cookiemonster

🍪 CookieMonster CookieMonster es una herramienta de línea de comandos y API para decodificar y modificar cookies de sesión vulnerables de varios frameworks diferentes. Está diseñada para ejecutarse en tuberías de automatización que deben ser capaces de procesar de manera eficiente una gran cantid...

CVE-2022-29359

School Club Application System Issue: Unauthenticated Stored Cross-Site Scripting to HTML injection to RCE Author: Zak Clifford Date: 12.04.2022 Vendor: https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html Software:...

CVE-2025-61686_docker

CVE-2025-61686docker Start 1. Build root@kitploit: docker-compose up --build 2. Start root@kitploit: docker-compose up Reproduction Steps 1. Construct a session that meets the path traversal condition root@kitploit: └─$ echo -en '"AAAA../../../tmp/flower"'|base64 -w0 | tr '+/' '-' | tr -d '='...

CVE-2025-29602

CVE-2025-29602 - Stored cross site scriptingXSS vulnerabilities in the FlatPress CMS 1.3.1 Description A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS 1.3.1. An attacker with admin privileges can inject a malicious JavaScript payload into the...

yappy

Yappy 🐶 AI-powered LinkedIn engagement assistant. Automatically discover LinkedIn posts and leave thoughtful, unique, AI-generated comments that actually sound like you. Yappy is a powerful terminal-based tool that uses Google's Gemini AI and Playwright browser automation to help you stay active ...

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...

ICTBroadcast - Command Injection

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are know...

Wing FTP Server <= 7.4.3 - Path Disclosure via Overlong UID Cookie

Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability CVE-2025-47813. The vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an overlong UID value causes the server to respo...

Bludit CMS <= 3.20.0 - Cross-Site Scripting

Bludit CMS contains a reflected XSS caused by improper sanitization in the search plugin, letting unauthenticated attackers inject arbitrary JavaScript, exploit requires crafted malicious search query. id: CVE-2026-41456 info: name: Bludit CMS = 3.20.0 - Cross-Site Scripting author: 0xAkoko...

cve-2025-5755

CVE-2025-5777: The Ultimate PoC & Scanner 🚀 An advanced, powerful, and easy-to-use tool designed to detect and exploit CVE-2025-5777 CitrixBleed 2. This script not only identifies the vulnerability but also helps in demonstrating its impact by parsing human-readable information from the memory...

CVE-2023-43326

mooSocial: XSS CVE-2023-43326 A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Note: XXS Also works when these URLs are used in Referer Header. The...

ExploitVeer

CVE-2025-5777: El Escáner Definitivo 🚀 🔐 CVE: CVE-2025-5777 🚨 Gravedad: Crítica 👨‍💻 Autor: Virendra Kumar & CyberLeelawat 📜 Licencia: MIT Una herramienta avanzada, potente y fácil de usar diseñada para detectar y explotar CVE-2025-5777 también conocido como CitrixBleed 2. Este script no solo...

CVE-2019-10008

CVE-2019-10008 ManageEngine Service Desk Plus 9.3 Privilaged account Hijacking Date: 30-03-2019 Exploit Author: Ata Hakçıl, Melih Kaan Yıldız Vendor: ManageEngine Vendor Homepage:www.manageengine.com Product: Service Desk Plus Version: 10.0 Tested On: Windows 10 64 bit CVE : 2019-10008 Complete P...

CVE-2025-50363_BXSS_CVE

Project Name & Repo URL: Maid Hiring Management System using PHP and MySQL Vulnerability Type: Privilege Escalation via Blind XSS Affected Versions:v1.0 💣Vulnerability Description: A Blind Cross-Site Scripting XSS vulnerability was discovered in the Maid Hiring Management System, which allows a...

CVE-2023-45542

CVE-2023-45542 A reflected cross-site scripting XSS vulnerability exisits in the q parameter on search function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: q Exploit - Proof of Concept POC Reflect...

adaPwn

adaPwn - CVE-2019-14912 PoC adAS OPENSSO module doesn't correctly verify the domain to redirect, making possible to redirect the user to an attacker controlled website, stealing his adAS session cookie. Usage usage: adaPwn.py -h --interface INTERFACE --httpPort HTTPPORT --dnsPort DNSPORT ipToSpoo...

CVE-2023-31852

CVE-2023-31852 Reflected cross-site scripting XSS attack exists in web-based management interface of Cudy LT400. The page /cgi-bin/luci/admin/network/wireless/config has reflected XSS via the iface parameter. The methods of exploitation would involve sending a specially crafted request to the...

CVE-2019-13633

CVE-2019-13633 Suggested description : Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. Additional Information : Blinger.io - is a platform which used by global clients such as FxPro, Alfa Bank, OneTwoTrip, Ivi, KupiVIP Group, Belavia, Wargaming, Yandex, OZON, TCS Group Holding and...

CVE-2022-46087

CVE-2022-46087 CloudSchool v3.0.1 is vulnerable to Cross Site Scripting XSS. A normal user can steal session cookies of the admin users through notification received by the admin user. Reffer to: https://github.com/G37SYS73M/AdvisoryG37SYS73M/blob/main/CVE-2022-46087/poc.md...

CVE-2023-44813

CVE-2023-44813 A reflected cross-site scripting XSS vulnerability in the mode parameter on Invite Friend function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: mode Exploit - Proof of Concept POC...