CVE-2024-32113-POC

Apache OfBiz vulns POC for CVE-2024-32113 The USERNAME and PASSWORD params can be provided at the /ecomseo/AnonContactus interface, which is publicly accessible to anyone. POC1：RCE curl --noproxy '' -k --location --request POST...

CVE-2021-26084

Confluence Server Webwork Pre-Auth OGNL Injection CVE-2021-26084 Confluence is a web-based corporate wiki developed by Australian software company Atlassian. An OGNL injection vulnerability exists that allows an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data...

chub-supply-chain-poc

Context Hub Supply Chain PoC Zero-sanitization vulnerability inContext Hub @aisuite/chub v0.1.3 enables silent dependency injection through the MCP documentation pipeline. References: CWE-94 Code Injection | CWE-829 Untrusted Control Sphere | CWE-345 Insufficient Verification of Data Authenticity...

CVE-2022-0944

CVE-2022-0944 SQLPad - Template injection This is a blind vulnerability, meaning that the output is directly returned in the response. Exploit Use the script with the following command: python3 exploit.py --url http://localhost:13000 --command 'ls -la /tmp/test' --username admin --password passwo...

CVE-2026-46368-OpenWrt-Exploit

OpenWrt luci-app-https-dns-proxy Authenticated Command Injection CVE-2026-46368 This repository contains the Proof of Concept PoC exploit for a critical OS command injection vulnerability in luci-app-https-dns-proxy that results in arbitrary command execution as root. CVE ID: CVE-2026-46368...

CVE-2022-46169

Cacti v1.2.22: Unauthenticated Command Injection Vulnerability CVE-2022-46169 Based on ariyaadinatha PoC exploit for CVE-2022-46169...

CVE-2023-36845-POC

CVE-2023-36845 PoC Automation Script This script provides an automated Proof of Concept PoC for the vulnerability identified as CVE-2023-36845, which affects the J-Web component of Juniper Networks Junos OS on EX and SRX Series devices. It demonstrates the potential for remote modification of the...

CVE-2022-0739

CVE-2022-0739 My take on CVE-2022-0739 BookingPress exploit, based on destr4ct's POC - just prettier. Example Example usage against HackTheBox's MetaTwo machine, which hosts a WordPress with a vulnerable bookingpress plugin version 1.0.10. python booking-sqlinjector.py -u http://metapress.htb -nu...

Exploit-CVE-2025-24799

Exploit-CVE-2025-24799 CVE-2025-24799 Exploit: GLPI - Unauthenticated SQL Injection Installation git clone https://github.com/MatheuZSecurity/Exploit-CVE-2025-24799 cd Exploit-CVE-2025-24799 pip3 install -r requirements.txt python3 exploit.py -h Join in Rootkit Researchers...

lighty-sqlinj-demo

title: Ep4 - Network-Related Vulnerability members: Ciro S. Costa Marcela Terakado date: 10 Nov, 2015 Related vulnerability: CVE-2014-2323 1 was assigned to SQL injection bug. CVE-2014-2324 2 was assigned to the path traversal bug. Confirm:...

CVE-2025-6018-6019

CVE-2025-6018 CVE-2025-6019 PoC Exploit Local Privilege Escalation LPE - openSUSE / SUSE Linux Enterprise 15 Working PoC/Exploit for CVE-2025-6018 and CVE-2025-6019 - Privilege escalation from unprivileged user to root on openSUSE Leap 15.x and SUSE Linux Enterprise 15.x 🎯 Quick Summary CVE ID|...

CVE-2023-49971

CVE-2023-49971 Customer Support System 1.0 - Cross-Site Scripting XSS Vulnerability in "firstname" field/parameter on "customerlist" Page Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious acto...

CVE-2024-3400

CVE-2024-3400 CVE-2024-3400 : Palo Alto OS Command Injection - Proof of Concept POC Disclamer This is a tool for security engineering and vulnerability assessment teams to quickly verify the existance of the vulnerability on their assets across the environment...

CobaltStrikeScan

CobaltStrikeScan Scan files or process memory for Cobalt Strike beacons and parse their configuration. CobaltStrikeScan scans Windows process memory for evidence of DLL injection classic or reflective injection and/or performs a YARA scan on the target process' memory for Cobalt Strike v3 and v4...

CVE-2025-57819-RCE

FreePBX 16 — Unauthenticated SQLi to RCE Summary: This guide demonstrates how to chain two vulnerabilities in FreePBX 16 CVE-2025-57819 and CVE-2025-61678 to achieve a complete attack chain from unauthenticated access to Remote Code Execution RCE. Vulnerability / CVE Information CVE ID| Affected...

CVE-2024-4577

CVE-2024-4577, Argument Injection in PHP-CGI ./CVE-2024-4577.sh /path/to/domains-list POC : POST /test.hello?%ADd+allowurlinclude%3d1+%ADd+autoprependfile%3dphp://input HTTP/1.1 Host: host User-Agent: curl/8.3.0 Accept: / Content-Length: 23 Content-Type: application/x-www-form-urlencoded...

CVE-2022-1292

CVE-2022-1292 POC Description The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary comman...

CVE-2026-44706

SQL Injection in Chatwoot FilterService A proof-of-concept exploit for CVE-2026-44706, a SQL Injection vulnerability in Chatwoot's FilterServiceltgtfiltervalues that allows any authenticated agent to read the entire PostgreSQL database including user credentials and API tokens. Read the full...

CVE-2026-86218

CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit Overview This is a Python 3 proof-of-concept exploit for CVE-2026-86218, a critical pre-authentication remote code execution vulnerability in N-able N-central. Vulnerability Details: CVE: CVE-2026-86218 CVSS Score: 10.0 Critical CWE: CWE-96...

HiddenDesktop

Hidden Desktop BOF Hidden Desktop often referred to as HVNC is a tool that allows operators to interact with a remote desktop session without the user knowing. The VNC protocol is not involved, but the result is a similar experience. This Cobalt Strike BOF implementation was created as an...