Exploits

Exploits Some Exploits I've written...

WCAPF WooCommerce Ajax Product Filter - SQL Injection

WCAPF WooCommerce Ajax Product Filter = 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely. id: CVE-2026-3396 info: name: WCAPF WooCommerce Ajax Product Filter ...

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

WordPress Media Library Assistant < 3.40 - SQL Injection

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role and above to perform SQL injection. id: CVE-2026-16959 info: name: WordPress Media...

GutenKit Blocks Addon < 2.5.0 - Stored Cross-Site Scripting

GutenKit Blocks Addon before 2.5.0 lets an authenticated Author upload an unsanitized SVG through the WordPress REST media endpoint; JavaScript in the SVG can execute when a user opens its URL. id: CVE-2026-19697 info: name: GutenKit Blocks Addon 2.5.0 - Stored Cross-Site Scripting author:...

AeroCMS 0.1.1 - SQL Injection

AeroCMS 0.1.1 contains a SQL injection caused by unsanitized author parameter, letting attackers execute arbitrary SQL commands, exploit requires crafted author input. id: CVE-2022-38812 info: name: AeroCMS 0.1.1 - SQL Injection author: shivampand3y severity: medium description: | AeroCMS 0.1.1...

yara

!IMPORTANT This project is in maintenance mode. More info: https://virustotal.github.io/yara-x/blog/yara-x-is-stable/ YARA in a nutshell YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malwar...

WordPress_4.9.8_RCE_POC

Summary A simple PoC for WordPress RCE author priviledge, refer to CVE-2019-8942 and CVE-2019-8943. Affected Version WordPress " 3. Detect current theme by WPScan wpscan -u -et, e.g. twentyseventeen as default in wordpress 4.9.8 4. Upload the payload image file poc.jpg Login the author account;...

termshark

Termshark A terminal user-interface for tshark, inspired by Wireshark. V2.4 is out now with packet search and profiles for colors and columns! See theChangeLog. If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help! Features Rea...

openstego

OpenStego OpenStego is a steganography application that provides two functionalities: 1. Data Hiding: It can hide any data within an image file. 2. Watermarking: Watermarking image files with an invisible signature. It can be used to detect unauthorized file copying. Usage For GUI: Use menu...

CVE-2021-29447

WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 Using Step1. Run WordPress $ make up-wp Step2. Run Attacker web server $ make up-mal Step3. Generate malicious WAV file Without wavefile npm Recommend $ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00%remote;%init;%trick; \x00'...

pafish

Pafish Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do. The project is free and open source; the code of all the anti-analysis techniques is publicly available. Pafish executables for...

CVE-2026-126275

NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plan...

CVE-2026-116615

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the postcontent parameter. This is due to asymmetric parsing between the save-time strip filter...

EUVD-2026-125246

NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plan...

CVE-2026-126275 NocoDB before 2026.09.0 IDOR in Row Comment Operations

NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plan...

CVE-2026-120658

The Download Manager plugin for WordPress (versions 6.0.0-7.6.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the file[additional_previews][] parameter. The root cause is insufficient input sanitization and output escaping within the wpdm_sanitize_array() function. While the function u...

EUVD-2026-124985

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fileadditionalpreviews' parameter in all versions up to, and including, 7.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-124976

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the postcontent parameter. This is due to asymmetric parsing between the save-time strip filter...

presentations

Presentations by Jorge Orchilles Year| Organization| Talk Title| Slides| Video ---|---|---|---|--- 2022| CactusCon 10| Operationalized Purple Teaming| Slides| YouTube 2021| GRIMMCon 0x6| State of C2 Matrix - 2021| Slides| 2016| FS-ISAC| Purple Team| Slides| 2011| Hack Miami| Vulnerability...