CVE-2026-37064

CVE-2026-37064 User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user...

Imperva_gzip_WAF_Bypass

Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...

SSI-CVE-2022-21661

SSI-CVE-2022-21661 Information System's Security 2nd Assignment Study and exploit the vulnerability CVE-2022-21661 that allows SQL Injections through plugins POST requests to WordPress versions below 5.8.3. Configuring the environment To start and configure the environment, you should just run:...

CVE-2024-22939

target:https://github.com/sunkaifei/FlyCms version: v1.0 FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /system/article/categoryedit Poc history.pushState'', '', '/' Success:...

CVE-2023-42793

CVE-2023-42793 - TeamCity Admin Account Creation lead to RCE use exploit.py first to creat administrator account for you and then use rce.py to execute commands on the target, and for reverse shell check this exploit script Description This script exploits CVE-2023-42793 to create an admin accoun...

CVE-2022-1040

CVE-2022-1040 may the poc with you 外面捡来的 curl --insecure -H "X-Requested-With: XMLHttpRequest" -X POST 'https://x.x.x.x/userportal/Controller?mode=8700&operation=1&datagrid=179&json="🦞":"test"'...

react2shell

React2Shell - CVE-2025-55182 Exploit PoC A proof-of-concept exploit for CVE-2025-55182, a critical Remote Code Execution vulnerability in Next.js applications using React Server Components. ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY. ❌ DO NOT use against system...

netwave-dosvulnerability

Netwave IP Camera server vulnerable to unauthenticated Denial of Service via one single huge POST request on any firmware. CVE| Description ---|--- CVE-2018-6479| Unauthenticated remote Denial of Service vulnerability CVSS| Score| Details ---|---|--- 3| 7.3|...

CVE-2024-40498

CVE-2024-40498 Affected Application online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced Description The file register.php handles user registration. At line 117, the POST parameters "$address1" and $address2" are unsanitized, unlike the e-mail,...

CVE-2023-28432

MinIO vulnerability exploit CVE-2023-28432 Description This python3 script is designed to exploit CVE-2023-28432, which potentially affects certain MinIO server configurations. The script makes a POST request to a specified hostname, attempting to retrieve sensitive environment variables such as...

fortilogger_arbitrary_fileupload

CVE-2021-3378 | FortiLogger - Unauthenticated Arbitrary File Upload Metasploit Date: 30-01-2021 Exploit Author: Berkan Er [email protected] Vendor Homepage: https://www.fortilogger.com/ Software Link: https://www.fortilogger.com/download Version: 4.4.2.2 Tested on: Windows 10 Enterprise x64...

cve-2026-34473-unauthenticated-dos-zte-routers

CVE-2026-34473: Unauthenticated Denial of Service in ZTE Routers affecting 140K+ devices worldwide 17+ models Technical breakdown of CVE-2026-34473, published from the original disclosure set and firmware-analysis artifacts. Live site:...

Mass-Scanner-CVE-2026-2631

⚡ CVE-2026-2631 Async Mass Checker Private async mass-checker for internal WordPress validation 🚨 Warning This tool performs a destructive validation. It sends a POST request to the target endpoint and may changeshopsecret on vulnerable targets. Use it only on systems you own or are explicitly...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

cve-2022-1040

Environment In Python Environment3.10 It's strongly recommended to use the virtual environment pip3 install baseproxy python3.10 will raise an AttributeError if the version of pyOpenSSLdownloaded with baseproxy is too low. Reinstalling the latest version will fix it. pip3 uninstall pyOpenSSL pip3...

CVE-2022-24707

PoC for CVE-2022-24707 SQL Injection Vulnerability on Puncher plugin. A POST request can be crafted to exploit SQL Injection and leak database contents. This is tested on Anuko Time Tracker 1.20.0.5640. python3 exploit.py --help usage: exploit.py -h --username USERNAME --password PASSWORD --host...

xsssniper

XSSSNIPER xsssniper is an handy xss discovery tool with mass scanning functionalities. Usage: Usage: xsssniper.py options Options: -h, --help show this help message and exit -u URL, --url=URL target URL --post try a post request to target url --data=POSTDATA post data to use --threads=THREADS...

CVE-2024-36401

RCE for CVE-2024-36401 POC for CVE-2024-36401 GeoServer. This POC will attempt to establish a reverse system shell from the targets. Overview POC for CVE-2024-36401: RCE for GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer. This POC is based on the security advisory by phith0n. H...

CVE-2017-9841

phpunit-shell ⭐ a simple python3 script to exploit CVE-2017-9841. the exploit - CVE-2017-9841 ❗ simple script that exploits a remote code execution vulnerability found in PHPUnit before 4.8.28 and 5.x before 5.6.3. makes a post request to the target with user input system commands...

Nagios-Log-Server-2.1.7-Persistent-Cross-Site-Scripting

Nagios-Log-Server-2.1.7-Persistent-Cross-Site-Scripting A stored cross-site scripting XSS in Nagios Log Server 2.1.7 can result in an attacker performing malicious actions to users who open a maliciously crafted link or third-party web page. Nagios Log Server 2.1.7 and older versions are affected...