Jenkins build-metrics 1.3 - Cross-Site Scripting

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...

SolarWinds Web Help Desk - Authentication Bypass

SolarWinds Web Help Desk contains an authentication bypass vulnerability caused by improper access control, letting attackers execute protected actions without authentication, exploit requires no special conditions. id: CVE-2025-40552 info: name: SolarWinds Web Help Desk - Authentication Bypass...

ZoneMinder v1.37.* <= 1.37.64 - SQL Injection

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37. = 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65. id: CVE-2024-51482 info: name: ZoneMinder v1.37. = 1.37.64 - SQL Injection author...

Web Directory Free < 1.7.0 - SQL Injection

The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. id: CVE-2024-3552 info: name: Web Directory Free 1.7.0 - SQL...

Netsweeper 4.0.5 - Default Weak Account

The Web Panel in Netsweeper before 4.0.5 has a default password of 'branding' for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/. id: CVE-2014-9614 info: name: Netsweeper 4.0.5 - Default Weak Account author: daffainfo severity: critica...

Kramer VIAware - Privilege Escalation and Remote Code Execution

Kramer VIAware, all tested versions, allow privilege escalation and remote code execution due to misconfigured sudo permissions. Attackers can execute arbitrary system commands remotely if the web interface is accessible, due to vulnerabilities in the handling of privileged operations through...

web-application-firewall-

Web Application Firewall Simulation Overview This project demonstrates a Web Application Firewall WAF simulation using Flask and a vulnerability checker for CVE-2017-5638. The WAF middleware blocks HTTP requests containing specific patterns, and the vulnerability checker tests for and exploits th...

CVEs

Lista de CVE CVE-2024-22890: My e-Diary App - Cross-Site-Scripting Prueba de Concepto PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22890.md CVE-2024-22909 : Online-Exam-System - Cross-Site-Scripting Prueba de Concepto PoC :...

CVE-2024-4577

CVE-2024-4577 - PHP-CGI Argument Injection RCE | | ---|---|--- CVE| Description| CVSSv3 CVE-2024-4577| PHP-CGI Argument Injection Vulnerability| 9.8 | | "CVE-2024-4577 is a critical argument injection vulnerability in PHP that can be exploited to achieve remote code execution RCE. According to...

CVE-2025-24813-POC

JSP Web Shell 上传器 一个简单的 Python 工具，用于通过 HTTP PUT 请求将一个基础的 JSP Web Shell 上传到一个或多个目标。 ⚠️ 仅用于教育和授权的渗透测试。 Apache Tomcat 存在路径等价/路径遍历漏洞，原因是未正确处理路径中的 ../ 序列。 CVE ID: CVE-2025-24813 Severity: 严重 Reference link: https://github.com/advisories/GHSA-83qj-6fr2-vhqg 🧰 功能 上传一个具有命令执行能力的基础 JSP Shell 支持： 单个目标 -t...

CVE-2012-1723

Navegador web drive-by que explota CVE-2012-1723 para ejecución remota de código. Puede encontrar un recorrido y detalles técnicos en https://ethaniel.me/2017/02/09/practice-the-past-cve-2012-1723/...

CVE-2026-10290-SQLI

Hotel and Tourism Reservation System - Unauthenticated SQL Injection in tour.php Vulnerability Details Field| Details ---|--- Title| Hotel and Tourism Reservation System - SQL Injection via tour GET Parameter Vendor| code-projects.org Vendor URL|...

vcenter-cve-2021-21980-lab

CVE-2021-21980 Vulnerable Test Environment Overview Realistic test environment simulating VMware vSphere Web Client path traversal vulnerability. ⚠️ WARNING: Vulnerable test environment. Do NOT expose to internet! Quick Start Build and Run podman build -t vcenter-lab . podman run -d -p 443:443...

CVE-2026-57517-CWP

CVE-2026-57517 CWP Exploit This repository contains a Go-based proof-of-concept tool for testing a known Control Web Panel CWP vulnerability scenario related to CVE-2026-57517. The implementation targets a blind SQL injection path and includes optional webshell deployment and command execution fl...

static-code-analysis-helper

Static-Code-Analysis-Helper Descripción Detecta funciones que probablemente causen metodologías de ataque en muchos lenguajes de programación web y frameworks de tu carpeta de proyecto. Te ayuda a realizar análisis de código estático. Nota : Muchas de las funciones descritas aquí pueden no causar...

kismet-docs

OBSOLETO Este repositorio ahora está fusionado en el repositorio kismet-web-docs, y todos los cambios futuros deben realizarse allí. El nuevo motor del sitio utiliza Hugo, y varias de las partes de la documentación se han convertido a datos YAML con plantillas...

dbdtct

dbgdtct Desctiption dbgdtct is a Python-based tool designed to help you detect if a web application is deployed in debug mode—a critical misconfiguration that can expose sensitive information and increase the risk of exploitation in production environments. Installation git clone...

CVE-2024-22909

CVE-2024-22909 : Online-Exam-System - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22909.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-22909/blob/main/CVE-2024-22909.md...

CrushFTP-auth-bypass-CVE-2025-31161

CrushFTP Authentication Bypass - CVE-2025-31161 A comprehensive toolkit for exploiting CVE-2025-31161, an authentication bypass vulnerability in CrushFTP that allows unauthorized user account creation. 🔍 What is CVE-2025-31161? CVE-2025-31161 is a critical authentication bypass vulnerability in...

MouseServer-1.7.8.5-RCE

WiFi Mouse Server 1.7.8.5 - RCE An optimized Python 3 Proof-of-Concept PoC exploit for WiFi Mouse Server v1.7.8.5. This script leverages an inherent protocol vulnerability to achieve Remote Code Execution RCE via automated keystroke injection. This version has been explicitly modified and tuned f...