CVE-2026-26980

CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content API SQL Injection PoC ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Overview CVE-2026-26980 is an unauthenticated SQL Injection vulnerability in TryGhost Ghost CMS Content API. The vulnerable path is...

CVE-2023-1389

Description CVE-2023–1389 is an Unauthenticated Command Injection vulnerability in the TP-Link Archer AX21 WiFi router. A calllback in the country parameter uses the popen function, which is run as root, allowing the attacker to inject arbitrary values through GET or POST requests to the admin...

CVE-2023-32590

CVE-2023-32590 Subscribe to Category = 2.7.4 - Unauthenticated SQL Injection Description The Subscribe to Category plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.7.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2025-26159

CVE-2025-26159 This script may only be used in authorized environments where explicit permission has been granted. The author is not responsible for any misuse, damage, or consequences resulting from the use of this script. This script decodes, filters, and extracts cookies as part of the...

CVE-2026-22599

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-22599 CVE-2026-22599 Strapi 5.33.1 - Strapi I am @abraxasnull. Loopback lab. CVE-2026-22599-Abraxas-Labs.py chdirs into lab/ and runs run.sh. Content-Type Builder write API database-query injection. Yup...

CVE-2022-22954-PoC

CVE-2022-22954 PoC VMware Workspace ONE Access and Identity Manager RCE via SSTI. CVE-2022-22954 - PoC SSTI Usage: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help show this help message and exit -m SETMODE, --mode SETMODE Available modes: shodan | file | manual -i IP,...

MemITM

What's the MemITM tool? The MemITM Mem In The Middle tool has been developped in order to easily intercept "messages" in Windows processes memory. We developped a lot of custom memory interception tools in order to capture network messages before encryption, or IPC messages, and to be able to...

VMInjector

V M I n j e c t o r c 2012 by Marco Batista Licensed under GPLv3 see LICENSE file Overview: VMInjector is a tool designed to bypass OS login authentication screens of major operating systems running on VMware Workstation/Player, by using direct memory manipulation. Description: VMInjector is a to...

CVE-2026-114624

The baserCMS website development framework (versions 5.0.0 to 5.3.2 and 5.4.0 to 5.4.2 ) is vulnerable to PHP object injection . The widget-area entity fails to validate input types, allowing a string submitted via the admin JSON API to be stored unchanged. Subsequent entity reads deserialize thi...

CVE-2024-10354

Source code Petrol pump management software free download | SourceCodester Description SQL Injection vulnerability in sourcecodester Petrol pump management software v1.0, A vulnerability has been found that is rated as high risk, affecting some unknown functionality of the admin\print.php file,...

CSZ-CMS-Stored-XSS---Site-Settings

CSZ CMS Stored XSS v1.3.0 Author: Sergio Description: Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameter in the Site Settings Menu. Attack Vectors: Scripting A vulnerability in the...

CVE-2023-0669

CVE-2023-0669 CVE-2023-0669 GoAnywhere MFT command injection vulnerability...

PSTrojanFile

PSTrojanFile Windows PowerShell Filename and Defender Anti-Malware API - Code Execution POC Discovery: John Page aka hyp3rlinx 2019 and revisted 2023 Updated Dec 24, 2023 Bypassing single quotes obstacle in PowerShell for code exec and bonus PS Windows Event log fail! Semicolon and friend "&"...

CVE-2023-49968

CVE-2023-49968 Customer Support System 1.0 - SQL Injection Vulnerability in managedepartment.php via "id" URL Parameter Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. An attacker with malicious intent can execute SQL commands on the MySQL database ...

vba2clr

TLDR: Just experimenting with different ways to load CLR .NET assemblies on VBA locally and remotely by using AppDomain.ExecuteAssembly or any other handy method after getting arround AccessVBOM programmatic access to visual basic project is not trusted from VBA. vba2clr..vba: Sets AccessVBOM...

CVE-2021-46422

CVE-2021-46422 OS Command Injection in South Korean Wireless Routers Installation git clone https://github.com/kelemaoya/CVE-2021-46422.git cd CVE-2021-46422 pip3 install -r requirements.txt Usage Single URL pocsuite -r ../CVE-2021-46422.py -u url --verify Batch URLs pocsuite -r...

CVE-2019-25024

CVE-2019-25024 OpenRepeater ORP / Unauthenticated Command Injection Advisories: MITRE CVE: https://vulners.com/cve/CVE-2019-25024 US NIST: https://nvd.nist.gov/vuln/detail/CVE-2019-25024 Tenable: https://www.tenable.com/cve/CVE-2019-25024 VulDB: https://vuldb.com/?id.170172 Ubuntu:...

CVE-2020-28243

CVE-2020-28243 A command injection vulnerability in SaltStack's Salt allows for privilege escalation via specially crafted process names on a minion when the master calls restartcheck. For a full writeup please see this blog post Affected Versions: All versions between 2016.3.0rc2 and 3002.2 Link...

WireBug

WireBug WireBug is a tool set for Voice-over-IP penetration testing. It is designed as a wizard which makes it easy to use. The tools are build for single using too, so every tool is its own python or bash program. Installation Read the Installation Guide in the wiki. Tools FullBridge: This is a...

Wordpress-cve-CVE-2022-21661

Wordpress 5.8.2 CVE-2022-21661 Vuln enviroment This enviroment is setup with the Elementor Custom Skin, plugin to test the CVE-2022-21661. to start the enviroment console wp-lab$ ./start.sh To get the admin password get the log from the running container, a new pwd is generated every time the...