CVE-2023-22515-Scan

CVE-2023-22515-Scan About This is simple scanner for CVE-2023-22515, a critical vulnerability in Atlassian Confluence Data Center and Server that is actively being exploited in the wild by threat actors in order "to create unauthorized Confluence administrator accounts and access Confluence...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field Assigned CVE ID: CVE-2026-66418 Target Repository:...

CVE-2026-108975

A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function moveuploadedfile of the file admin/addadmin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The...

CVE-2023-42793

TeamCity CVE-2023-42793 Exploit This Python script exploits a security vulnerability CVE-2023-42793 in JetBrains TeamCity, allowing an attacker to create a new user with administrative privileges. Usage The script takes either a single TeamCity instance URL or a list of URLs as input. The provide...

Exchange2domain

Exchange2domain All in One tools of privexchange . You only need to open the web server port, so no high privileges are required. Great writeup! Abusing Exchange: One API call away from Domain Admin. Requirements These tools require impacket. You can install it from pip with pip install impacket...

GodGenesis

Welcome To God Genesis God Genesis is a C2 server purely coded in Python3 created to help Red Teamers and Penetration Testers. Currently It only supports TCP reverse shell but wait a min, its a FUD and can give u admin shell from any targeted WINDOWS Machine. The List Of Commands It Supports :-...

360WFP_Exploit

360WFPExploit A proof-of-concept PoC demonstrating potential abuse of the 360 Security WFP driver 360netmonx64wfp.sys interface, aimed at verifying the risk that IOCTL interfaces without caller authentication may be misused by third-party programs. This project is intended for security research a...

CVE-2026-23550

██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ███████╗ ███████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ╚════██╗╚════██╗██╔════╝ ██╔════╝██╔═████╗ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ █████╔╝ █████╔╝███████╗ ███████╗██║██╔██║ ██║ ╚█...

Bludit-3-9-2-bb

Bludit-3-9-2-bb Bludit 3.9.2 - bruteforce bypass - CVE-2019-17240 Very simple script based on CVE-2019-17240. Original POC and explanation: https://github.com/bludit/bludit/pull/1090. usage: python ./bludit-3-9-2-bb.py -l 'http://sitename.com/admin/login' -u ./usernamesfilelist.txt -p...

CVE-2021-45232-RCE

CVE-2021-45232 CVE-2021-45232 Apache apisix Dashboard api unauth rce Version: 2.10.1 Fofa: title="Apache APISIX Dashboard" POC: IP:PORT/apisix/admin/migrate/export...

Check-LocalAdminHash

Check-LocalAdminHash Check-LocalAdminHash is a PowerShell tool that attempts to authenticate to multiple hosts over either WMI or SMB using a password hash to determine if the provided credential is a local administrator. It's useful if you obtain a password hash for a user and want to see where...

CVE-2022-1386-FusionBuilder-SSRF

CVE-2022-1386 – Fusion Builder Example: python3 exploitcve20221386.py https://vulnerable.site https://abc123.oast.fun Use Interact.sh or Burp Collaborator to receive the callback. 📋 Sample Output Fetching nonce from target... Sending SSRF payload to https://abc123.oast.fun... + SSRF confirmed:...

CVE-2026-108975

The SourceCodester Library Management System 1.0 contains a security flaw in the admin/add_admin.php file, specifically affecting the move_uploaded_file function. By manipulating the image argument, an attacker can achieve unrestricted upload of files. This vulnerability can be initiated remotely...

EUVD-2026-98315

A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function moveuploadedfile of the file admin/addadmin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The...

MalSCCM

MalSCCM This tool allows you to abuse local or remote SCCM servers to deploy malicious applications to hosts they manage. To use this tool your current process must have admin rights over the SCCM server. Typically deployments of SCCM will either have the management server and the primary server ...

reportly

Reportly is an EntraID user activity report tool. About the tool This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following: 1. Information about t...

CVE-2023-50564

CVE-2023-50564 📌 Description This exploit allows an authenticated admin in Pluck CMS v4.7.18 to upload a malicious ZIP module containing a PHP shell, resulting in remote code execution RCE. ⚙️ Features Authenticates to the target using a valid username and password Automatically creates a ZIP...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...

wotop

Web-On-Top-Of-Protocol WOTOP ██╗ ██╗ ██████╗ ████████╗ ██████╗ ██████╗ ██║ ██║██╔═══██╗╚══██╔══╝██╔═══██╗██╔══██╗ ██║ █╗ ██║██║ ██║ ██║ ██║ ██║██████╔╝ ██║███╗██║██║ ██║ ██║ ██║ ██║██╔═══╝ ╚███╔███╔╝╚██████╔╝ ██║ ╚██████╔╝██║ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═════╝ ╚═╝ Introduction WOTOP is a tool meant to...

CVE-2023-2859

CVE-2023-2859: Stored HTML injection in folderName affecting Admin in TeamPass 3.0.9 - M Nadeem Qazi Hi, I have found a major vulnerability in the nilsteampassnet/teampass application that involves stored HTML injection in the FolderName field. By inserting malicious HTML code into the FolderName...