CVE-2026-55579

CVE-2026-55579 — Pheditor Hardcoded Default Password RCE -critical TL;DR: Pheditor all versions ships with a hardcoded default administrator password admin embedded in its source code. There is no forced password change on first login, only a visual warning. Any unauthenticated attacker can log i...

coldfusion-10-11-xss

ColdFusion 10.x 11.x XSS - RCE PoC Exploits This repo contains XSS vectors for CVE-2015-0345 APSB15-07 that allow for the ability to gain remote command execution on ColdFusion installations. This exploit is only valid for ColdFusion 10 and 11 installations. Specifically, ColdFusion 11, Update 11...

CVE-2024-30850-chaos-rat-rce-poc

https://github.com/chebuya/CVE-2024-30850-chaos-rat-rce-poc/assets/146861503/ac03c8c7-54b3-4280-9f29-719c44af5192 CHAOS RAT v5.01 web panel RCE CVE-2024-30850, CVE-2024-31839 https://github.com/tiagorlampert/CHAOS This exploit works by spoofing an agent callback for an XSS CVE-2024-31839, and...

rack-bug

Rack::Bug Code Climate Repository: http://github.com/brynary/rack-bug Description Rack::Bug adds a diagnostics toolbar to Rack apps. When enabled, it injects a floating div allowing exploration of logging, database queries, template rendering times, etc. Features Password-based security IP-based...

laravel-exploits

laravel-exploits Exploit for CVE-2021-3129 Details: https://www.ambionics.io/blog/laravel-debug-rce Usage $ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id $ ./laravel-ignition-rce.py http://localhost:8000/ /tmp/exploit.phar Log file:...

majordomo-CVE-2026-27174-poc

majordomo-CVE-2026-27174-poc A proof-of-concept exploiting an unauthenticated remote code execution via the admin panel's PHP console feature in MajorDomo Major Domestic Module. Vulnerability MajorDoMo's admin panel exposes a PHP evaluation console via /admin.php. Due to a missing exit after an...

admin-panel-finder

admin-panel-finder A Python Script to find admin panel of a site...

Explotacion-CVE-2023-32315-Openfire

🔍 CVE-2023-32315 Description: The CVE-2023-32315 vulnerability affects Openfire servers, allowing an attacker to bypass the web admin panel login without valid credentials. The exploit adds an administrative user, allowing the attacker to upload a malicious plugin and obtain a web shell. ⚙️ How it...

Logsensor

Logsensor A Powerful Sensor Tool to discover login panels, and POST Form SQLi Scanning Features login panel Scanning for multiple hosts Proxy compatibility http, https Login panel scanning are done in multiprocessing so the script is super fast at scanning many urls quick tutorial & screenshots a...

Fast-Google-Dorks-Scan

Fast Google Dorks Scan The OSINT project, the main idea of which is to collect all the possible Google dorks search combinations and to find the information about the specific web-site: common admin panels, the widespread file types and path traversal. The 100% automated. Usage example: chmod +x...

CVE-2026-31857

CVE-2026-31857: Craft CMS control panel RCE CVE-2026-31857 is a remote code execution issue in Craft CMS relational condition rules. BaseElementSelectConditionRule::getElementIds renders user-controlled input as an unsandboxed Twig template. An authenticated Control Panel user can submit a crafte...

XCTR-Hacking-Tools

🍀 XCTR Hacking Tools 🍀 Version 1.0.0 All in one tools for Information Gathering. Instagram: Capture the Root 🖼️ Screenshots 🖼️ 📹 How to use 📹 Click on the image... Thank you Jolanda de Koff. You can visit https://hackingpassion.com for a lot of amazing articles. 📒 Read Me 📒 Initially, you need to...

CVE-2025-49132

Impact Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code, without being authenticated. With the ability to execute arbitrary code, this vulnerability can be exploited in an infinite number of ways. It could be used t...

CVE-2025-49132-PoC

CVE-2025-49132 PoC by Pwndalf Overview This repository contains a Proof of Concept PoC for CVE-2025-49132, a Remote Code Execution RCE vulnerability affecting Pterodactyl Panel -l -p...

BlackNET

BlackNET 😈 Free advanced and modern Windows botnet with a nice and secure PHP panel developed using VB.NET. About BlackNET 🤓 Free advanced and modern Windows botnet with a nice and secure PHP panel built using VB.NET. this botnet controller comes with a lot of features and the most secure panel f...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

cve-2020-0688

cve-2020-0688 cve-2020-0688 Login with a user with an email address privliage is nothing to worry about. Grab - VIEWSTATEGENERATOR from page source Grab - the value of ASP.NETSessionId cookie for viewstateuserkey value Download YSO Here ysoserial.exe -p ViewState -g TextFormattingRunProperties -c...

CVE-2026-57517

Control Web Panel ≤ 0.9.8.1224 — Blind SQL Injection to Remote Code Execution Port 2083 → userRes POST → INTO DUMPFILE → Port 2031 Webshell → cwpsvc 🔴 Vulnerability Overview CVE-2026-57517 is a critical pre-authentication blind SQL injection in Control Web Panel CWP versions ≤ 0.9.8.1224. The...

Vehicle-Service-Management-System-Multiple-Privilege-Escalation-Leads-to-CRUD-Operations

CVE-2021-46075 Exploit Title: Vehicle Service Management System - 'Multiple' Privilege Escalation Leads to CRUD Operations Exploit Author: SANU P.L CVE: CVE-2021-46075 CVSS: 7.2 HIGH References:...

CVE-2025-48703

CVE-2025-48703 CVE-2025-48703 is a critical vulnerability in CentOS Web Panel CWP that allows unauthenticated attackers to perform remote code execution RCE by bypassing authentication and executing system commands. The vulnerability affects CWP versions 0.9.8.1204 and earlier, and has been patch...