CVE-2023-41892_poc

CVE-2023-41892poc Customized this for my own use pocnoauth.py Basic PHP one-liner webshell OS command execution via ?cmd= pocauth.py Simple key-based authentication added webshell SHA-256 hash comparison method Commands can only be executed if the correct key is provided Code modification require...

Joomla-Scanner

Joomla Scanner Joomla Unauthorized Access Vulnerability CVE-2023-23752 made with python Usage Display Result.txt URL | Database Name | Username | Password | Host Disclaimer Alat ini hanya untuk edukasi, dilarang memperjual beli kan dan menyalahgunakan...

CVE-2024-52429

CVE-2024-52429 WP Quick Setup history.pushState'', '', '/'; document.forms0.submit;...

CVE-2025-6934

CVE-2025-6934 🛡️ CVE-2025-6934 - Unauthenticated Privilege Escalation in Opal Estate Pro 📝 Description The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to Privilege Escalation in all version...

CVE-2024-25092

CVE-2024-25092 NextMove Lite 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation Description: The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'xladdoninstallation' functio...

CVE-2021-38314

CVE-2021-38314 What is the vulnerability? The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a given site but deterministi...

wargame_Re-LS

CVE-2025-0184 DOCX SSRF CTF Challenge Quick Start 1. Setup and Build make setup make build 2. Start Services make up 3. Web Access open http://localhost:8080 Goal Access the internal Admin service port 3003 and obtain the flag! Expected Flag : CTFflagreadme Exploit cd exploits python3...

CVE-2025-24893

CVE-2025-24893 PoC | XWiki Platform 15.10.10 - Remote Code Execution An RCE Remote Code Execution category vulnerability, found when unauthenticated attackers can execute arbitrary Groovy code remotely without authentication or prior access Guest User. Below is a PoC Proof-Of-Concept in Python fo...

CVE-2024-5633

PoC for CVE-2024-5633 Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the same local network to an undocumented binary service CoolView on one of the ports. An attacker with a knowledge of the available commands...

CVE-2018-11759

CVE-2018-11759 Proof of concept Description The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported b...

metasploitable2-vsftpd-exploitation

Metasploitable 2 - vsFTPd 2.3.4 Exploitation Lab Overview This project demonstrates a penetration testing workflow against a deliberately vulnerable machine, Metasploitable 2. The objective was to identify, exploit, and analyze a known vulnerability in the FTP service, ultimately achieving...

CVE-2024-20767

CVE-2024-20767 CVE-2024-20767 - Arbitrary file system read using an Improper Access Control vulnerability in Adobe ColdFusion Please refer to ma4ter blogpost for more information: Adobe ColdFusion任意文件读取漏洞CVE-2024-20767分析 Products and Versions affected: Product| Affected Versions ---|--- ColdFusio...

CVE-2026-5430

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-5430 CVE-2026-5430 WSO2 API Manager 4.5.0 - WSO2 I am @abraxasnull. Loopback lab. The client is CVE-2026-5430-Abraxas-Labs.py. JWT alg mix-up. JWTUtil.verifyTokenSignature throws on non-RSA alg. Pre-patch...

CVE-2025-6384

CVE-2025-6384: Groovy Sandbox Bypass 2 in CrafterCMS Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. Vendor Disclosure: The vendor's disclosure and fix for this...

CVE-2024-33453

CVE-2024-33453 Sensitive Data Exposure via Object Level Access Control in esp-idf Description A Buffer Overflow vulnerability in the esp-idf framework version 5.1, used by some Schoolbox products, allows a remote attacker to obtain sensitive information through improper object-level access contro...

CVE-2021-34646

CVE-2021-34646 PoC for CVE-2021-34646 Exploit Title: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Authentication Bypass Date: 2021-09-16 Exploit Author: Sebastian Kriesten 0xB455 Contact: https://twitter.com/0xB455 Affected Plugin: Booster for WooCommerce Plugin Slug: woocommerce-jetpack...

CVE-2024-22274-RCE

Privilege Escalation: VMware vCenter Server Authenticated RCE 📜 Description The “com.vmware.appliance.recovery.backup.job.create” and the “com.vmware.appliance.recovery.backup.validate” API components are vulnerable to a flag injection attack that can be leveraged to execute arbitrary commands as...

Storm-Breaker

A Tool With Attractive Capabilities. Features: Obtain Device Information Without Any Permission ! Access Location SMARTPHONES Access Webcam Access Microphone Update Log: Second latest Update on November 4th , 2022 . The overall structure of the tool is programmed from the beginning and is availab...

CVE-2022-1040

CVE-2022-1040-sophos-rce-poc sophos rce poc sophos webmin portal auth bypass and rce all in one script; The vulnerability affects Sophos Firewall v18.5 MR3 18.5.3 and older Mitigation: update to latest version asap https://support.sophos.com/support/s/article/KB-000043853?language=enUS to avoid...

CVE

CVE Writeups for CVE-2025-67586, CVE-2025-67985, CVE-2025-67986 -------------- CVE-2025-67586 Exploit PoC -------------- Exploit Title: WordPress Plugin 5.2.0 - Broken Access Control Software Link: https://wordpress.org/plugins/highlight-and-share/ Version: Description A broken access control...