CVE-2019-13292-WebERP_4.15

Blind SQL Injection Exploit for WebERP This is a Python3 script that demonstrates an exploit for a Blind SQL Injection vulnerability in WebERP version 4.15, initially discovered by Semen Alexandrovich Lyhin on June 10, 2019. The original exploit can be found here, and further details regarding th...

Log4j-PoC

Proof of Concept for Log4j CVE-2021-44228 Disclaimer This project is only for educational purposes. Introduction This is a proof of concept of the log4j rce adapted from HyCraftHD. Here are some links for the CVE-2021-44228: https://www.lunasec.io/docs/blog/log4j-zero-day...

injection

This repository does not have a README...

php_filter_chain_generator

PHP filter chain generator A CLI to generate PHP filters chain, get your RCE without uploading a file if you control entirely the parameter passed to a require or an include in PHP! Usage Help $ python3 phpfilterchaingenerator.py --help usage: phpfilterchaingenerator.py -h --chain CHAIN --rawbase...

Flangvik

Flangvik C POC for CVE-2021-26855 aka ProxyLogon, supports the classically semi-interactive web shell as well as shellcode in…...

CVE-2022-37203

CVE-2022-37203 CVE-2022-37203 POC Additional Information https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql3.md Vulnerability Type SQL Injection Vendor of Product the development group Affected Product Code Base https://github.com/jflyfox/jfinalcms - JFinal CMS 5.1.0...

CVE-2025-13780

CVE-2025-13780: pgAdmin 4 = 8.14 RCE Scanner A comprehensive vulnerability scanner for CVE-2025-13780 , a Remote Code Execution RCE vulnerability in pgAdmin 4 versions ≤ 8.14. 🔍 Vulnerability Details The vulnerability exists in the Restore feature of pgAdmin 4. The application attempts to block...

CVE-2024-51818

CVE-2024-51818 Fancy Product Designer = 6.4.3 - Unauthenticated SQL Injection Description The Fancy Product Designer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

TeamViewer_Permissions_Hook_V1

TeamViewer Permissions Hook V1 A proof of concept injectable C++ DLL, that uses naked inline hooking and direct memory modification to change TeamViewer permissions. Features As the Server - Enables extra menu item options on the right side pop-up menu. Most useful so far to enable the "switch...

CVE-2025-53770

CVE-2025-53770 This is a scanner for the SharePoint unauthenticated Remote Code Execution vulnerability, assigned CVE number CVE-2025-53770. The code for this was written by reverse-engineering a payload seen in the wild. Use at your own risk, I am not responsible for any negative impact this mig...

CVE-2024-0566

CVE-2024-0566 Smart Manager 8.27.0 - Post-Authenticated SQL Injection Exploit Title: Smart Manager 8.27.0 - Post-Authenticated SQL Injection Date: 2024-01-18 Exploit Author: Ivan Spiridonov - xbz0n Vendor Homepage: https://www.storeapps.org/ Software Link:...

CVE-2025-61304

CVE-2025-61304 "OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address" In the background the ping extension is using the command prompt of Windows to perform the ping. The input field for the Test Target Host is also 1024 chars long. After th...

CVE-2025-22352

1️⃣ Component type WordPress plugin 2️⃣ Component details Component name ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Vulnerable version = 1.4.8 Component slug elex-bulk-edit-products-prices-attributes-for-woocommerce-basic Component link...

globalprotect-ca-cert-ipc

c2us.exe - Launches a command as the running user in the desktop session of the logged on user. In thise case, launches cmd.exe as SYSTEM in the desktop session of the unprivileged user. c2us.c - Source code for c2us.exe. epinject.exe - Entry point injector, used to spawn a new process and inject...

CVE-2024-44542

CVE-2024-44542 Description: todesk v1.1 was discovered to contain a SQL injection vulnerability via the title parameter at /todesk.com/news.html. Vulnerability Type: SQL Injection Vendor of Product: todesk Affected Product Version: todesk - v1.1 Affected Component: todesk.com, news.html Attack...

Demo-Exploit-Jackson-RCE

Demo-Exploit-Jackson-RCE Based on the project jackson-rce-via-spel this project serves as an example web application to test multiple attack vectors file upload, forms on the Jackson-databind vulnerability. Introduction Based on an Angular7 frontend and a spring-boot backend different attack...

CVE-2026-48732-poc

CVE-2026-48732: Warp Remote SSH cwd Command Injection PoC Description This repository contains a Proof of Concept PoC for CVE-2026-48732 , a high severity OS Command Injection vulnerability in Warp legacy SSH background command handling. Affected Warp versions used the remote working directory cw...

CVE-2024-37791

CVE-2024-37791 CVE-2024-37791 Project address: Preparatory work: Log in to the backend - get cookie Vulnerability URL: http://127.0.0.1:8093/s/article/Content/index?classid=&keyword= Vulnerability parameter: keyword payload: %27andselectfromselect+ifasciisubstrdatabase,1,1%3E97,sleep1,0a//union/...

EXPLOIT-CVE-2026-26216

CVE-2026-26216 — Crawl4AI unauthenticated RCE via hooks GHSA-5882-5rx9-xgxp CVSS 10.0 · pre-auth RCE · CWE-94 Code Injection Unauthenticated remote code execution on the Crawl4AI Docker server field. This code is executed with exec inside a "homemade sandbox" — a restricted builtins dictionary...

CVE-2024-51482-ZoneMinder-CCTV-HTB-Reliable-EXP

README Hackthebox Machine: CCTV Application: ZoneMinder Description Performing multiple time-based blind injections for the same character and selecting the most frequent result significantly reduces errors and improves reliability, though it is time-consuming...