CVE-2026-12227

CVE-2026-12227 — Visual Composer Website Builder Unauthenticated LFI Python 3 PoC for CVE-2026-12227 Wordfence: Local File Inclusion via the vcv-template query parameter in Visual Composer Website Builder visualcomposer on wordpress.org. | ---|--- Platform| WordPress plugin Component| Visual...

BGGP

Binary Golf Grand Prix This repo contains files for the Binary Golf Grand Prix, sorted by year. BGGP is an annual small file competition, with players creating the smallest possible files that perform a specified function. Files can be no greater than 4096 bytes. Year| Theme| Description...

SauronEye

SauronEye SauronEye is a search tool built to aid red teams in finding files containing specific keywords. Features : Search multiple network drives Search contents of files Search contents of Microsoft Office files .doc, .docx, .xls, .xlsx Find VBA macros in old 2003 .xls and .doc files Search...

CVE-2026-41545 WebSocket timelapse path traversal and command injection

A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version:...

Malicious code in py-sock2 (PyPI)

Source: kam193 317abc5a9c1b535f3db6fd260a2f77eaaceb45745cd93deea7e9b3dd1d0cb933 The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in py-worm (PyPI)

Source: kam193 d4c5838f30da7c1f684305ec0704ef37e963793449390f5b13a4e06212ccbd9d The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

VeeamDumper-BOF

Veeam Dumper BOF A credential extraction BOF for Veeam Backup and Replication and Veeam One by Stephen Munro and Logan Kroeger from @MWRCyberSec. The BOF needs to be executed in an Admin beacon on either a Veeam One or Veeam Backup and Replication server and supports Cobalt Strike and Outflank C2...

phpMussel

What is phpMussel? An ideal solution for shared hosting environments, where it's often not possible to utilise or install conventional anti-virus protection solutions, phpMussel is a PHP script designed to detect trojans, viruses, malware and other threats within files uploaded to your system...

CVE-2024-28995

CVE-2024-28995 Disclaimer This tool is only for personal security research and learning. Any direct or indirect consequences and losses caused by the dissemination or use of this tool are the responsibility of the user. The tool author assumes no responsibility. version = 15.4 NAME: Serv-U -...

INPGer

INPGer | CVE-2022-4063 - InPost Gallery Automatic Mass Tool for checking vulnerability in CVE-2022-4063 - InPost Gallery install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How To Use bash inpger.sh yourlist.txt thread Reference...

CVE-2019-13288-POC

CVE-2019-13288-POC xpdf/install/bin/pdftotext ./poc.pdf In Xpdf 4.01.01, the Parser::getObj function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646...

Pentest-Collaboration-Framework

Pentest Collaboration Framework Pentest Collaboration Framework - an opensource, cross-platform and portable toolkit for automating routine processes when carrying out various works for testing! Explore the docs » ‼️ Important Links Links | ---|--- 📖Installation Guide | 🌐Wiki 🚀Releases 💬Telegram...

CVE-2019-5418

CVE-2019-5418 1. Vulnerability Description Ruby on Rails is a web application framework, a relatively newer web application framework built on the Ruby language. This vulnerability is mainly caused by Ruby on Rails using the render file method with a specified parameter to render views outside th...

apxutil

A tool to manipulate Schneider Electric PLC archive files This tool can extract and reassemble PLC "archive" files, used by several Schneider Electric PLC:s, including at least M580, M340 and Quantum. The archive files with an extension of .sta are really a zip archive containing a few files...

CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-

CVE-2025-8088 WinRAR Proof of Concept PoC-Exploit This repository contains a Proof of Concept PoC script for CVE-2025-8088 , a path traversal vulnerability in WinRAR versions up to 7.12. This PoC demonstrates how attackers could exploit the vulnerability to place malicious files outside the...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 Reflected SVG XSS Reflected Cross-Site Scripting XSS via SVG Rendering in FuguHub https://vulners.com/cve/CVE-2025-65790 This repository documents a Reflected Cross-Site Scripting XSS vulnerability in FuguHub 8.1 , where SVG files containing inline JavaScript are...

CVE-2021-40978

CVE-2021-40978 mkdocs built-in dev-server directory traversal exploitation Mkdocs 1.2.2 allows directory traversal through the built-in dev-server which responds on port 8000. There is below some examples of successfully exploited paths: Impact Using this tecnique it is possible to fetch files...

CVE-2022-1388

CVE-2022-1388 Nuclei Template for CVE-2022-1388. I have used the shadow file for poc , you can use the passwd '/etc/passwd' file as well. Change the Extractor according to your choice. POC Reference: https://support.f5.com/csp/article/K23605346...

CVE-2025-24104

CVE-2025-24104 Writeup: Reading Files Out-of-Sandbox I reported a bug that Apple later tracked as CVE-2025-24104. In my original report, I demonstrated how a malicious backup could be used to bypass sandbox restrictions. However, Apple’s initial description stated that this vulnerability could le...

outis

outis outis is a custom Remote Administration Tool RAT or something like that. Think Meterpreter or Empire-Agent. However, the focus of this tool is neither an exploit toolkit there are no exploits nor persistent management of targets. The focus is to communicate between server and target system...