Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

MaxSite CMS <=109.1 - Remote Code Execution

MaxSite CMS through 109.1 allows unauthenticated remote attackers to execute arbitrary code via the MarkItUp editor preview AJAX endpoint, preview-ajax.php. The endpoint insufficiently authenticates the request, failing to ensure the user is logged in, and processes the attacker's input via unsaf...

WordPress Admin Font Editor <=1.8 - Cross-Site Scripting

WordPress Admin Font Editor 1.8 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

Welcart e-Commerce < 2.11.32 - SQL Injection

Welcart e-Commerce WordPress plugin 2.11.32 contains a SQL injection caused by improper sanitization of values from imported CSV files, letting users with Editor role and above execute arbitrary SQL commands, exploit requires Editor or higher privileges. id: CVE-2026-16065 info: name: Welcart...

WordPress Site Editor <=1.1.1 - Local File Inclusion

WordPress Site Editor through 1.1.1 allows remote attackers to retrieve arbitrary files via the ajaxpath parameter to editor/extensions/pagebuilder/includes/ajaxshortcodepattern.php. id: CVE-2018-7422 info: name: WordPress Site Editor =1.1.1 - Local File Inclusion author: LuskaBol,0x240x23elu...

CVE-2018-0802

CVE-2018-0802 CVE-2018-08022: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802 MITRE CVE-2018-0802: https://vulners.com/cve/CVE-2018-0802 0patch exploitation and patch video: https://www.youtube.com/watch?v=XU-U4K270Z4 Qihoo 360 blog post...

CVE-2023-46818

CVE-2023-46818 An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if adminallowlangedit is enabled. Usage ❯ python3 CVE-2023-46818.py Usage: python3 CVE-2023-46818.py Poc of CVE-2023-46818 ISPConfig = 3.2.11 - Code...

FormatFuzzer

FormatFuzzer FormatFuzzer is a framework for high-efficiency, high-quality generation and parsing of binary inputs. It takes a binary template that describes the format of a binary input and generates an executable that produces and parses the given binary format. From a binary template for GIF,...

r2ai

R2AI - Augmented reversing with LLM for radare2 ╭─────────────────────────────────╮ │ , . . , │ ╭──╮ │ : \ \ |: \ : | │ │ │ │ | |/ || , || : | │ │ O O | : \ \ . || : || | │ │ │╷ │ | |\ :||| || | │ │ ││ │ || : |||| │ │ ─╯│ ╰─────────────────────────────────╯ ╰───╯ Components This repository...

dnSpy

dnSpyEx dnSpyEx is an unofficial continuation of the dnSpy project which is a debugger and .NET assembly editor. You can use it to edit and debug assemblies even if you don't have any source code available. Main features: Debug .NET and Unity assemblies Edit .NET and Unity assemblies Light and da...

Exploit-LPE-CVE-2026-21721

💥 CVE-2026-21721 Exploit Wrote an exploit for CVE-2026-21721 and tested it on a test bench. 🎯 What's inside A combat privilege escalator: logs in, reads permissions, writes Admin permission=4 on all dashboards. A valid account with Editor rights is required for exploitation. 🧪 Tested on a test...

sops

SOPS: Secrets OPerationS SOPS is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP. demo .. image:: https://i.imgur.com/X0TM5NI.gif .. image::...

CVE-2026-48907

CVE-2026-48907 — Unauthenticated RCE in Joomla Content Editor JCE ≤ 2.9.99.4 Proof-of-concept exploit for CVE-2026-48907 — a CVSS 10.0 pre-authentication remote code execution vulnerability in the Joomla Content Editor JCE extension. Research by Grayxploit Security Team Table of Contents Overview...

HexWalk

HexWalk - Hex Editor/Viewer/Analyzer HexWalk is an Hex editor, viewer, analyzer. Built on qhexedit2, Capstone and Qt, with a built-in signature scanner, HexDig, inspired by binwalk. It is cross platform and has plenty of features: Advanced Find can find patterns in binary files based on...

CVE-2024-9932-POC

CVE-2024-9932-POC Description: The Wux Blog Editor WordPress plugin is vulnerable to arbitrary file uploads due to insufficient file type validation in the wuxbtinsertImageNew function. Versions up to and including 3.0.0 are affected. This vulnerability allows unauthenticated attackers to upload...

XPEViewer

PE file viewer/editor for Windows, Linux and MacOS. Download: https://github.com/horsicq/XPEViewer/releases How to run: https://github.com/horsicq/XPEViewer/blob/master/docs/RUN.md How to build: https://github.com/horsicq/XPEViewer/blob/master/docs/BUILD.md Changelog:...

modo

Modo The open-source AI IDE that plans before it codes. MIT License · Quick Start · What Modo Adds · Contributing I wanted a small feature in an AI coding tool. Couldn't find a way to suggest it. So I asked myself: how hard is it to actually build something like Kiro, Cursor, or Windsurf? Turns o...

Mohnad-AL-saif-CVE-2020-11107-XAMPP-Local-Privilege-Escalation

🧨 CVE-2020-11107 – XAMPP Local Privilege Escalation Windows 📌 Overview CVE-2020-11107 is a Local Privilege Escalation LPE vulnerability affecting Apache Friends XAMPP on Windows. An unprivileged user can modify the XAMPP Control Panel configuration file xampp-control.ini and replace the default...

CVE-2023-22809

Linux Privilege Escalation Exploit for CVE-2021-3560 Sudoedit a.k.a -e - Local Privilege Escalation For educational and authorized security research purposes only Original Exploit Authors n3m1dotsys Vulnerability Description In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra...

CVE-2026-48907

CVE-2026-48907 ⚠️ This repository is for educational and defensive security purposes only. Test only on systems you own or are explicitly authorized to assess. Do not use this project against third-party systems. This PoC is CVE-2026-48907, an unauthenticated RCE vulnerability affecting Joomla...