bonesi

BoNeSi BoNeSi , el Simulador de Botnets DDoS, es una herramienta para simular tráfico de botnets en un entorno de pruebas sobre la red. Está diseñado para estudiar el efecto de los ataques DDoS. ¿Qué tráfico se puede generar? BoNeSi genera ataques de inundación ICMP, UDP y TCP HTTP a partir de un...

CVE-2023-23752

CVE-2023-23752 simple program for joomla CVE-2023-23752 scanner, This is a simple Ruby script that checks if a list of targets is vulnerable to CVE-2023-23752, a critical security vulnerability in a web application. The script sends a HTTP GET request to a specified endpoint, and extracts...

AfterLogic Aurora and WebMail Pro < 7.7.9 - Information Disclosure

AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP GET request to WebDAV EndPoint with built-in “caldavpublicuser@localhost” and it’s the predefined password “caldavpublicuser” allows the attacker to read all fil...

SnakeYAML-CVE-2022-1471-POC

SnakeYAML-CVE-2022-1471-POC Código para el blog de veracode Para demostrar la ejecución de código, 1. Construye el proyecto usando maven 2. Ejecuta python3 -m http.server 8080 para iniciar el servidor HTTP 3. Ejecuta exploit.java. Deberías observar una solicitud HTTP GET en el servidor 4. Para...

CVE-2025-24893-PoC

CVE-2025-24893 – Ejecución Remota de Comandos en XWiki Prueba de Concepto Resumen Este repositorio contiene una Prueba de Concepto PoC controlada para CVE-2025-24893 , una vulnerabilidad de Ejecución Remota de Comandos RCE sin autenticación que afecta a XWiki. La vulnerabilidad permite a un...

Grafana-CVE-2021-43798

Grafana-CVE-2021-43798 Grafana File-Read Affected versions: 8.0.0-lastest Poc-http-get /public/plugins/plugins-lst/../../../../../../../../filename Default plugins list alertlist annolist grafana-azure-monitor-datasource barchart bargauge cloudwatch dashlist elasticsearch gauge geomap...

CVE-2018-11776

CVE-2018-11776 Investigation of CVE-2018-11776 vulnerability that allows attackers to remotely execute code and gain control over Apache Struts-based applications. Install and Exploiting https://github.com/hook-s3c/CVE-2018-11776-Python-PoC Suricata In the file "test.rules " presents a rule for t...

CVE-2024-51428-PoC

CVE-2024-51428 - ZoneMinder Blind SQL Injection PoC Python wrapper for sqlmap designed to exploit CVE-2024-51428 in ZoneMinder. This tool automates detection and exploitation of a Blind SQL Injection vulnerability while keeping the output clean and focused on useful data. The script hides sqlmap...

CVE-2002-0201

CVE-2002-0201 Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long HTTP GET request, possibly triggering a buffer overflow. Exploit-db publication at https://www.exploit-db.com/exploits/21237/ Securityfocus...

CVE-2004-2271-MiniShare-1.4.1-BOF

CVE-2004-2271 - MiniShare 1.4.1 - BOF References https://nvd.nist.gov/vuln/detail/CVE-2004-2271 Vulnerability MiniShare 1.4.1 has no bounds checking on HTTP GET requests it receives. By sending a long, malformed HTTP GET request, an attacker can perform a buffer overflow and execute arbitrary cod...

Fake_CVE-2020-1350

FakeCVE-2020-1350 This is the source code for a very crude fake CVE-2020-1350 exploit tool, which developed as part of honeypot repository for the SIGRed vulnerability, with the goal of tracking/mapping interest and attempts to use exploits for this critical vulnerability. This project was...

CVE-2019-18655

CVE-2019-18655 módulo metasploit. Desbordamiento de búfer basado en SEH en la aplicación File Sharing Wizard v.1.5.0. Resumen de CVE: File Sharing Wizard versión 1.5.0 está afectado por una vulnerabilidad de desbordamiento de búfer basada en el Manejador de Excepciones Estructuradas SEH. Un...

CVE-2024-10511

CVE-2024-10511 CWE-287: Improper Authentication Summary Schneider Electric PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktop, servers and workstations PowerChute Serial Shutdown v1.2.0.301 and prior...

Http-Asynchronous-Reverse-Shell

Shell inversa asíncrona HTTP/S ✨ Introducción En una era donde sistemas de detección avanzados como IDS, IPS, EDR, AV y firewalls dominan las redes corporativas, evadirlos durante evaluaciones ofensivas de seguridad es un desafío. La mayoría de las shells inversas aprovechan túneles TCP capa 4, q...

CVE-2026-58415

A flaw was found in the moddavfs module of the Apache HTTP Server. A remote attacker can exploit this vulnerability by sending an HTTP GET request directly to the internal WebDAV Web Distributed Authoring and Versioning state directory. This allows unauthorized access to internal state files,...

cve-2026-1731-scanner

CVE-2026-1731 — BeyondTrust RS/PRA Passive Vulnerability Scanner ╔═══════════════════════════════════════════════════════════════╗ ║ ║ ║ CVE-2026-1731 ║ ║ BeyondTrust RS/PRA Passive Vulnerability Scanner ║ ║ ║ ╠═══════════════════════════════════════════════════════════════╣ ║ PASSIVE SCANNER —...

djust has broken object-level access control (IDOR)

Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...

S2-046_S2-045_POC

S2-046POC Usage: ./s2046.sh url ./s2045.sh url Sample: 1. chmod +x ./s2046.sh 2. ./s2046.sh http://172.16.152.135/index.action OUTPUT: ================HTTP GET Method================ uid=0root gid=0root groups=0root context=unconfinedu:unconfinedr:unconfinedjavat:s0-s0:c0.c1023 uid=0root gid=0roo...

CVE-2024-3273-EXPLOIT

CVE-2024-3273 - D-Link Remote Code Execution RCE 💥 A critical vulnerability, classified as CVE-2024-3273, was discovered in several D-Link NAS devices, including DNS-320L, DNS-325, DNS-327L, and DNS-340L, up to the date of 20240403. This vulnerability affects an unknown function of the file...

CVE-2026-100696

Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery SSRF vulnerability in the optional Elasticsearch driver plugins/drivers/elastic.php, fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect before the login result is validated, an...