CVE-2025-67315

CSRF to Deactivate Any Employee Summary The Manage Employees functionality is vulnerable to Cross-Site Request Forgery CSRF. An attacker can trick a logged-in admin into sending a forged request that inactivates an employee e.g., inid=1 without the admin’s knowledge or consent. CVSS Base Score: 5...

pymeta

PyMeta PyMeta is a Python3 rewrite of the tool PowerMeta, created by dafthack in PowerShell. It uses specially crafted search queries to identify and download the following file types pdf, xls, xlsx, csv, doc, docx, ppt, pptx from a given domain using Google and Bing scraping. Once downloaded,...

raven

Raven Currently is not being maintained Raven is a Linkedin information gathering tool that can be used by pentesters to gather information about an organization employees using Linkedin. Disclaimer Please do not use this program to do stupid things. The author does not keep any responsibility of...

CrocoTime Employee Attendance DoS

The vulnerability of the CrocoTime employee attendance system is related to an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

CrocoTime authorization Unauthorized Access

The vulnerability of the CrocoTime employee time management system is related to deficiencies in the authorization process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

LinkedInDumper

LinkedInDumper Python 3 script to dump company employees from LinkedIn API 💬 Description LinkedInDumper is a Python 3 script that dumps employee data from the LinkedIn social networking platform. The results contain firstname, lastname, position title, location and a user's profile link. Only 2 A...

CVE-2024-22369

CVE-2024-22369 Credits This POC is based on the reproducer built by Ziyang Chen of HuaWei Open Source Management Center The reproducer has been used to create this PoC, with some adjustments and clean up, and also enriched with some more automation. Prepare the enviroment We'll need a Mysql...

CVE-2021-43657

CVE-2021-43657 This is a reference/POC for CVE-2021-43657 This vulnerability was found when i was playing with the open source software which is responsible for Employee Task Management System...

CVE-2025-40677

Exploit Title: Summar Employee Portal Prior to 3.98.0 Authenticated SQL Injection - CVE-2025-40677 Google Dork: inurl:"/MemberPages/quienesquien.aspx" Date: 09/22/2025 Exploit Author: Peter Gabaldon - https://pgj11.com/ Vendor Homepage: https://www.summar.es/ Software Link:...

Employee Records System 1.0 - Unauthenticated File Upload RCE

Employee Records System version 1.0 contains an unrestricted file upload vulnerability in uploadID.php that allows remote unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution. id: CVE-2021-4462 info: name: Employee Records System 1.0 - Unauthenticated File...

ScrapedIn

ScrapedIn Tool to scrape LinkedIn This tool assists in performing reconnaissance using the LinkedIn.com website/API for red team or social engineering engagements. It performs a company specific search to extract a detailed list of employees who work for the target company. Enter the name of the...

D4TA-HUNTER

Video Demo: https://darkhacking.es/d4ta-hunter-framework-osint-para-kali-linux My website: https://microjoan.com My blog: https://darkhacking.es/ Buy me a coffee: https://www.buymeacoffee.com/microjoan DISCLAIMER This toolkit contains materials that can be potentially damaging or dangerous for...

CVE-2024-25175

CVE-2024-25175 Reflected XSS via HTTP Response Splitting Description : Exploitation of this vulnerability can lead to the execution of JavaScript code in the victim's browser Cross-Site Scripting when following a specially crafted link. The vulnerability arises because The web server does not...

CVE-2026-117512

A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employeeinsert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made...

CVE-2026-117512 oretnom23 php-travel-agency-system employee_insert.php unrestricted upload

A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employeeinsert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made...

EUVD-2026-111113

A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employeeinsert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made...

CVE-2026-117512

The oretnom23 php-travel-agency-system contains an unrestricted upload vulnerability affecting the admin/employee_insert.php file. By manipulating the employee photo argument, an attacker can perform a remote upload of files. While the project was notified of this issue, no response has been prov...

CVE-2026-117512 oretnom23 php-travel-agency-system employee_insert.php unrestricted upload

A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employeeinsert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made...

PT-2026-126687

A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been mad...

CVE-2026-116050

A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file /source/registerform3.php of the component Registration. The manipulation of the argument pemail leads to sql injection. The attack can...