CVE-2023-33538

Python Exploit for TP-Link TL-WR940N/TL-WR841N Command Injection Vulnerability Usage Instructions 1. Basic Vulnerability Check : root@kitploit: python tplinkexploit.py -t 192.168.1.1 -u admin -p admin 2. Execute Custom Command : root@kitploit: python tplinkexploit.py -t 192.168.1.1 -u admin -p...

CVE-2022-40317

CVE-2022-40317 Stored XSS in Notes A stored XSS was found in the notes section of the application while we were pentesting a client that was using OpenKM. Basically, when storing notes, somehow normal HTML was allowed and it was rendered as is. As you know, However, we found that using...

CVE-2025-1302

CVE-2025-1302 ★ CVE-2025-1302 JSONPath-plus RCE PoC ★ https://github.com/user-attachments/assets/5d791540-ef6c-4cd0-bd25-7a1dbbd194fb Configuración del laboratorio root@kitploit: docker build -t jsonpath:10.2.0 . docker run --rm --name jsonpath -p 3000:3000 jsonpath:10.2.0 localhost:3000...

Instagram-Notes-Audio-Leakage-via-URL-Extraction-Fixed

🎙️ Fuga de audio de Notas de Instagram mediante extracción de URL Solucionado y recompensado 🛡️ Resumen de la vulnerabilidad En 05/2025, descubrí una vulnerabilidad en Instagram Web que permitía a cualquier usuario extraer el archivo de video original de una Nota y acceder al audio de fondo , que...

CVE-2025-24367-PoC-Cacti

Cacti CVE-2025-24367 Authenticated RCE PoC This repository contains a proof‑of‑concept exploit for CVE‑2025‑24367 , an authenticated remote code execution vulnerability in Cacti. The issue abuses insufficient input sanitization in graph template handling. By injecting malicious content into the...

CVE-2026-90772

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

EUVD-2026-76993

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

CVE-2026-90772

Amundsen frontend through 4.3.0 is affected by a stored XSS in ResourceListItem components (e.g., TableListItem), which render table, dashboard, and feature descriptions using dangerouslySetInnerHTML without HTML sanitization. An attacker with low privileges can inject malicious markup (such as )...

CVE-2026-90772 Amundsen Frontend through 4.3.0 Stored XSS via Description

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

exploit-CVE-2022-25765

Exploit for CVE-2022-25765 pdfkit - Command Injection Like this repo? Give us a ⭐! For educational and authorized security research purposes only. Exploit Author @UNICORDev by @NicPWNs and @Dev-Yeoj Vulnerability Description The package pdfkit from 0.0.0 are vulnerable to Command Injection where...

CVE-2021-38602

CVE-2021-38602 A stored cross site scripting vulnerability is present on the Article editing page in version 5.8.7 of PluXML. User input is not properly sanitized in multiple fields. Vulnerable Fields: Headline optional: Content: Once inserted, XSS can be triggered by visiting the posted article ...

CVE-2022-27251

CVE-2022-27251 Remote Code Execution in LocalStack 0.12.6 Due to the lack of sanitization on user input on the Lambda API handler field whilst spawning Lambda functions and the way Docker containers are insecurely spawned, an injection can be provided through AWS CLI in the --handler option to be...

CVE-2021-36563

CVE-2021-36563 – Multiple Stored and Reflected XSS Application: CheckMK Management Web Console Software Revision: From 1.5.0 to 2.0.0p9 Attack type: Stored and Reflected XSS Solution: Update to Software Revision 2.0.0p10 or later Summary: The CheckMK management web console versions 1.5.0 to 2.0.0...

CVE-2021-22204

CVE-2021-22204 Summary of the CVE Improper sanitization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image. Affected Versions Version 7.44 - 12.23 Anomalies Dependencies: djvulibre-bin exiftool Calls these three...

CVE-2019-1010174

CVE-2019-1010174 CImg Library v.2.3.3 - command injection CVE-2019-1010174 Detail Modified This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided. Description CImg The CImg Library v.2.3...

Sooty

Visión general Sooty es una herramienta desarrollada con la tarea de ayudar a los analistas de SOC a automatizar parte de su flujo de trabajo. Uno de los objetivos de Sooty es realizar tantas comprobaciones rutinarias como sea posible, permitiendo al analista más tiempo para un análisis más...

CVE-2024-9264-RCE-Exploit

CVE-2024-9264-RCE-Exploit in Grafana via SQL Expressions Description Proof Of Concept for Remote Code Execution in Grafana CVE-2024-9264 This repository contains a Python script that exploits a Remote Code Execution RCE vulnerability in Grafana's SQL Expressions feature. By leveraging insufficien...

mailenable-cve-2022-36934

MailEnable CVE-2022-36934 Exploit Module Metasploit module for MailEnable's authentication bypass vulnerability CVE-2022-36934, leading to remote code execution. 📌 Features Exploits MailEnable's improper input sanitization in SMTP/POP3 Supports both x86 and x64 Windows targets No user interaction...

CVE-2023-44761_ConcreteCMS-Stored-XSS---Forms

ConcreteCMS XSS Almacenado v.9.2.1 Autor: Sergio Descripción: Múltiples vulnerabilidades de Cross Site Scripting en ConcreteCMS v.9.2.1 permiten a un atacante local ejecutar código arbitrario a través de un script manipulado en los Formularios de los objetos de Datos. Vectores de ataque: Una...

CVE-2025-44148

CVE-2025-44148 - Reflected Cross-Site Scripting Reflected XSS Reflected Cross-Site Scripting XSS in MailEnable Vendor: MailEnable Pty. Ltd. Affected Versions: 10 Description A reflected cross-site scripting XSS vulnerability exists in MailEnable Webmail due to improper user input sanitization in...