frieren

Frieren: The micro-framework for security gadgets Description Frieren is a framework for running security tools on OpenWrt routers and Single Board Computers SBCs. It provides a web panel with WiFi management, installable modules, an integrated terminal, and a package manager. The stack is a PHP...

Storm-Breaker

A Tool With Attractive Capabilities. Features: Obtain Device Information Without Any Permission ! Access Location SMARTPHONES Access Webcam Access Microphone Update Log: Second latest Update on November 4th , 2022 . The overall structure of the tool is programmed from the beginning and is availab...

CVE-2024-30850-chaos-rat-rce-poc

https://github.com/chebuya/CVE-2024-30850-chaos-rat-rce-poc/assets/146861503/ac03c8c7-54b3-4280-9f29-719c44af5192 CHAOS RAT v5.01 web panel RCE CVE-2024-30850, CVE-2024-31839 https://github.com/tiagorlampert/CHAOS This exploit works by spoofing an agent callback for an XSS CVE-2024-31839, and...

PhoneMonitor

PhoneMonitor 一款针对 Android 设备的远程管理工具。 应用的最低 SDK 版本为 API 15，按其性质，目标 API 级别设为 21 是合理的。 使用说明： 使用 Android Studio 打开 PhoneMonitor 文件夹。 用 AppSettings.java 文件中的相应替换内容替换 XXXX 字符串。 构建签名的 APK。 修改 Webpanel 文件夹中 helperfuncs.php 文件的数据库参数。 将 php 文件上传到你的服务器。 在你的服务器上创建一个名为 'phonemonitor' 的 MySQL 数据库。 从主页面注册一个账户。...

CVE-2022-44877-white-box

Docs Paper : https://docs.google.com/document/d/1rQ7e9i2AFzHbASfRu3nkgjIswbrS2AB2i7V9OK3dJLs/edit?usp=sharing Libprochider : https://github.com/gianlucaborello/libprocesshider /var/www/html YouTube Demo : https://www.youtube.com/watch?v=V0HgzE8IElA&t=343s tested machine box CentOS 7 - CentOS Web...

CVE-2022-44877-CWP7

CVE-2022-44877-CWP7 Control Web Panel 7 CWP7 Remote Code Execution RCE CVE-2022-44877 Unauthenticated Repository will get updated with POC soon...

cumulus

애플리케이션 취약점 모니터링 소프트웨어 Cumulus란? Cumulus는 실시간으로 보안 취약점을 모니터링하고 수정할 수 있는 서비스입니다. 이슈는 웹 대시보드에 보고됩니다. 매우 간단하고 강력합니다. 주요 기능 웹 프론트에 SDK를 설치하기만 하면 서비스에서 보안 취약점을 찾을 수 있습니다. SDK는 내부 레이어에서 동적으로 취약점을 탐지합니다 예: DOM 이벤트, XHR 요청 스캐너는 외부 레이어에서 정적으로 취약점을 탐지합니다 예: 웹 크롤링 기반 분석 추가로 탐지할 수 있는 취약점이 있다고 생각되면 SDK 또는 스캐너에...

CVE-2022-44877

Centos Web Panel 7 の未認証リモートコード実行 - CVE-2022-44877 root@kitploit: + Centos Web Panel 7 Unauthenticated Remote Code Execution + Centos Web Panel 7 - log ➜ CVE-2022-44877 cat log examplelog ➜ CVE-2022-44877 echo "examplelog $whoami" log ➜ CVE-2022-44877 cat log examplelog examplelog root ➜...

CVE-2026-57517

Control Web Panel ≤ 0.9.8.1224 — リモートコード実行に至るブラインドSQLインジェクション Port 2083 → userRes POST → INTO DUMPFILE → Port 2031 Webshell → cwpsvc 🔴 脆弱性の概要 CVE-2026-57517 は、Control Web Panel CWP バージョン ≤ 0.9.8.1224 における、認証前の重大なブラインドSQLインジェクションです。ユーザーパネルのエンドポイントにある userRes...

CVE-2025-48703

CVE-2025-48703 CVE-2025-48703 is a critical vulnerability in CentOS Web Panel CWP that allows unauthenticated attackers to perform remote code execution RCE by bypassing authentication and executing system commands. The vulnerability affects CWP versions 0.9.8.1204 and earlier, and has been patch...

CentOS Web Panel - OS Command Injection

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution. id: CVE-2021-31324 info: name: CentOS Web Panel - OS Command Injection author: ritikchaddha severity: critical description: | The unprivileged user portal...

CentOS Web Panel - SQL Injection

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter. id: CVE-2021-31316 info: name: CentOS Web Panel - SQL Injection author: ritikchaddha severity: critical description: | The unprivileged user portal part of CentOS Web Pane...

CVE-2026-57517-CWP

CVE-2026-57517 CWP Exploit This repository contains a Go-based proof-of-concept tool for testing a known Control Web Panel CWP vulnerability scenario related to CVE-2026-57517. The implementation targets a blind SQL injection path and includes optional webshell deployment and command execution fl...

CVE-2025-67888

CVE-2025-67888 Control Web Panel = 0.9.8.1208 admin/index.php OS Command Injection Vulnerability Affected Versions: Version 0.9.8.1208 and prior versions. Vulnerability Description: User input passed via the "key" GET parameter to /admin/index.php when the "api" parameter is set is not properly...

CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution

CWP Control Web Panel 0.9.8.1205 contains a remote code execution caused by shell metacharacters in the ttotal parameter in filemanager changePerm request, letting unauthenticated attackers execute code remotely, exploit requires knowledge of a valid non-root username. id: CVE-2025-48703 info:...

Netsweeper 4.0.5 - Default Weak Account

The Web Panel in Netsweeper before 4.0.5 has a default password of 'branding' for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/. id: CVE-2014-9614 info: name: Netsweeper 4.0.5 - Default Weak Account author: daffainfo severity: critica...

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

CVE-2025-69606-GSVoIP-XSS

CVE-2025-69606 — Reflected XSS in GSVoIP Web Panel Severity: Medium | CWE: CWE-79 | Auth Required: No | Vector: Remote Summary A Reflected Cross-Site Scripting XSS vulnerability was identified in the GSVoIP Web Panel v2.0.90. The msg parameter of the error endpoint does not sanitize user-controll...

agent_tesla_panel_rce

agentteslapanelrce このモジュールは、Agent Teslaのコントロールセンターにおけるコマンドインジェクションの脆弱性を悪用します。 セットアップ テスト用のリソースはこちらから入手できます： https://github.com/mekhalleh/agentteslapanelrce/tree/master/resources Windows WebPanel1.7z（認証不要のRCE）では、ioncube互換性のためにPHPバージョン5.6.40で構成されたWAMPサーバー3.1.9 x64を使用しました。...

CentOS-Control-Web-Panel-CVE

CentOS Control Web Panel バージョン 0.9.8.836 - 0.9.8.847 2019年6月29日、私たちのチームは CentOS Control Web Panel CWP バージョン 0.9.8.836 の脆弱性を調査し始め、いくつかの重大な脆弱性を発見しました。発見した脆弱性の一部は連鎖させることで、匿名ユーザーからルートユーザーまでサーバーを侵害することが可能です。チームが CWP に報告した後、彼らは迅速に対応してくれました。 最終的に、ここで言及されているすべての脆弱性は、CWP バージョン 0.9.8.848 CVE-2019-133xx...