CVE-2026-15399

The Animated Number Counters plugin for WordPress is vulnerable to a second-order SQL Injection in all versions up to and including 3.0 . The flaw exists because the 'counterid' parameter is insufficiently escaped and the read path fails to use proper query preparation, even though the write path...

CVE-2026-15399 Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter

The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

EUVD-2026-98348

The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

paradoxiaRAT

Paradoxia Remote Access Tool. Are you looking for a GUI alternative? Check outRemote Hacker Probe. More Advanced and Stable with ton of features. Features Paradoxia Console Feature| Description ---|--- Easy to use| Paradoxia is extremely easy to use, So far the easiest rat! Root Shell| - Automati...

android-c-sharp-rat-server

Android C R.A.T Server This is a pulgin built for the C R.A.T Server with the plugin system. 1. To install this plugin place the AndroidExtension.dll file from AndroidExtension/bin/Debug to /TutServer/bin/Debug/scripts 2. Then start the server and select the Plugins tab. 3. Select...

CVE-2021-40346

CVE-2021-40346 CVE-2021-40346 PoC HAProxy HTTP Smuggling For educational purposes only Setup $ docker build -t cve-2021-40346 . $ docker run --name poc -p 8000:80 -d --rm -it cve-2021-40346 4941e9f23508b497e4cbe334a75e7cdb84c83478522ed85f48db3477f97a6fb4 Test Confirm /admin is denied. $ curl...

GitHound

GitHound Overview GitHound is a BloodHound OpenGraph collector for GitHub, designed to map your organization’s structure and permissions into a navigable attack‑path graph. It: Models Key GitHub Entities GHOrganization : Your GitHub org metadata GHUser : Individual user accounts in the org GHTeam...

RAT-via-Telegram

RAT-via-Telegram Dviros's notes: Windows Remote Post Breach Tool via Telegram Python 2.7, Originally created by Ritiek, Forked and modified by mvrozanti and then myself. The whole purpose of this tool is to demonstrate as a "PoC" the control of an already breached machine, via Telegram. As the sa...

CVE-2022-3699

CVE-2022-3699 Incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory read/write. Thank you to ch3rn0byl for helping with this and I totally 100% ripped two of his functions. Explanatio...

CVE-2018-11759

CVE-2018-11759 Proof of concept Description The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported b...

rat-shell

Stories in Ready Windows Remote Access Trojan RAT using .NET Sockets Client-server binaries and source-code for controlling a remote machine behind a NAT with a command-line shell in Windows. Although the core provides support for communication with multiple RATs, the command-line interface used...

CVE-2026-40022

camel-platform-http-main Authentication Bypass on Non-Root Context Paths CVE-2026-40022 This project demonstrates an authentication bypass in Apache Camel's camel-platform-http-main component the embedded HTTP / management server of the Camel main runtime, tracked as CVE-2026-40022. When...

CVE-2026-44277

🚨 CVE-2026-44277 - FortiAuthenticator Unauthenticated RCE Critical Unauthenticated Remote Code Execution in Fortinet FortiAuthenticator 📋 Overview CVE-2026-44277 is a critical vulnerability in Fortinet FortiAuthenticator that allows unauthenticated attackers to achieve Remote Code Execution RCE v...

CVE-2021-26855

CVE-2021-26855-PoC PoC exploit code for CVE-2021-26855. Original code was developed by https://github.com/GreyOrder. The original repo was deleted shortly after additional features user enumeration etc. were added. Please post a pull request, if you have the latest version. CVE-2021-26855 ssrf...

SharpMove

SharpMove - .NET authenticated execution for remote hosts Building To compile open Visual Studio project and compile for release. Options WMI SCM DCOM Multiple Task Scheduler Service DLL Hijack DCOM Server Hijack Modify Scheduled Task Modify Service binpath SharpMove.exe action=query...

tomcatWarDeployer

tomcatWarDeployer Apache Tomcat auto WAR deployment & pwning penetration testing tool. What is it? This is a penetration testing tool intended to leverage Apache Tomcat credentials in order to automatically generate and deploy JSP Backdoor, as well as invoke it afterwards and provide nice shell...

CVE-2026-109106

A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulnerability is the function com.infraware.service.m.n.a of the component Document Intake. The manipulation of the argument displayname results in path traversal. The attack is only possible with local...

CVE-2026-103316

The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLDINSERTLIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining...

CVE-2024-32640-SQLI-MuraCMS

Muraider - Automating the detection & Exploitation of CVE-2024-32640 \ SQLi in Mura/Masa CMS Usage Detection: python3 CVE-2024-32640.py --url https://target.com/ Ghauri Exploitation Pass '-g' or '--ghauri' as argument: Parse in any arguments that you wish to use with Ghauri, following their...

DahuaLoginBypass

DahuaLoginBypass Chrome extension that uses vulnerability CVE-2021-33044 to log in to Dahua IP cameras and VTH/VTO video intercom devices without authentication. For other device types NVR/DVR/XVR, etc, there exists CVE-2021-33045 which cannot be exploited with an ordinary web browser. These...