CVE-2020-14321-modified-exploit

CVE-2020-14321-modified-exploit original: https://github.com/HoangKien1020/CVE-2020-14321 Modified Moodle exploit for privilege escalation Dorvack ┌──kali㉿kali-/…/192.168.1.121/exploits/CVE-2020-14321/modified └─$ proxychains python cve202014321.py -url https://formacion.dorvack.corp -cookie...

linux-basics-for-hackers-notes

Linux Basics for Hackers — Course A structured course built from personal study notes of the book Linux Basics for Hackers by OccupyTheWeb. Each module breaks down the core concepts, commands, and practical examples in plain English — straightforward enough for beginners, detailed enough to...

hackaday-u

Hackaday U - Introduction to Reverse Engineering with Ghidra This repository contains the exercises and resource materials for the Hackaday-U Course: Introduction to Reverse Engineering with Ghidra. The purpose of this course is to provide an overview of how to use Ghidra and how to reverse...

CVE-2026-61803

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount othe...

CVE-2026-39375

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without...

CVE-2026-61803 Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount othe...

CVE-2026-61803 Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount othe...

CVE-2026-61803

Frappe Learning Management System (LMS) versions prior to 2.52.1 are vulnerable to a business-logic integrity issue within the course/certificate checkout flow. The system improperly accepts client-controlled pricing , which allows an authenticated user to complete a purchase for a paid course or...

EUVD-2026-114197

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount othe...

CVE-2026-39375 Frappe LMS has Stored XSS in Course Meta

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without...

CVE-2026-39375 Frappe LMS has Stored XSS in Course Meta

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without...

CVE-2026-39375

The Frappe Learning Management System (LMS) is vulnerable to stored cross-site scripting (XSS) in versions prior to 2.52.0 . An authenticated user with a course editing role can inject malicious JavaScript via meta tag fields within the Course Management module . The root cause is the lack of ade...

EUVD-2026-114195

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without...

CVE-2026-119554

A flaw was found in Moodle's External database enrolment plugin. This vulnerability allows an authenticated attacker with course editing privileges to inject malicious SQL Structured Query Language commands through the course identification number field. During scheduled synchronization with...

CVE-2026-1375

CVE-2026-1375: Authenticated IDOR / Broken Access Control in Tutor LMS Plugin Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. Do not use this information to exploit systems...

CVE-2008-2992

EP284U This project is about CVE-2008-2992. Author Name| Mail ---|--- Jonas Holmberg| [email protected] Table of Contents EP284U Author Table of Contents Project Proposal Final Report Scripts Installation and Setup Proof of Concept Project Proposal Project proposal was the intend project...

CVE-2020-14321

Python script to exploit CVE-2020-14321 - Moodle 3.9 Course enrolments allowed privilege escalation from teacher role into manager role to RCE. Teachers of a course were able to assign themselves the manager role within that course. Payload extracted from:...

CVE-2020-14321

CVE-2020-14321 Course enrolments allowed privilege escalation from teacher role into manager role to RCE Maybe someone needs Python script, therefore, I have written it to exploit. How to use this PoC: How to use this PoC script Case 1. If you have vaid credentials: python3 cve202014321.py -u...

CVE-2025-67730

CVE-2025-67730 – Stored Cross-Site Scripting XSS Overview CVE ID: CVE-2025-67730 Vulnerability Type: Stored Cross-Site Scripting XSS Severity: Medium–High context-dependent This vulnerability allowed authenticated users to inject malicious HTML and JavaScript into description fields of Job , Cour...

CVE-2026-119554 Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sy...