CVE-2024-52301-Research

CVE-2024-52301-Research A bit of research around CVE-2024-52301. I've seen the vuln and wanted to find out how Laravel is vulnerable. For this, I just diffed the 6.20.44 and 6.20.45 versions, and traced how GET parameters could end up changing the application configuration. I've written about thi...

kodex

Kodex Community Edition - CE is an open-source toolkit for privacy and security engineering. It helps you to automate data security and data protection measures in your data engineering workflows. It offers the following functionality: Read data items from a variety of sources such as files,...

CVE-2023-31716

CVE-2023-31716 Name Affected product: FUXA Version affected: = 1.1.12 Problem: Local File Inclusion Description: FUXA 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log...

CVE-2023-2594

CVE-2023-2594 https://vulners.com/cve/CVE-2023-2594 A vulnerability, which was classified as critical, was found in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the component Registration. The manipulation of the argument username leads to sql injection. ...

CVE-2026-6355

Augmentt: Cross-Tenant Access via IDOR Credits This CVE was a collaborative effort between: Raznov – GitHub: https://github.com/basraznov HelloWorld Author– GitHub: https://github.com/Penquinsecq Description A vulnerability in the web application allows unauthorized users to access and manipulate...

CVE-2024-1512

CVE-2024-1512 Proof of Concept Vulnerability Overview CVE-2024-1512 exposes a critical vulnerability in the MasterStudy LMS WordPress Plugin, specifically within the implementation of the /lms/stm-lms/order/items REST route. The issue arises from the plugin's failure to properly escape the 'user'...

php-cgi-Injector

PHP-CGI Injector 🚀 CVE-2024-4577 & CVE-2024-8926 Exploit Tool Automated testing tool for PHP-CGI parameter injection vulnerabilities , supporting CVE-2024-4577 and CVE-2024-8926 , with capabilities for command execution, file upload, download , etc. 📌 Introduction This tool can be used to test...

roundcube-cve-2025-49113-lab

"DISCLAIMER: Educational Use Only" Roundcube Webmail RCE – CVE-2025-49113 Lab This repository documents my step-by-step exploitation of Roundcube Webmail CVE-2025-49113 in a controlled lab to obtain the secret stored in /secret.txt. ⚠️ Disclaimer All work was performed against a lab / training...

IPFire_2.19_RCE_Authenticated

IPFire 2.19 OINKCODE RCE PoC Python proof of concept for the authenticated command-injection vulnerability in IPFire 2.19's ids.cgi page through the OINKCODE parameter. For authorized security testing and training labs only. Run this PoC only against systems that you own or have explicit permissi...

See-SURF

See-SURF Security scanner now powered with AI 🤖 to find potential Server Side Request Forgery SSRF parameters in your web application. See-SURF not only helps you detect potential SSRF parameters but also helps you validate it, protecting your application with system and user data compromise. 🎓...

CVE-2023-46021-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability

CVE-2023-46021-Code-Projects-Blood-Bank-1.0-OOB-SQL-Injection-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overview...

hook

Hook Hook exploits a parameter injection vulnerability in the WatchGuard SSH interface. The vulnerability allows a low privileged user to exfiltrate arbitrary system files to an attacker controlled FTP server. Fortunately, there is a builtin low privileged user named status that this script...

CVE-2021-39475

CVE-2021-39475 XSS on admin reviews page https://www.warcloudsecurity.com/ecommerce/admin/reviews.php?action=preview&rID=1&page=0...

CVE-2023-48842

CVE-2023-48842 Source : D-Link Go-RT-AC750 revAv101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi. https://drive.google.com/file/d/1y5omf2SAhNmcPqDxCSRTvJVAWwPcH/view Little upgrade : I updated the script which is now on steroids, the scrip...

CVE-2022-38553

CVE-2022-38553 CROSS SITE SCRIPTING XSS ON "ACADEMY LEARNING MANAGEMENT SYSTEM" POC VIDEO: Security Risk: This security vulnerability allows to execute arbitrary JavaScript code in user browser if they access URL prepared by attackers...

CVE-2019-17671

＃CVE-2019-17671 ＃url + /？static = 1＆order = asc...

CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI to RCE Exploit Pre-Auth Path Traversal via 'tab' Parameter → Local File Inclusion Overview CVE-2026-9290 is a high-severity CVSS 7.5 unauthenticated Local File Inclusion vulnerability in the WP User Manager – User Profile Builder & Membership WordPress plugin ≤...

CVE-2018-17254

CVE-2018-17254 Exploit Title: Joomla JCK Editor 6.4.4 - 'parent' SQL Injection Googke Dork: inurl:/plugins/editors/jckeditor/plugins/jtreelink/ Vendor Homepage: http://docs.arkextensions.com/downloads/jck-editor Version: 6.4.4 Tested on: Debian 10 Ubuntu Windows 11/10 CVE : CVE-2018-17254 PHP...

CVE-2025-64459

CTF Challenge: Django ORM Injection CVE-2025-64459 Category: Web Security Difficulty: Medium Vulnerability: CVE-2025-64459 - Django ORM Filter Injection 📝 Description We built a secure merch shop with admin panel. Can you bypass the authentication and find the private admin note URL:...

CVE-2022-0439

CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Subscriber+ Blind SQL injection Must Have sqlmap installed & a valid username & password with subscriber+ Usage usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w UR...