CVE-2022-26134-Godzilla-MEMSHELL

CVE-2022-26134-Godzilla-MEMSHELL Usage java -jar CVE-2022-26134.jar Godzilla Password Godzilla Key example java -jar CVE-2022-26134.jar pass key If the memory shell has been injected successfully but Godzilla cannot connect, please add the following protocol header in the request configuration or...

CVE-2026-4112

SonicWall SMA 8200v: Privilege Escalation via Cross-Parameter Blind SQL Injection Firmware: 12.5.0-02283 Platform Hotfix on 12.5.0-02002 Base SonicWall Advisory 1. Summary A post-authentication blind SQL injection vulnerability in the SonicWall SMA 8200v management console port 8443 allows any...

CVE-2022-21661-Demo

This repository demonstrates a vulnerability in WordPress 5.8.2, in which missing sanitization in class-wp-tax-query.php can, in very specific situations, allow attackers to perform SQL injection. Note that successful exploitation requires developers to add vulnerable code to the WordPress...

ruby-RCE-CVE-2019-5420-

Ruby Deserialization CVE-2019-5420 https://github.com/PenTestical/CVE-2019-5420 References: 1 Ruby on Rails command execution vulnerability payload implementation process https://hackerone.com/reports/473888 Since ActiveSupport::MessageVerifier and ActiveSupport::MessageEncryptor use Marshal as t...

CVE-2017-5638

LAB 1 — Apache Struts2 OGNL Injection CVE-2017-5638 / S2-045 I. SYSTEM ANALYSIS Attack Surface Analysis After starting the container, Struts2 logs show that the application loads familiar configuration files such as struts-default.xml , struts-plugin.xml , and struts.xml. This confirms that the...

wp_bookingpress_1.0.11

CVE-2022-0739 CVE-2022-0739 Wordpress BookingPress Plugin 1.0.11 Unauthenticated SQL Injection Getting Started Executing program With python3 python3 sqli.py -u 'http://wordpress.site' -p 'wpnoncevalue' Help For help menu: python3 sqli.py -h Disclaimer All the code provided on this repository is...

CVE-2024-9326-PoC

CVE-2024-9326 PoC Exploit Script This PoC script is designed to verify the presence of CVE-2024-9326, a high SQL Injection vulnerability in PHPGurukul Online Shopping Portal v2.0. It automates the exploitation process to determine if the target web application is vulnerable, allowing security...

CVE-2023-6063-PoC

CVE-2023-6063 PoC Reference Unauthenticated SQL Injection Vulnerability Addressed in WP Fastest Cache 1.2.2 | WPScan Plugin setting Enable "WP Fastest Cache". PoC The "wordpressloggedin" cookie parameter is vulnerable. $ python sqlmap.py --dbms=mysql -u "http://127.0.0.1/wp-login.php"...

CVE-2024-35468

CVE-2024-35468 Submitter: Kha Do Human Resource Management System 1.0 Vulnerability SQL injection Description SQL injection vulnerability in /hrm/index.php in SourceCodester Human Resource Management System 1.0 allow attackers to execute arbitrary SQL commands via the password parameters. Affecte...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

CVE-2021-39165

CVE-2021-39165 Python3 POC for CVE-2021-39165 in CachetHQ Usage First of all, you should install the dependencies: pip3 install -r requirements.txt If you want to check whether the victim URL is vulnerable or not, you can execute: python3 exploit.py -u -c If you want to know the output of a MySQL...

CVE-2024-23692

Rejetto HFS HTTP File Server CVE-2024-23692 Vulnerability Overview Rejetto HFS HTTP File Server is a simple web file server that facilitates file sharing over a network or the internet. Despite its ease of use and simplicity, a critical vulnerability CVE-2024-23692 has been discovered, making the...

CVE-2022-36446-Webmin-RCE

CVE-2022-36446 — Webmin 1.997 RCE Authenticated Exploit for the Remote Code Execution vulnerability in Webmin versions prior to 1.997, through the Software Package Updates module. How does it work? The Webmin Software Package Updates module does not properly sanitize the u parameter before passin...

CNVD-C-2019-48814-CNNVD-201904-961

CNVD-C-2019-48814和CNNVD-201904-961 Thanks to t00ls-ximcx0101 for providing the script CNVD-C-2019-48814 POC Summary Related links: Qingshui Chuanqi's Jianshu article: https://www.jianshu.com/p/c4982a845f55 Reposted by Security Ancestor: https://dwz.cn/2GQvbUae Due to environment factors, paths ma...

CVE-2022-36162

CVE-2022-36162 Suggested description pdftoroff hovacui 1.1.0 is affected by: Command execution. The impact is: execute arbitrary code local. The component is: hovacui.c, line 1574. The attack vector is: To exploit the vulnerability, you just have to change HOME environment variable, put some...

CVE-2026-23744-POC

Description This vulnerability exists because MCPJam Inspector exposes internal API endpoints intended for debugging and development. These endpoints accept user-controlled input and pass it directly to system-level process execution without proper validation or sanitization. By sending a crafted...

Bughound

What is Bughound? Bughound is an open-source static code analysis tool that analyzes your code and sends the results to Elasticsearch and Kibana to get useful insights about the potential vulnerabilities in your code. Bughound has its own Elasticsearch and Kibana Docker image that is preconfigure...

CVE-2026-63030

CVE-2026-63030: wp2shell WordPress Batch API Desynchronization SQL Injection Exploit Proof of Concept tool for extracting users and password hashes via the CVE-2026-63030 wp2shell vulnerability. Vulnerability Information CVE : CVE-2026-63030 wp2shell Companion CVE : CVE-2026-60137 Type : Pre-Auth...

CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Multiple cross-site scripting XSS vulnerabilites in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data in the Content Manager Menu. Attack Vectors:...

CVE-2023-20110

CVE-2023-20110 PoC script for CVE-2023-20110 - Cisco Smart Software Manager On-Prem SQL Injection Vulnerability Usage 1. Update IP address and admin cookies in script, 2. Run the script with the following command: python3 exploit.py...