CVE-2019-15107

CVE-2019-15107 Webmin RCE Failed to change password : The current password is incorrectuid=0root gid=0root groups=0root python usage: python CVE201915107.py https://10.10.20.166:10000 cmd C:\Users\CTF\Desktoppython CVE201915107.py https://10.10.20.166:10000 id |\ /| ...

CVE-2025-69213

CVE-2025-69213: OpenSTAManager has a SQL Injection in ajaxcomplete.php getsedi endpoint Overview Field| Details ---|--- CVE ID| CVE-2025-69213 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: fetchArray$q; Data Flow 1. Source...

CVE-2024-3094-info

CVE-2024-3094-info https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - Lasse Collin response https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...

D-Link

CVE-2024-10914 D-Link Remote Code Execution RCE D-Link NAS- Command Injection via Name Parameter CVE-2024-10914:- A vulnerability was found in D-Link DNS-320, DNS- 320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgiusera...

CVE-2026-38192

pluck-CMS-4.7.20-code-injection-vulnerability In admin.php, the moduleaddtosite function iterates through the entire $POST array, splits the user-controllable parameter names using explode'|', ... and directly concatenates them into data/settings/themes//moduleconf.php. This file will subsequentl...

CVE-2024-4040-CrushFTP-server

CVE-2024-4040-CrushFTP-server CrushFTP is a proprietary multi-protocol, multi-platform file transfer server. CVE-2024-4040 - A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read any...

CVE-2025-69214

CVE-2025-69214: OpenSTAManager has a SQL Injection in ajaxselect.php componenti endpoint Overview Field| Details ---|--- CVE ID| CVE-2025-69214 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: !imagehttps://a...

CVE-2025-42957-SAP-S-4HANA-Under-Siege

CVE-2025-42957-SAP-S-4HANA-Under-Siege 1 – What Happened? In August 2025, SAP’s flagship ERP platform S/4HANA was found to expose a vulnerability in one of its RFC‑enabled function modules. Attackers who possess only low‑privileged access can inject arbitrary ABAP code into that module, bypassing...

GL.iNet-Multiple-Vulnerabilities

GL.iNet Multiple Vulnerabilities This repository contains the exploits of the following vulnerabilities: CVE-2023-46454: In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality...

CVE-2019-11581

Atlassian Jira unauthenticated template injection CVE-2019-11581 I Building 1. Bug versions 4.4.x 5.x.x 6.x.x 7.0.x 7.1.x 7.2.x 7.3.x 7.4.x 7.5.x 7.6.x before 7.6.14 the fixed version for 7.6.x 7.7.x 7.8.x 7.9.x 7.10.x 7.11.x 7.12.x 7.13.x before 7.13.5 the fixed version for 7.13.x 8.0.x before...

-CVE-2023-43340-Evolution-Reflected-XSS---Installation-Admin-Options

Evolution CMS Reflected XSS v3.2.3 Author: Sergio Description: Multiple Cross-site scripting XSS reflected vulnerabilities in the evolution v.3.2.3 installation process Admin options allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the cmsadmin,...

reverse-captcha-eval

Reverse CAPTCHA: Evaluating LLM Susceptibility to Invisible Unicode Instruction Injection An evaluation framework that tests whether large language models follow invisible Unicode-encoded instructions embedded in otherwise normal-looking text. Where traditional CAPTCHAs exploit tasks humans can...

DarkWidow

DarkWidow A Customizable Dropper Tool targeting Windows. Honourable Mentions: 1. BlackHat Asia, 2024 - Call For Tools 2. BlackHat USA, 2024 - Call For Tools 3. BlackHat SecTor, 2024 - Call For Tools 4. BlackHat Europe, 2024 - Call For Tools 5. Wild West Hacking Fest 2024 - Arsenal Thanks a lot to...

CVE-2021-46073

CVE-2021-46073 Exploit Title: Vehicle Service Management System - 'User List' Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-46073 CVSS: 4.8 MEDIUM References: https://www.plsanu.com/vehicle-service-management-system-user-list-stored-cross-site-scripting-xss...

cPanelSniper

cPanelSniper CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection 4-stage exploit chain · Interactive WHM Shell · Bulk scanner · Pipeline ready · stdlib only Overview cPanelSniper is a focused exploitation framework for CVE-2026-41940 , a critical authentication...

Fastjson-1.2.47-rce

Fastjson-1.2.47-rce version1.2.51 Remote Command Execution 1.2.24 "b":"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://localhost:1099/Exploit", "autoCommit":true Unknown version between 1.2.24-41...

exploit-CVE-2022-24780

iTop RCE via SSTI - CVE-2022-24780 exploit iTop --debug exploit.rb light --debug exploit.rb -h | --help full: exploit with an emulated browser, execute JavaScript, preserve original user profile information light: just parse HTML and send requests, no JavaScript, DESTRUCTIVE reset user informatio...

CVE-2026-42203

LiteLLM CVE-2026-42203 PoC Usage Instructions This document explains how to start a local LiteLLM environment and run CVE-2026-42203.py to verify the /prompts/test SSTI vulnerability. Only use in a local experimental environment that you are authorized to test. Do not point the script at...

cve-2026-82222-poc

CVE-2026-82222 Unauthenticated PHP object injection to RCE in GiveWP & % in the command; spaces become $IFS. Pass a form id if discovery misses. Pass -g if the script cannot find an enabled gateway. The donation request often returns HTTP 500 or times out. That is expected. The session write...

ABO.CMS-EXPLOIT-Unauthenticated-Login-Bypass-CVE-2024-25227

ABO.CMS-EXPLOIT-Unauthenticated-Login-Bypass-CVE-2024-25227 CVE-2024-25227 Exploit CVE-2024-25227 is a ABO.CMS 5.8 SQLi vulnerability found in the parameter "tblogin" PoC: POST /login.aspx HTTP/1.1 Host: localhost Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...