CVE-2024-3495-Poc

CVE-2024-3495-Poc CVE-2024-3495 Country State City Dropdown CF7 Accept-Encoding: gzip, deflate Accept: / Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko...

CVE-2022-41840-PoC

Zenario CMS 9.3 - Unauthenticated RCE Exploit CVE-2022-41840 An unauthenticated remote code execution RCE vulnerability affecting Zenario CMS version 9.3 and earlier. The exploit leverages a file upload vulnerability in the AJAX endpoint to upload a PHP webshell and achieve code execution...

drupal-exploit

drupal-exploit CVE-2018-7600 This script will exploit the CVE-2018-7600 vulnerability in Drupal 7 : drupal.py https://drupaldomain/drupal/ uid=33www-data gid=33www-data groups=33www-data https://nvd.nist.gov/vuln/detail/CVE-2018-7600 https://www.drupal.org/sa-core-2018-002...

CVE-2025-39459-Nuclei-Template

📄 Nuclei Template for CVE-2025-39459 🚀 Overview This repository features a Nuclei template specifically designed to detect an Unauthenticated Privilege Escalation Vulnerability CVE-2025-39459 in the Real Estate 7 WordPress Theme. This issue allows unauthenticated attackers to register as...

CVE-2026-81648

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-81648 CVE-2026-81648 CryptoPayment Gateway 1.2.2 - Granwill I am @abraxasnull. Loopback lab. The client is CVE-2026-81648-Abraxas-Labs.py. The guard is never called. Direct POST vendor/cryptd/ajax.php, not...

wp-jobhunt-exploit

wp-jobhunt-exploit CVE-2018-19487, CVE-2018-19488, exploit for WordPress wp-jobhunt plugin wp-jobhunt plugin is a plugin used with JobCareer theme: https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636 see changelog at the bottom Python exploit for CVE-2018-19487 AJ...

CVE-2020-9380

PoC IPTV Smarters Exploit Usage python gld.py -u http://www.pirate-ilegal-tv.com/ -i Vulnerability file includes/ajax-control.php: ?php / @ PHP 5.6 @ Decoder version : 1.0.0.1 @ Release on : 24.03.2018 @ Website : http://EasyToYou.eu / sessionstart; if fileexists"functions.php" includeonce...

CVE-2025-1913-PoC

CVE-2025-1913 -- Proof of Concept PoC This repository contains an educational-only Proof of Concept PoC for CVE-2025-1913 , created by Suhaib518 🇸🇦. This PoC demonstrates how specially crafted serialized PHP input may trigger vulnerable logic in affected WordPress components. The PoC is safe and...

CVE-2020-24186-wpDiscuz-7.0.4-RCE

POC CVE-2020-24186-wpDiscuz-7.0.4-RCE WordPress wpDiscuz 7.0.4 Remote Code Execution A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the...

lab-cve-2025-57819

Work in Progress FreePBX CVE-2025-57819 Lab - Unauth SQLi → RCE Chain Nuclei POC Spin up a reproducible FreePBX 15 lab Docker to validate CVE-2025-57819 — a critical unauthenticated SQL injection in userman AJAX endpoints that can be chained to RCE. Includes a working Nuclei template...

CVE-2022-21661

CVE-2022-21661 CVE-2022-21661 docker and poc functions.php needs to replace the original functions.php in the image, and mount it directly in docker-compose.yml poc POST /wp-admin/admin-ajax.php HTTP/1.1 Host: your-ip:8080 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:132.0 Gecko/201001...

CVE-2025-30772

🚨 CVE-2025-30772 - Privilege Escalation in WPC Smart Upsell Funnel for WooCommerce 📅 Published: March 27, 2025 🔐 CVSS Score: 8.8 High 🔥 CWE-862: Missing Authorization 🐞 Vulnerability Summary A Missing Authorization vulnerability in the WPC Smart Upsell Funnel for WooCommerce plugin allows...

CVE-2025-1661

CVE-2025-1661 - Unauthenticated Local File Inclusion LFI in HUSKY – Products Filter Professional for WooCommerce Description The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion LFI in all versions up to and including 1.3.6.5 via the...

CVE-2021-24499

CVE-2021-24499 Mass exploitation of CVE-2021-24499 unauthenticated upload leading to remote code execution in Workreap theme. The AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other wa...

RAU_crypto

RAUcrypto Combined exploit for Telerik UI for ASP.NET AJAX. File upload for CVE-2017-11317 and CVE-2017-11357 - will automatically upload the file .NET deserialisation for CVE-2019-18935 Now supports testing for the target's ability to pull in remote payloads from an attacker-hosted SMB service...

CVE-2025-4380

CVE-2025-4380 - Ads Pro Plugin = 4.89 - Local File Inclusion LFI Exploit Description This Python exploit targets Ads Pro Plugin ≤ 4.89 for WordPress, vulnerable to Local File Inclusion LFI via the bsapreviewcallback AJAX action. An unauthenticated attacker can exploit this to read arbitrary files...

CVE-2025-3605

🚀 CVE-2025-3605 Exploit Guide 🛡️ Vulnerability Summary The Frontend Login and Registration Blocks plugin for WordPress versions = 1.0.7 is vulnerable to privilege escalation via account takeover. The issue arises because the plugin does not validate user identity when updating sensitive details...

CVE-2025-5815-Nuclei-Template

📄 Nuclei Template for CVE-2025-5815 🚀 Overview This repository features a Nuclei template specifically designed to detect an Unauthenticated Bot Logging Disable Vulnerability CVE-2025-5815 in the Traffic Monitor WordPress plugin. This issue allows unauthenticated attackers to remotely disable bot...

CVE-2017-11317-auto-exploit-

Vulnerabilities CVE-2017-11317 . https://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference...

CVE-2021-38314

CVE-2021-38314 What is the vulnerability? The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a given site but deterministi...