drupal-jsonapi-sqli-scanner

CVE-2026-9082 — Drupal PostgreSQL SQL Injection Mass Scanner & Exploitation Tool Unauthenticated SQL Injection in Drupal Core PostgreSQL JSON:API filter array key injection via PDO placeholder name abuse Overview CVE-2026-9082 is a Highly Critical SQL injection vulnerability in Drupal Core...

CVE_Prioritizer

CVE Prioritizer CVE Prioritizer is a powerful tool that helps you prioritize vulnerability patching by combining CVSS, EPSS, CISA's Known Exploited Vulnerabilities and VulnCheck's community resources NVD++, KEV. It provides valuable insights into the likelihood of exploitation and the potential...

SploitScan

SploitScan 📜 Description SploitScan is a powerful and user-friendly tool designed to streamline the process of identifying exploits for known vulnerabilities and their respective exploitation probability. Empowering cybersecurity professionals with the capability to swiftly identify and apply kno...

CVE-2026-6875-PoC-Exploit

CVE-2026-6875 - ServiceNow Pre‑Auth RCE Exploit Framework & PoC Verifier ServiceNow AI Platform — JavaScript Injection → Sandbox Escape → RCE → Root Privesc Exploit Framework & Safe Verifier For authorized security testing only. Legal Disclaimer & Responsible Use This tool is provided for...

fleet-cve-scanner

fleet-cve-scanner An open-source, single-script CVE scanner for RMM-managed fleets. Pure PowerShell 7, no agents, no appliances, no license fees. It answers one question for every piece of software on every endpoint you manage: is the installed version known to be vulnerable, and how urgent is it...

CVE-2025-8875-CVE-2025-8876

CVE-2025-8875 & CVE-2025-8876 How does this detection method work? Version detection template - anything running 2025.3.1.9 or older is considered vulnerable to CVE-2025-8875 & CVE-2025-8876 How do I run this script? 1. Download Nuclei from here 2. Copy the template to your local system 3. Run th...

Cisa-KEV-Threat-Intel-Orchestrator

CISA KEV Threat Intel Orchestrator Zero-touch pipeline that turns newly weaponized CVEs from the CISA Known Exploited Vulnerabilities KEV catalog into production-ready Sigma detection rules, automatically, every week. The problem Manually turning a new KEV entry into a usable detection is slow:...

CVE-2026-60206-PoC-Exploit

CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework-Toolkit Oracle WebLogic Server — SAML Authentication Bypass → Admin Takeover Exploit Framework & Mass Scanner For authorized security testing only. ⚖️ Legal Disclaimer & Responsible Use This tool is provided for educational and...

CISA-KEV

CISA-KEV Executive Summary This repository provides automated tracking and analysis of both CISA's KEV and VulnCheck KEV catalogs, cross-referenced with Nuclei security templates and public proof-of-concept exploits. By integrating VulnCheck KEV, coverage expands from 1,557 to 4,720 total unique...

CVE-2026-15409-15410-Framework

1 CVE-2026-15409 | 2 CVE-2026-15410 SonicWall SMA1000 - SSRF → Erlang RCE → Root Privesc Exploit Framework & Safe Detection Tool ! Ethical Use Only - Authorized Tests This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized acces...

CVE-2026-50751---Check-Point-IKEv1-Authentication-Bypass-Exploit

CVE-2026-50751 - Check Point IKEv1 Authentication Bypass Exploit ⚠️ IMPORTANT WARNING This code is ONLY for educational purposes and authorized security testing. Unauthorized use against systems without explicit permission is ILLEGAL. The author is not responsible for the misuse of this tool. 📋...

CrushFTP VFS - Sandbox Escape LFR

VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox. id: CVE-2024-4040 info: name: CrushFTP VFS - Sandbox Escape LFR author: DhiyaneshDK,pussycat0x severity:...

Skype for Business 2019 (SfB) - Blind Server-side Request Forgery

Skype Pre-Auth Server-side Request Forgery SSRF vulnerability id: CVE-2023-41763 info: name: Skype for Business 2019 SfB - Blind Server-side Request Forgery author: hateshape severity: medium description: | Skype Pre-Auth Server-side Request Forgery SSRF vulnerability impact: | Unauthenticated...

SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass

SimpleHelp = 5.5.15 and 6.0 pre-release contain an authentication bypass caused by lack of cryptographic signature verification in OIDC tokens, letting remote unauthenticated attackers gain technician sessions, exploit requires OIDC authentication configured. id: CVE-2026-48558 info: name:...

Mingsoft MCMS v5.2.7 - SQL Injection

Mingsoft MCMS v5.2.7 contains an SQL injection vulnerability via /cms/content/list that allows unauthenticated attackers to execute arbitrary SQL commands on the affected database server. id: CVE-2022-26585 info: name: Mingsoft MCMS v5.2.7 - SQL Injection author: ritikchaddha severity: critical...

WP Hotel Booking < 1.10.4 - PHP Object Injection

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpresshotelbooking1 cookie in load in includes/class-wphb-sessions.php. id: CVE-2020-29047 info: name: WP Hotel Booking 1.10.4 - PHP Object...

UniFi OS - Authentication Bypass via Path Traversal (..%2f)

UniFi OS devices contain an improper access control vulnerability caused by insufficient authorization checks, letting network attackers make unauthorized system changes, exploit requires network access. id: CVE-2026-34908 info: name: UniFi OS - Authentication Bypass via Path Traversal ..%2f...

F5 BIG-IP - Unauthenticated RCE via AJP Smuggling

CVE-2023-46747 is a critical severity authentication bypass vulnerability in F5 BIG-IP that could allow an unauthenticated attacker to achieve remote code execution RCE. The vulnerability impacts the BIG-IP Configuration utility, also known as the TMUI, wherein arbitrary requests can bypass...

PHPSHE 1.7 - SQL Injection

A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication. id: CVE-2019-9762 info: name: PHPSHE 1.7 - SQL Injection author: DhiyaneshDK severity: critical description: | A SQL Injection was...

Apache Struts 2.0.0-2.5.25 - Remote Code Execution

Apache Struts 2.0.0 through Struts 2.5.25 is susceptible to remote code execution because forced OGNL evaluation, when evaluated on raw user input in tag attributes, may allow it. id: CVE-2020-17530 info: name: Apache Struts 2.0.0-2.5.25 - Remote Code Execution author: pikpikcu severity: critical...