PoCForCVE-2015-1528

This PoC is divided into three Parts, the folder mediaserver help to inject code into mediaserver from a normal application. the folder surfaceflinger help to inject code to surfaceflinger after you got mediaserver permission. the folder systemserver help to inject code to systemserver after you...

Inject-PHP-to-JPG-Using-Jhead

Inject-PHP-to-JPG-Using-Jhead $ pkg install vim or apt-get install vim $ pkg install jhead or apt-get install jhead $ jhead -h for help $ jhead -purejpg yourfiles.jpg $ jhead -ce yourfiles.jpg Click ESC typed :x to save $ jhead yourfiles.jpg Example : site.com/youfiles.php?cmd=Command Here...

cve-2020-24616-poc

cve-2020-24616-poc cve-2020-24616 poc The first poc written by a Java rookie Referenced many JNDI injection Pocs...

CVE-2021-40303

CVE-2021-40303 perfex crm 1.10 is vulnerable to Stored Cross Site Scripting XSS via /clients/profile. poc: POST /clients/profile HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664; rv:78.0 Gecko/20100101 Firefox/78.0 Accept:...

CVE-2024-4577-RCE

PHP CGI Argument Injection CVE-2024-4577 RCE 📜 Description In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command...

CVE-2024-53255

CVE-2024-53255 boid CMS 2.1.1 - reflected Cross-Site Scripting XSS Description: A reflected XSS vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code Steps to exploit: 1- Login to the CMS and Navigate to the delete...

Mailcow-CVE-2022-31245

Mailcow CVE-2022-31245 CVE-2022-31245: RCE and Domain Admin privilege escalation for Mailcow. Including POC. Reported and fixed: 2022-05 Patched Version: https://github.com/mailcow/mailcow-dockerized/releases/tag/2022-05d CVE: https://vulners.com/cve/CVE-2022-31245 CVE-2022-31245: Command...

CVE-2024-55988

CVE-2024-55988 Navayan CSV Export = 1.0.9 - Unauthenticated SQL Injection Description The Navayan CSV Export plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

CVE-2025-52688

CVE-2025-52688 Affected Products Alcatel AP13161 - Enterprise WIFI access point Summary There are 2 main vulnerabilities being addressed here: Lack of input sanization on multiple JSON web parameters that allows malicious characters such as ; to be injected to caused a command injection attack La...

XSScope

Go beyond the alert XSScope is one of the most advanced GUI Framework for XSS Clientside attacks. It can perform different XSS attack and HTML Injection in real time. Features Perform XSS botnet attacks. Every victim who is affected by XSS payload in the webserver, will contantly bind the payload...

DjVul_StringAgg

Django CVE-2020-7471 SQLi CVE-2020-7471: Potential SQL injection via StringAggdelimiter django.contrib.postgres.aggregates.StringAgg aggregation function was subject to SQL injection, using a suitably crafted delimiter. RUN python manage.py makemigrations python manage.py migrate python manage.py...

WCE

wce Wce is a powerful Hash injection tool. It can not only be used for Hash injection, but also directly retrieve plaintext or Hash. This tool is available in 32-bit and 64-bit versions. help Parameter description: l 列出登录的会话和NTLM凭据（默认值）； s 修改当前登录会话的NTLM凭据 参数：:::； r...

CVE-2025-55182_full_exploit

CVE-2025-55182fullexploit this repo have CVE-2025-55182 full exploit with RCE Step to run the exploit 1. Install Dependencies pip install -r requirements.txt 2. Run exploit python3 exploit.py targetlist.txt "command"...

CVE-2024-51482-PoC

CVE-2024-51482-PoC Authenticated time-based blind SQL injection exploit for ZoneMinder v1.37. = 1.37.64 Overview This is a proof-of-concept exploit for CVE-2024-51482, a time-based blind SQL injection vulnerability in ZoneMinder's event management functionality. The exploit requires authenticatio...

Privilege-escalation-ASKEY

Privilege-escalation-ASKEY-Router-RTF3505VW-N1 CVE-2022-47040 Privilege escalation vulnerability on ASKEY routers Device: ASKEY RTF3505VW-N1 Firmware: BRSVg000R3505VMN1001s327 not tested in other version CLI Version: ReducedCLIHGUv13 Exploit: ASKEY RTF3505VW-N1 devices are provided with access...

aco-prompt-shield

aco-prompt-shield 🛡️ Stop prompt injection attacks before they reach your LLM — zero API costs, runs entirely locally, integrates in 2 minutes. Prompt injection is the 1 security risk for LLM applications. aco-prompt-shield catches known jailbreak patterns, understands semantic intent via ML, and...

CVE-2024-6670

CVE-2024-6670 PoC for Progress Software WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability CVE-2024-6670 A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/progress-whatsup-gold-sqli-cve-2024-6670/ Usage python CVE-2024-6670.py...

CVE-2024-12986

CVE-2024-12986 Scanner and Exploit This repository contains a scanner and exploit for the CVE-2024-12986 vulnerability, which is a command injection vulnerability in the apmcfgupptim endpoint of DrayTek Gateway Devices. The vulnerability allows an attacker to execute arbitrary commands on the...

CVE-2026-2035703-x300

CVE-2026-108576: Tozed ZLT X300 5G CPE — Remote Root Code Execution via SDR Rogue Base Station Status: Published — coordinated disclosure via CISA ICS and CERT/CC Discovered: 2026-08-08 Researcher: Muhammad Nadeem Danish danish1162 CVE ID: CVE-2026-108576 assigned by VulDB CNA, published on cve.o...

Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Html-Injection

CVE-2021-46079 Exploit Title: Vehicle Service Management System - 'Multiple' File upload Leads to Html Injection Exploit Author: SANU P.L CVE: CVE-2021-46079 CVSS: 7.2 HIGH References: https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-html-injection...