nuvola

nuvola nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted...

bl_sbx

blsbx itunesstored & bookassetd Sandbox Escape This repository contains a proof-of-concept demonstrating how maliciously crafted downloads.28.sqlitedb and BLDatabaseManager.sqlite databases can escape the sandbox of itunesstored and bookassetd on iOS. By abusing their download mechanisms, the POC...

cwe-tool

cwe-tool A command line CWE discovery tool based on OWASP / CAPSEC database of Common Weakness Enumeration. Official OWASP CWE Toolkit Page Install Executable with Node.js tooling If you have a Node.js environment, you can invoke cwe-tool using the npx tool as follows: npx cwe-tool ...command-lin...

slater

Slater Current version:v0.25.2 — all releases. In one line: Slater serves graphs that don't fit in memory — hundreds of millions of nodes and billions of edges in low hundreds of MB of RAM — over standard Bolt , so any neo4j driver just works, with disk-native vector search sitting next to the...

cacti-cve-2023-39361

Cacti ™ Running Cacti from the develop Branch IMPORTANT When using source or by downloading the code directly from the repository, it is important to run the database upgrade script if you experience any errors referring to missing tables or columns in the database. Changes to the database are...

grafanaExp

grafanaExp Exploit Grafana CVE-2021-43798 arbitrary file read vulnerability to automatically detect vulnerability, existing plugins, extract secret key, decrypt server database file, and output datasourrce info. Usage Provides exp and decode functionality. ➜ ./grafanaExp -h NAME: grafanaExp -...

CVE-2022-28346

CVE-2022-28346 A flaw was found in the Django package, which leads to a SQL injection. This flaw allows an attacker using a crafted dictionary containing malicious SQL queries to compromise the database completely. Table of Contents CVE-2022-28346 Description Environment Proof of Concept and...

CVE-2022-0739

CVE-2022-0739 My take on CVE-2022-0739 BookingPress exploit, based on destr4ct's POC - just prettier. Example Example usage against HackTheBox's MetaTwo machine, which hosts a WordPress with a vulnerable bookingpress plugin version 1.0.10. python booking-sqlinjector.py -u http://metapress.htb -nu...

cve-2025-57819

🛡️ FreePBX Hunter - CVE-2025-57819 🛡️ A powerful Nuclei toolkit for detecting and validating the critical FreePBX authentication bypass vulnerability. 📖 Table of Contents Click to expand About This Project Key Features Vulnerability Breakdown Templates in Action Finding Targets with Shodan Legal...

guasap-whatsapp-foresincs-tool

Guasap Forensic The Guasap Forensic implemented in Python under the GNU General Public License, for the extraction and analysis of files, data bases and logs for forensic WhatsApp. What it does? 1. Check root in device 2. Extract DB and multimedia files no root 3. Extract and analyze deleted...

CVE-2021-21311

CVE-2021-21311 Description SSRFServer-side Request Forgery in Adminer Open Source Database Management tool from v4.0.0 v4.7.8 patched at v4.7.9 Patch commit Usage exploit.py -h -target TARGET -redirect REDIRECT -host HOST -port PORT options: -h, --help show this help message and exit -target TARG...

CVE-2024-27348-Apache-HugeGraph-RCE

Remote Code Execution vulnerability in Apache HugeGraph Server CVE-2024–27348 CVE-2024-27348 is a critical Remote Command Execution RCE vulnerability in Apache HugeGraph Server, a popular graph database system. The flaw resides in the Gremlin traversal language interface, which allows users to...

malicious_extension_sentry

Malicious Chrome/Edge Extensions Database An automatically updated database of Chrome extensions removed from the Chrome Web Store for containing malware, policy violation, or bundling unwanted software 🌐 Live Dashboard Real-time search, filtering by threat category, and source reports, built on...

sqlmap-ai

SQLMap AI Assistant An AI-powered wrapper around SQLMap that makes SQL injection testing more accessible and automated. Features Core Features AI-Assisted Testing - Intelligent vulnerability analysis and recommendations Adaptive Testing - Step-by-step testing that adapts to target responses...

CVE-2024-1071

CVE-2024-1071 Ultimate Member Unauthorized Database Access / SQLi PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

POC-CVE-2026-58048

CVE-2026-58048 CVSS 4.0: 9.4 Critical | CWE-89: SQL Injection | NVD Authenticated cPanel user → arbitrary SQL as MySQL root via database rename. cPanel improperly preserves the user's session sqlmode ANSIQUOTES when executing rename operations as root — a backtick in the database name breaks out ...

ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure

ADB formerly Pirelli Broadband Solutions P.DGA4001N router with firmware PDGTEFSP4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service device restart as demonstrated by a direct request to 1...

LearnPress < 4.2.7.1 - SQL Injection

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'conlyfields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of...

Mitel MiCollab <= 9.8.0.33 - SQL Injection

A vulnerability in NuPoint Messenger NPM of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary...

CVE-2023-42860

CVE-2023-42860 Exploit for CVE-2023-42860 for research purposes only. This exploit works for versions of macOS earlier to 13.3, even though Apple´s changelog says it was fixed in version 14.1. Steps 1. Download the InstallAssistant.pkg 2. Modify the variable TARGETFILE on the exploit.sh file to a...