CVE-2026-7229-SQLI

Authenticated SQL Injection in Coaching Management System Allows Database Dump Description A SQL Injection vulnerability exists in the Coaching Management System in PHP. The complaintreply parameter in the admin reply functionality is not properly sanitized before being used in SQL queries. An...

CVE-2026-0075

CVE-2026-0075 ContactsProvider Research PoC A controlled-lab Android research prototype for evaluating the observable behavior associated with CVE-2026-0075 in ContactsProvider2. Overview CVE-2026-0075 is an Android local elevation-of-privilege issue in ContactsProvider2. The public advisory...

nmap-vulners

nmap-vulners Turn an nmap service scan into a ranked list of CVEs, exploits and what is being attacked in the wild. One NSE script that takes the software nmap already identified, asks the Vulners database what is known about it, and prints the answer inside the scan report - worst first, by what...

CVE-2020-13405

CVE-2020-13405 Base Score: 7.5 HIGH🟥 MicroWeber is an open-source Content Management System CMS written in PHP. It allows web administrators to easily build a website by dragging and dropping components where they want them to be. It is a popular choice among those looking to start a website that...

kviklet

Kviklet Kviklet.dev | Release Notes | Discord Secure access to production environments without impairing developer productivity. Kviklet pronounced Quick-let applies the Four-Eyes Principle to production database access, with a pull request-like review and approval workflow for individual SQL...

rustsec

RustSec Crates 🦀🛡️📦 The RustSec Advisory Database is a repository of security advisories filed against Rust crates published via crates.io. The advisory database itself can be found at: https://github.com/RustSec/advisory-db About this repository This repository contains a Cargo Workspace with all...

MSSQL-Analysis-Coerce

MSSQL Analysis Services - Coerced Authentication A technique to coerce a Windows SQL Server to authenticate on an arbitrary machine. This proof of concept is co-authored by : Podalirius: Worty: Proof of concept In order to trigger the authentification as the local machine account, we need to...

PHP-Shell-Detector

Web Shell Detector Web Shell Detector – is a php script that helps you find and identify php/cgiperl/asp/aspx shells. Web Shell Detector has a “web shells” signature database that helps to identify “web shell” up to 99%. By using the latest javascript and css technologies, web shell detector has ...

slater

Slater Current version:v0.25.4 — all releases. In one line: Slater serves graphs that don't fit in memory — hundreds of millions of nodes and billions of edges in low hundreds of MB of RAM — over standard Bolt , so any neo4j driver just works, with disk-native vector search sitting next to the...

nuvola

nuvola nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted...

oracleShell

oracleShell Oracle Database Command Execution Test Environment - DBA Privileges: SELECT FROM v$version Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production PL/SQL Release 11.2.0.1.0 - Production "CORE 11.2.0.1.0 Production" TNS for 32-bit Windows: Version 11.2.0.1.0 - Production...

CVE-2019-9053-Exploit-Python-3

CVE-2019-9053 Exploit Python 3 This repository contains an exploit for the vulnerability CVE-2019-9053 found in the CMS Made Simple CMSMS software. The exploit has been modified to work with Python 3 and is compatible with CMSMS version 2.2.9 and below. Description CVE-2019-9053 is a Time-Based...

bl_sbx

blsbx itunesstored & bookassetd Sandbox Escape This repository contains a proof-of-concept demonstrating how maliciously crafted downloads.28.sqlitedb and BLDatabaseManager.sqlite databases can escape the sandbox of itunesstored and bookassetd on iOS. By abusing their download mechanisms, the POC...

CVE-2024-32640-SQLI-MuraCMS

Muraider - Automating the detection & Exploitation of CVE-2024-32640 \ SQLi in Mura/Masa CMS Usage Detection: python3 CVE-2024-32640.py --url https://target.com/ Ghauri Exploitation Pass '-g' or '--ghauri' as argument: Parse in any arguments that you wish to use with Ghauri, following their...

CVE-2026-10757

There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service which could, depending on the service being configured in a non-default access configuration “public”, include an...

the-bastion

🔒 The Bastion Overview Bastions are a cluster of machines used as the unique entry point by operational teams such as sysadmins, developers, database admins, ... to securely connect to devices servers, virtual machines, cloud instances, network equipment, ..., usually using ssh. The Bastion...

OWASP-WSTG-Rag

OWASP WSTG RAG A Retrieval-Augmented Generation RAG system that indexes the OWASP Web Security Testing Guide WSTG into a vector database, providing instant access to security testing methodologies via REST API and MCP Model Context Protocol for Claude Code integration. Features Complete WSTG...

msploitego

msploitego - The Pentesting suite for Maltego THIS IS A BETA RELEASE, please be nice and report any issues Whats New New Features Now supporting multiple workspaces for Metasploit via Postgres queries A bash script that runs tons of auxiliary modules against targets. Really 'fattens' up the...

armory

dM. ,MMb d'YM. ,P Mb MM 6MM MM 6MMb 6MMb 6MMMMMb MM 6MM MM M' d' YM. MM69 " MM69 MM69 Mb 6M' Mb MM69 " Mb d' ,PMbMMMMMMMMMMMMMMYM.,P d' YM. MM MM MM MM MM MM MM MM M \ ,MMMMMMMMbMMMMMMMMMMMMMMMbd'\ d' YM. MM MM MM MM YM. ,M9 MM YMP dM dMMMM MM MM MM YMMMMM9 MM M d' 8,P YMM Description This is...

CVE-2026-10757

A SQL injection vulnerability exists in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux . An attacker with access to the service—which could include an anonymous attacker if the service is configured with "public" access—can execute unauthorized database-specific functions. Patc...