CVE-2026-108772

A path traversal vulnerability exists in bleenco abstruse versions up to 2.1.0 . The flaw is located in the filepath.Join function within the file server/api/worker/download_cache.go file of the Cache Endpoint component. By manipulating the File argument, a remote attacker can perform a path trav...

CVE-2025-2304

Camaleon CMS -p Arguments -t, --target Base target URL -u, --username Valid low-privileged username -p, --password User password Exploit Flow 1. Retrieve login page and extract CSRF token 2. Authenticate with provided credentials 3. Access profile edit page 4. Extract password update endpoint and...

CVE-2025-69213

CVE-2025-69213: OpenSTAManager has a SQL Injection in ajaxcomplete.php getsedi endpoint Overview Field| Details ---|--- CVE ID| CVE-2025-69213 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: fetchArray$q; Data Flow 1. Source...

CVE-2026-81648

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-81648 CVE-2026-81648 CryptoPayment Gateway 1.2.2 - Granwill I am @abraxasnull. Loopback lab. The client is CVE-2026-81648-Abraxas-Labs.py. The guard is never called. Direct POST vendor/cryptd/ajax.php, not...

endsfuzzer

endsfuzzer endsfuzzer is a simple tool used to fuzz a list of domains for specific endpoints. It will check all the domains in a list for a single endpoint, then moves on to the next endpoint to check for. Features Fast. Makes use of go routines. Gentler to servers. Fuzzes all hosts for one...

exploit-cve

CVE-2024-39713: Rocket.Chat SSRF PoC Description A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. Links: https://nvd.nist.gov/vuln/detail/CVE-2024-39713 https://hackerone.com/reports/1886954 Usage pip install -r requirements.txt python3...

HTC

Hack The CCTV DVRs Credentials Exposed | CVE-2018-9995 | The CCTV Leaked Username For Get Loggin Access How To Use? Open The https://www.zoomeye.org/ Search This Keyword '/login.rsp' Wait To Get IP and Port $ python3 thecctv.py More Information OS | Language | Contact ---|---|--- Linux Ubuntu |...

flar3ad

flar3ad is a tool that takes advantage of the CVE-2026-51031 to read files from a target server taking advantage of the /v1 endpoint of FlareSolverr's API and using driver.get function in order to exploit the vulnerability. Further explained in xinyi's blog. Installation git clone...

CVE-2022-1388-Exploit

CVE-2022-1388-Exploit Test and Exploit Scripts for CVE 2022-1388 F5 Big-IP masscheck.py will take a file input and check the hosts are vulnerable without exploiting them. Detection: Scanning for /mgmt/tm/util/bash as an endpoint, likely to be in web server logs. Or if you have a F5 go patch it, t...

CVE-2025-69214

CVE-2025-69214: OpenSTAManager has a SQL Injection in ajaxselect.php componenti endpoint Overview Field| Details ---|--- CVE ID| CVE-2025-69214 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: !imagehttps://a...

POC-CVE-2022-28117

CVE 2022 28117 PoC Python with slight modifications Usage : python3 .\poccve2022-28117.py -x file:///etc/passwd -u username -p password http://192.168.148.140/navigate...

CVE-2024-2389

Progress Kemp Flowmon CVE-2024-2389 Description This repository contains a Python script to exploit a vulnerability in Flowmon that allows for gaining a reverse shell on the target system. The exploit leverages a flaw in the service.pdfs/confluence endpoint to execute arbitrary commands on the...

CVE-2025-1913-PoC

CVE-2025-1913 -- Proof of Concept PoC This repository contains an educational-only Proof of Concept PoC for CVE-2025-1913 , created by Suhaib518 🇸🇦. This PoC demonstrates how specially crafted serialized PHP input may trigger vulnerable logic in affected WordPress components. The PoC is safe and...

CVE-2025-54123-Poc

CVE-2025-54123 Exploit Hoverfly Authenticated Middleware Command Injection RCE | CVSS 9.8 CRITICAL Vulnerability Hoverfly -u -p -c --shell SHELL -t, --target - Hoverfly API endpoint required -u, --username - Admin username required -p, --password - Admin password required -c, --command -...

cve-2021-26855

cve-2021-26855 GET /ecp/x.png HTTP/1.1 Host: 192.168.170.134 Cookie: X-BEResource=localhost1942062522 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:109.0 Gecko/20100101 Firefox/110.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8...

telerik-scanner-cve-2017-9248

Telerik CVE-2017-9248 Vulnerability Scanner V2.0 A comprehensive Python scanner that discovers Telerik endpoints and tests for CVE-2017-9248 cryptographic vulnerability with enterprise-grade bulk scanning capabilities. Features Quick & Discovery Modes: Single path testing or comprehensive discove...

CVE-2025-47226

CVE-2025-47226 - IDOR Vulnerability in Snipe-IT = v8.0.4 🚨 Insecure Direct Object Reference IDOR vulnerability in Snipe-IT allows authenticated users to view asset information from other departments by tampering with locationid. ✍️ Discovered By Siripong Jintung GitHub: Sn1p3r-H4ck3r Linkedin:...

CVE-2023-27163

CVE-2023-27163 Request-Baskets v1.2.1 - Server-side request forgery SSRF request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /api/baskets/name. This vulnerability allows attackers to access network resources and sensitive information via a...

CVE-2026-8206

CVE-2026-8206 - Kirki WordPress Plugin Mass Exploit Mass exploitation tool for CVE-2026-8206 – a critical vulnerability in the Kirki WordPress plugin versions ≤ 6.0.6 that allows unauthenticated attackers to hijack password reset links and take over any user account, including administrators...

kiterunner

Kiterunner Introducción Durante mucho tiempo, el descubrimiento de contenido se ha centrado en encontrar archivos y carpetas. Si bien este enfoque es efectivo para servidores web heredados que alojan archivos estáticos o responden con 3xx ante una ruta parcial, ya no es efectivo para aplicaciones...