CVE-2022-23378

CVE-2022-23378 : Reflected XSS in TastyIgniter v3.2.2 Restaurtant CMS Authenticated reflected XSS exists in the TastyIgniter Admin dashboard in version v3.2.2. Mitre URL: https://vulners.com/cve/CVE-2022-23378 NIST URL: https://nvd.nist.gov/vuln/detail/CVE-2022-23378 Proof of Concept POC: Admin...

CVE-2025-49132

CVE-2025-49132 - Pterodactyl Panel Exploit ⚠️ Disclaimer : This repository is created for educational and research purposes only as part of my security research to understand and document CVE-2025-49132. All credit for the vulnerability discovery goes to the original researchers. / |\ \ / /| | | /...

admin-panel-finder

admin-panel-finder A Python Script to find admin panel of a site...

NeutrinoBotHack

NeutrinoBotHack Blind SQL injection in Neutrino panel...

CVE-2025-49132

Impact Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code, without being authenticated. With the ability to execute arbitrary code, this vulnerability can be exploited in an infinite number of ways. It could be used t...

Vehicle-Service-Management-System-Multiple-Privilege-Escalation-Leads-to-CRUD-Operations

CVE-2021-46075 Exploit Title: Vehicle Service Management System - 'Multiple' Privilege Escalation Leads to CRUD Operations Exploit Author: SANU P.L CVE: CVE-2021-46075 CVSS: 7.2 HIGH References:...

CVE-2024-21413

CVE-2024-21413 - Expect Script POC Microsoft Outlook Leak credentials & Remote Code Execution Vulnerability when chained with CVE-2023-21716 through the preview panel CVSS:3.1 9.8 / 8.5 Outlook should warm you about the risk on opening an external link = but this is not the case! usage:...

CVE-2025-48703

CVE-2025-48703 CVE-2025-48703 is a critical vulnerability in CentOS Web Panel CWP that allows unauthenticated attackers to perform remote code execution RCE by bypassing authentication and executing system commands. The vulnerability affects CWP versions 0.9.8.1204 and earlier, and has been patch...

CVE-2024-45264

CVE-2024-45264 Suggested description A cross-site request forgery CSRF vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3132 allows remote attackers to add a new administrator, leading to escalation of privileges. Vulnerability Type CWE-352 | Cross Site Request Forgery CSRF Vendo...

Logsensor

Logsensor A Powerful Sensor Tool to discover login panels, and POST Form SQLi Scanning Features login panel Scanning for multiple hosts Proxy compatibility http, https Login panel scanning are done in multiprocessing so the script is super fast at scanning many urls quick tutorial & screenshots a...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

CVE-2026-55579

CVE-2026-55579 — Pheditor Hardcoded Default Password RCE -critical TL;DR: Pheditor all versions ships with a hardcoded default administrator password admin embedded in its source code. There is no forced password change on first login, only a visual warning. Any unauthenticated attacker can log i...

CVE-2025-49132

CVE-2025-49132 - 10.0 Critical https://github.com/pterodactyl/panel/security/advisories/GHSA-24wv-6c99-f843 Vulnerable versions: 1.9.0 .. 1.11.10 OpSec Considerations RCE exploitation is limited but can be detected through: cat /var/www/pterodactyl/storage/logs/laravel-2025--.log | grep...

ibombshell

ibombshell - Dynamic Remote Shell ,--.!, / -- / / / // / / / / ,d08b. '| / / / / / \ / / / / / 0088MM / / // / // / / / / / / // // / / / / / / / 9MMP' ///// // //./// ///// + Starting the console... Console ready! ibombshell is a tool written in Powershell that allows you to have a prompt...

cyberpanel

🛠️ CyberPanel Web Hosting Control Panel powered by OpenLiteSpeed, designed to simplify hosting management. 🔧 Features & Services 🔐 Different User Access Levels via ACLs. 🌌 Auto SSL for secure websites. 💻 FTP Server for file transfers. 🕒 Light-weight DNS Server PowerDNS. 🔐 phpMyAdmin to manage...

CVE-2020-18325

Multilple Cross Site Scripting XSS vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel. Description Subrion CMS is easy to install and simple to manage. Use it as a stand-alone application or in conjunction with other applications to create entry level sites, mid-siz...

Admin-Panel_Finder

Admin Panel Finder A burp suite extension that enumerates infrastructure and application Admin Interfaces. OWASP References: Classification : Web Application Security Testing 02-Configuration and Deployment Management Testing OTG v4 : OWASP OTG-CONFIG-005 WSTG : WSTG-CONF-05 Why should I use this...

PhoneMonitor

PhoneMonitor A Remote Administration Tool for Android devices. The Minimum SDK version for the app is API 15 and by its nature, the Target API level makes sense to be 21. Instructions: Open the folder PhoneMonitor with Android Studio. Replace the XXXX strings with the relevant substitutes from...

CVE-2026-36670

CVE-2026-36670 A time-based blind SQL injection exploit for the OpenSIPS Control Panel. This exploit abuses an authenticated sql injection vulnerability within the aliasmanagement.php module of opensips. The table GET parameter is improperly sanitized, allowing an attacker to inject a crafted...

FuguHub-8.4-Authenticated-RCE-CVE-2024-27697

FuguHub 8.4 Authenticated RCE Fuguhub is a Cloud Media Server Software. The version tested was the debian version at this link: https://fuguhub.com/articles/FuguHub-for-Debian An issue in Real Time Logic LLC FuguHub v.8.4 allows a local attacker to execute arbitrary code via a crafted script to t...