psobf

Ofuscador de PowerShell Su objetivo es transformar el código para dificultar el análisis y las firmas estáticas, útil en laboratorios y compromisos autorizados de Red Team/Pentesting. Soporta 6 niveles de ofuscación más una arquitectura de transformaciones/pipeline que permite apilar técnicas com...

PageTableInjection

PageTableInjection Code Injection, Inject malicious payload via pagetables pml4. Introduction This is just a proof-of-concept of the page table injection technique to inject malicious code into the arbitrary user processes. On Windowsand some modern OSes, every process has a its PML4 a.k.a...

CVE-2023-46818

CVE-2023-46818 Python Exploit 🔥 Description This Python exploit script targets a security vulnerability in ISPConfig's records POST parameter to /admin/languageedit.php, which is not properly sanitized. This allows an authenticated admin to inject and execute arbitrary PHP code. ⚠️ Affected...

CVE-2022-22947_EXP

1. Spring Cloud Gateway Remote Code Execution Vulnerability Hazard Level: High POC/EXP: Public CNVD ID: CNNVD-2022-16402 CVE ID: CVE-2022-22947 2. Affected Versions: VMWare Spring Cloud GateWay 3.1.0 VMWare Spring Cloud GateWay =3.0.0, python cve-2022-22947.py 验证单个目标： 1、python cve-2022-22947.py...

tplmap

Tplmap Este proyecto ya no recibe mantenimiento. Estaré encantado de fusionar nuevos PRs siempre que no rompan el conjunto de pruebas. Tplmap ayuda en la explotación de vulnerabilidades de Inyección de Código e Inyección de Plantillas del Lado del Servidor SSTI mediante diversas técnicas de escap...

CVE-2022-22947

Spring Cloud Gateway Example: python3 exploit.py http://localhost:8080 'id' + St...

pe_to_shellcode

petoshellcode Convierte un PE para que pueda ser inyectado como un shellcode normal. Al mismo tiempo, el archivo de salida sigue siendo un PE válido. Soporta tanto PEs de 32 como de 64 bits Autores:@hasherezade y @hh86 Objetivo El objetivo de este proyecto es proporcionar la posibilidad de genera...

spring-cve-2022-22947

spring-cve-2022-22947 Spring cloud gateway code injection : CVE-2022-22947...

CVE-2025-3248

POC - Remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code - CVE-2025-3248 Overview Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP request...

CVE-2019-8331

Eng Description CVE-2019-8331 is a Cross-Site Scripting XSS security vulnerability found in Bootstrap, a JavaScript library widely used for developing websites and mobile applications. This vulnerability occurs because Bootstrap does not properly sanitize data sent via thedata-template attribute ...

drow

drow Descripción TL;DR drow es una utilidad de línea de comandos que se utiliza para inyectar código y enganchar el punto de entrada de ejecutables ELF post-compilación. Toma ejecutables ELF sin modificar como entrada y exporta un ELF modificado que contiene un payload suministrado por el usuario...

drow

drow Description TL;DR drow is a command-line utility that is used to inject code and hook the entrypoint of ELF executables post-build. It takes unmodified ELF executables as input and exports a modified ELF contianing an embedded user-supplied payload that executes at runtime. Slightly more...

CVE-2021-42694

CVE-2021-42694 Generate malicious files using recently published homoglyph-attack vulnerability, which was discovered at least in C, C++, C, Go, Python, Rust, JS, ... Cite from cve.mitre.org An issue was discovered in the character definitions of the Unicode Specification through 14.0. The...

CVE-2021-40904

CVE-2021-40904 - RCE via CheckMk's Dokuwiki embedded application Application: CheckMK Management Web Console Software Revision: From 1.5.0 to 1.5.0p25 Attack type: RCE Solution: Upgrade to version 1.6 or higher. Summary: The web management console of CheckMk Raw Edition versions 1.5.0 to 1.5.0p25...

php-jpeg-injector

php-jpeg-injector Inyecta cargas útiles de php en imágenes jpeg. Relacionado con esta publicación. Caso de Uso Tienes una aplicación web que procesa una imagen jpeg a través de la librería gráfica GD de PHP. Descripción Este script inyecta código PHP en una imagen jpeg especificada. La aplicación...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

CVE-2025-3248

CVE-2025-3248 ★ CVE-2025-3248 Langflow RCE PoC ★ Lab Setup docker pull langflowai/langflow:1.2.0 docker run -d --name CVE-2025-3248 -p 7860:7860 langflowai/langflow:1.2.0 localhost:7860 Description Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code...

CVE-2026-3300

CVE-2026-3300 - Everest Forms Pro Unauthenticated Stored Cross-Site Scripting Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: CRITICAL CVSS: 9.8 Impact: Confidentiality, Integrity, Availability Published: 2026-03-31 Technical...

CVE-2020-8644-PlaySMS-1.4

CVE-2020-8644-PlaySMS-1.4 Python script to exploit PlaySMS before 1.4.3 Execution Open a port on your machine: And the execute exploit.py: ./exploit.py Changing the exploit Tou may want to change the reverse shell created by exploit.py To do this, you can change the function createrevshellencoded...

CVE-2026-105329

A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php of the component PluginManager. Executing a manipulation can lead to code injection. The attack can be launched remotely. The exploit has be...