CVE-2022-29464

WSO2 Arbitrary File Upload to Remote Command Execution RCE https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738 Example python3 exploit.py https://target.org:9443 shell.jsp...

CVE-2020-8193

CVE-2020-8193...

ci_fuzz

Description: This script fuzz's for Command Injection vulnerabilities resulting in remote command execution. Similiar OWASP vulnerablities are explained here -- https://www.owasp.org/index.php/CommandInjection The script will attempt to execute OS commands by injecting into every value in the bod...

f5-waf-quick-patch-cve-2021-44228

f5-waf-quick-patch-CVE-2021-44228 F5 Networks Advanced WAF/ASM Quick Patch CVE 2021-44228. Overview This tool connects to a BIG-IP device and creates a custom signature set called CVE-2021-4428 and apply it to all policies in blocking mode. It also enforces all signatures and apply the changes...

webapp-exploits

webapp-exploits Web Application Exploit Development...

wvctf

WebVulnCTF WVCTF or WebVulnCTF is a gamified web platform which promotes training in pentesting and web application development security in an entertaining way. Through a rewards system, the user must search for a set of flags in the vulnerable application, that correspond to frequent...

CVE-2021-38149

CVE-2021-38149 Chikitsa Patient Management System 2.0.0 Stored Cross-Site Scripting XSS An instance of stored cross-site scripting XSS exists in multiple pages on version 2.0.0 of Chikitsa Patient Management System that allows for arbitrary JavaScript to be executed in a user's browswer that coul...

CVE-2019-12744

CVE-2019-12744 Information Exploit Title: Remote Command Execution through Unvalidated File Upload in SeedDMS versions 5.1.11 CVE: CVE-2019-12744 Vendor Homepage: https://www.seeddms.org/index.php?id=2 Exploit Author: NobodyAtall Tested version: Seeddms 5.1.10, 5.0.11 Tested OS: Windows 7 x64...

CVE-2020-28653

CVE-2020-28653 Version: 2016 - 2020 before patch Usage: python exploit.py http://vuln-web.com...

WAFEC

OWASP WAFEC Project Document Repository OWASP WAF Evaluation Criteria Project The Web Application Firewall Evaluation Criteria WAFEC provides interested partied, including users, vendors and 3rd party evaluators with a tool to learn about Web Application Firewalls WAFs and evaluate the suitabilit...

vajra

An automated web hacking framework for web applications Table of Content About Vajra What is Vajra Key Feaures What Vajra does Installation Running with docker-compose Tools Used by Vajra Contributing License Future Plans/Under Development Credits Disclaimer FAQ Detailed insight about Vajra can b...

CVE-2026-6355

Augmentt: Cross-Tenant Access via IDOR Credits This CVE was a collaborative effort between: Raznov – GitHub: https://github.com/basraznov HelloWorld Author– GitHub: https://github.com/Penquinsecq Description A vulnerability in the web application allows unauthorized users to access and manipulate...

MOVEit Transfer - SQL Injection

In Progress MOVEit Transfer before 2020.1.11 12.1.11, 2021.0.9 13.0.9, 2021.1.7 13.1.7, 2022.0.7 14.0.7, 2022.1.8 14.1.8, and 2023.0.4 15.0.4, a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized...

Apache OFBiz - Remote Code Execution

Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server id: CVE-2024-45507 info: name: Apache OFBiz -...

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Multiple Atlassian products Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye contain a files or directories accessible to external parties vulnerability which could allow an...

CVE-2026-14851

A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information PII and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised...

CVE-2026-14851

The Copart online billing service suffers from a vulnerability that leads to the unauthorised disclosure of information within its customer invoicing web application. The root cause is a lack of authorisation checks on the endpoint responsible for serving PDF invoice files , combined with certain...

EUVD-2026-100940

A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information PII and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised...

CVE-2026-105106

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130097)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130097 advisory. Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache...