdStrike which results in a bootloop with the message "INACCESSIBLEBOOTDEVICE"...

CVE-2026-24849

CVE-2026-24849 OpenEMR Authenticated Arbitrary File Read EtherFax disposeDoc Tested on: OpenEMR Version = 7.0.2 Proof-of-concept exploit for CVE-2026-24849 , an authenticated path-traversal / arbitrary file read in OpenEMR's Fax/SMS EtherFax module. Any authenticated user regardless of privilege...

forensicscanner

This repository does not have a README...

SAP-CVE-2025-31324

SAP-CVE-2025-31324 POC A tool to detect and exploit a critical unauthenticated file‐upload vulnerability in SAP NetWeaver Visual Composer. Description SAP NetWeaver Visual Composer includes a component called Metadata Uploader which lacks proper authorization checks, allowing unauthenticated...