CVE-2019-11224

Modero AMX Code Execution CVE-2019-11224 This repo contains a few sources about CVE-2019–11224 https://link.medium.com/zukA0oCnV8 because I noticed that the link no longer works on the official NIST website. Modero AMX devices are essentially touch panel devices for meeting rooms, they can be...

CVE-2024-12270

CVE-2024-12270 Beautiful Taxonomy Filters = 2.4.3 - Unauthenticated SQL Injection Description The Beautiful taxonomy filters plugin for WordPress is vulnerable to SQL Injection via the 'selects0term' parameter in all versions up to, and including, 2.4.3 due to insufficient escaping on the user...

CVE-2023-23488-PoC

CVE-2023-23488-PoC Unauthenticated SQL Injection - Paid Memberships Pro 2.9.8 WordPress Plugin Running this script against a WordPress instance with Paid Membership Pro plugin tells you if the target is vulnerable. As the SQL injection technique required to exploit it is Time-based blind, instead...

CVE-2019-9053

CVE-2019-9053 Exploit - CMS Made Simple Unauthenticated SQL Injection SQLi An exploit script for CVE-2019-9053 , a critical unauthenticated SQL injection SQLi vulnerability in CMS Made Simple versions 2.2.9 and below. This tool leverages time-based SQL injection to extract admin credentials...

CVE-2026-14459-14460-pardus-software

Pardus Software Center — Local Privilege Escalation CVE-2026-14459 & CVE-2026-14460 Proof-of-concept and exploit-ready code for two local privilege escalation issues in the pardus-software package Pardus Software Center version 1.0.4 , both fixed in 1.0.5. CVE| Class| Summary| CVSS 3.1 CERT-TR...

NoFaxGiven

NoFaxGiven - Code Execution & Persistence in NETWORK SERVICE FAX Service A fax routing extension is a DLL that adds routing functionality to the fax service. Multiple fax routing extensions can reside on one server. When the fax server receives a fax transmission, it routes the received document...

CVE-2025-11391

Unauthenticated Blind SQL Injection in PPOM for WooCommerce = 33.0.15 This repository contains a Proof of Concept PoC for an unauthenticated time-based blind SQL Injection vulnerability in the "PPOM for WooCommerce" WordPress plugin, affecting versions up to and including 33.0.15. Vulnerability...

CVE-2026-36670

CVE-2026-36670 A time-based blind SQL injection exploit for the OpenSIPS Control Panel. This exploit abuses an authenticated sql injection vulnerability within the aliasmanagement.php module of opensips. The table GET parameter is improperly sanitized, allowing an attacker to inject a crafted...

log4j-quick-scan

log4j-quick-scan Scan your IP network and determine hosts with possible CVE-2021-44228 vulnerability in log4j library. There are far better and advanced tools for security audit, but many of them requires commercial penetration software or external, 3rd party service or software. This script is...

CVE-2026-25643-Frigate-RCE

CVE-2026-25643: Frigate NVR = 0.16.3 Authenticated RCE Exploit Title: Frigate NVR = 0.16.3 - Authenticated Remote Code Execution Date: 2026-02-05 Exploit Author: jduardo2704 Vendor Homepage: https://frigate.video/ Software Link: https://github.com/blakeblackshear/frigate Version: = 0.16.3 CVE:...

CVE-2026-2035703-x300

CVE-2026-2035703: Tozed ZLT X300 5G CPE — Remote Root Code Execution via SDR Rogue Base Station Status: Under coordinated disclosure 90-day embargo Discovered: 2026-08-08 Researcher: Muhammad Nadeem Danish danish1162 CVE ID: CVE-2026-2035703 Severity: Critical CVSS 9.8 CWE: CWE-78 OS Command...

cve-2024-3400

cve-2024-3400 Python exploit and checker script for CVE-2024-3400 Palo Alto Command Injection and Arbitrary File Creation root@kitploit: usage: cve-2024-3400.py -h exploit,check ... CVE-2024-3400 - Palo Alto OS Command Injection positional arguments: exploit,check Available modules exploit Exploi...

log4j

Log4J Zero-Day Compilation of log4j OSINT findings, including Detection, Attack Surface, Mitigation, IoCs. I. Overview Summary This vulnerability makes it possible for any attacker who can inject text into log messages or log message parameters into server logs to load code from a remote server...

CVE-2025-55182_full_exploit

CVE-2025-55182fullexploit this repo have CVE-2025-55182 full exploit with RCE Step to run the exploit 1. Install Dependencies pip install -r requirements.txt 2. Run exploit python3 exploit.py targetlist.txt "command"...

CVE-2025-3248

CVE-2025-3248 Exploit Tool Documentation Introduction This tool is used to exploit the CVE-2025-3248 vulnerability a Python-based code injection vulnerability to achieve remote command execution RCE on the target server by crafting malicious payloads. The vulnerability exists in a web application...

CVE-2025-46181-XSS

CVE-2025-46181 - Reflected XSS in an Online Appointment Booking System CVE-ID : CVE-2025-46181 Discovered by : Shemkumar P shemkumar.github.io Vulnerability Type : Reflected Cross-Site Scripting XSS Severity : Medium Status : Disclosed, CVE Assigned by MITRE ✨ Description A Reflected Cross-Site...

CVE-2024-41997

Warp Terminal RCE CVE-2024-41997 Command injection via unsanitized warp:// URI scheme handler. Full writeup at 0day.gg. Summary...

CVE-2024-24142

CVE-2024-24142: School-Task-Manager-System-SQL-Injection-2 Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/School-Task-Manager-System/CVE-2024-24142.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-24142/blob/main/CVE-2024-24142.md...

CVE-2025-26056

CVE-2025-26056 Auhtor: Rohan Deshpande OS Command Injection Summary OS command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a host operating system via a vulnerable application. This can lead to unauthorized access, data breaches, and system...

CVE-2024-22890

CVE-2024-22890: My e-Diary App - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22890.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-22890/blob/main/CVE-2024-22890.md...