wordpress-CVE-2024-10924--exploit

🚀 WordPress Really Simple Security Plugin Vulnerability CVE-2024-10924 📌 Overview WordPress is one of the most popular open-source Content Management Systems CMS, powering millions of websites worldwide—from personal blogs to full-fledged e-commerce platforms. However, in November 2024 , a critic...

CVE-2025-10352-POC

CVE-2025-10352 POC - Admin Account Creation 🛠️ POC for CVE-2025-10352: An unauthenticated endpoint in Melis Platform melis-core that allows creation of an administrator account via a crafted HTTP request to a specific admin endpoint. 🔗 References 📄 CVE-2025-10352 on MITRE 📄 Melis Platform Warning...

Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-50564

CVE-2023-50564 - Pluck CMS v4.7.18 Remote Code Execution RCE Exploit Description This script exploits a Remote Code Execution RCE vulnerability in Pluck CMS v4.7.18. The vulnerability allows a malicious user to upload a malicious PHP file to the server and execute it, gaining remote command...

DotCMS-CVE-2022-45782

CVE-2022-45782 – dotCMS Password Reset Token Predictability PoC This repository contains a proof-of-concept exploit for CVE-2022-45782, a vulnerability in dotCMS where password-reset tokens are generated using the non-cryptographic method RandomStringUtils.randomAlphanumeric. Because this token i...

cve-2024-0012-poc

cve-2024-0012-poc CVE-2024-0012 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS software. This vulnerability allows an unauthenticated attacker to access the management web interface over the network, obtain PAN-OS administrator privileges, and thereby perform administrativ...

CVE-2025-68860

WordPress Mobile Builder = 1.4.2 - Broken Authentication CVE-2025-68860 Description The WordPress Mobile Builder plugin version 1.4.2 and below has a Broken Authentication vulnerability that allows an attacker to generate a valid JWT token with the default secret "examplekey" and authenticate as...

CVE-2024-54363

CVE-2024-54363 Wp NssUser Register successful, just Check this: Login...

Gallery-Plugin-SQL-Injection

Exploit Title: Wordpress Video Gallery - YouTube Gallery and Vimeo Gallery Plugin SQL Injection Date: 2024-07-05 Exploit Author: tmrswrr Category : Webapps Vendor Homepage: https://total-soft.com/wp-video-gallery/ Version 2.3.6 1. Access the Admin Panel: Navigate to the admin panel of your...

MAL-012

MAL-012: Reflected Cross-Site Scripting in Admin Console leading to Remote Code Execution in Payara Server A reflected Cross Site Scripting XSS attack was found in the Payara Admin Console. By convincing an admin user to access the malicious URL and click the “Choose File” button, an attacker can...

Vehicle-Service-Management-System-Multiple-Privilege-Escalation-Leads-to-CRUD-Operations

CVE-2021-46075 Exploit Title: Vehicle Service Management System - 'Multiple' Privilege Escalation Leads to CRUD Operations Exploit Author: SANU P.L CVE: CVE-2021-46075 CVSS: 7.2 HIGH References:...

CVE-2024-24401

Vulnerability Report CVE Disovered DESIGNED TO BE RUN ON KALI LINUX Notes Nagios has patched version 2024R1.0.1 in all recent downloads. To determine if a target is vulnerable, ensure they are using an older download of 2024R1.0.1. The updated script checks to make sure that the target system is...

Craft-CMS-3.0.25---Cross-Site-Scripting

Craft-CMS-3.0.25 - Cross-Site-Scripting Craft CMS 3.0.25 - Cross-Site Scripting Vulnerability CVE-CVE-2018-20418 https://vulners.com/cve/CVE-2018-20418 Proof of Concept Allows it to run a Cross-Site Scripting by saving a new title from the console tab. POST...

CVE-2025-41646---Critical-Authentication-Bypass-

CVE-2025-41646---Critical-Authentication-Bypass- CVE-2025-41646 - Critical Authentication bypass 🔓 CVE-2025-41646 - RevPi WebStatus Authentication Bypass PoC A critical authentication bypass vulnerability CVE-2025-41646 in RevPi WebStatus ≤ v2.4.5 allows an attacker to log in as admin without val...

TheDoc

TheDoc is a simple but very useful SQLMAP automator with built in admin finder, hash crackerusing hashcat and more! Abilities: Counts total injections tried. Crawls given domain for vulnerabilties. Extracts Database Infos via injection URL Extract Users, Passwords & emails via injection URL...

CVE-2025-30911

Exploit for CVE-2025-30911 – WordPress RomethemeKit = 1.5.4 This script exploits a critical vulnerability in the RomethemeKit For Elementor WordPress plugin = v1.5.4 that allows authenticated arbitrary plugin installation and activation , potentially leading to Remote Code Execution RCE. 🛠️...

SimpleCTF-UpdatedExploit

CMS Made Simple = 2.2.10 SQL Injection Exploit Overview This Python script exploits an unauthenticated SQL injection vulnerability in CMS Made Simple = 2.2.10 CVE-2019-9053. The exploit extracts sensitive information such as the salt, username, email, and password of the administrator from the CM...

CVE-2025-45619

Issue details Camera model PTC310UV2 running firmware version 0.1.0000.59. The vulnerability is found in the web interface that is used to access the camera. The vulnerability was found during a penetration test, thus, certain information in the PoC screenshots have been redacted. Description Thi...

CVE-2024-9698

CVE-2024-9698 Crafthemes Demo Import = 3.3 - Arbitrary File Upload Exploit 📌 Overview This exploit targets a critical vulnerability CVE-2024-9698 in the Crafthemes Demo Import plugin for WordPress. The vulnerability allows authenticated administrators to upload arbitrary files to the affected...

CVE-2025-50286

Grav Admin Direct Install RCE CVE-2025-50286 Metasploit module and lab setup for authenticated Remote Code Execution in the Grav Admin Plugin Direct Install functionality. Overview CVE: CVE-2025-50286 Impact: Authenticated RCE Vector: Admin panel → Direct Install Result: Arbitrary command executi...

CVE-2024-9933

CVE-2024-9933 WatchTowerHQ = 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check Description: The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.6. This is due to the 'watchtowerotatoken' default value is...