58 matches found
CVE-2025-55182-zoomeye
Zoomeye Next.js RCE スキャナ 作成者: im-ezboy Zoomeye検索を使用したNext.js RCE CVE-2025-55182 のスキャナです。Zoomeyeクエリでターゲットを見つけ、提供されたエクスプロイトペイロードでテストします。 特徴 デフォルトで2つのZoomeye dorkを使用します: http.header="Vary: RSC, Next-Router-State-Tree" vul.cve="CVE-2025-55182" 並列スキャン（デフォルト20スレッド）とリクエストタイムアウト制御。 脆弱なターゲットを...
safer-eval-cve-CVE-2019-10760
safer-eval-cve-CVE-2019-10760 以下针对 safer-eval 1.3.1 及更低版本的概念验证（POC）漏洞利用是首个公开已知的攻击该版本范围的载荷。 贡献 请参阅 CONTRIBUTING 了解对本项目做出贡献的指南。...
CVE-2004-2271-MiniShare-1.4.1-Buffer-Overflow
CVE 2004-2271 MiniShare-1.4.1-缓冲区溢出 https://vulners.com/cve/CVE-2004-2271 用法在文件中，自动生成msfvenom payload，因为我懒。 移植自： https://www.exploit-db.com/exploits/636/ https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/minisharegetoverflow.rb 许可证： 不要用此做任何非法的事情，否则可以自由编辑/重新上...
CVE-2017-8759
CVE-2017-8759 武器化 PoC 本仓库包含可用来武器化 CVE-2017-8759 漏洞的数据。 如需完整信息，请访问 https://www.mdsec.co.uk/blog/ 查找与本漏洞相关的文章。 与以往一样，我的研究旨在帮助社区更好地意识到不断上升的威胁，同时也帮助对抗模拟社区更好地模拟针对客户环境的真实威胁，从而更好地教育和告知他们。未经事先同意，不得将我的研究用于任何目标。 武器化视频可在此处找到：https://www.youtube.com/watch?v=hlkx5uYBT1Y 致谢 感谢我自己，Vincent Yiu @vysecurity，实现了无需交...
Root-My-Galaxy
Root My Galaxy Root My Galaxy 是一款一键安装工具，适用于明确支持的 Samsung 型号与内核组合。该应用程序本身与设备偏移量、原生漏洞利用载荷以及 KernelSU 构建产物保持分离。 最新版本 设备数据源与原生载荷维护在 Root-My-Galaxy-Payloads 中。 应用程序 该应用会选择型号列表与三段式内核版本均匹配手机的载荷。例如，6.6.98-android15-8-... 匹配 6.6.98。高级模式会按这两个值过滤目录，并允许手动选择，同时显示型号与内核版本警告。 构建 要求： Android Studio JBR 21 Android...
Exploit for CVE-2026-42945
CVE-2026-42945 PoC Go This tool is designed for detecting a...
Exploit for CVE-2026-1731
CVE-2026-1731 BeyondTrust Remote Support Pre-Auth RCE PoC...
📄 Django 5.1.13 SQL Injection
Django version 5.1.13 suffers from a remote SQL injection vulnerability. Exploit Title: Django 5.1.13 - SQL Injection Google Dork: none Not applicable for this vulnerability Date: 2025-12-03 Exploit Author: Wafcontrol Security Team Vendor Homepage: https://www.djangoproject.com/ Software Link:...
Malicious code in syahlan-poke34 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bca1810855f6ff0be7eedd9ab5f40bc1ca3b86429e31d927154d49bb36065d1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Sitecore 10.4 - Remote Code Execution (RCE)
Exploit Title: Sitecore 10.4 - Remote Code Execution RCE Exploit Author: Yesith Alvarez Vendor Homepage: https://developers.sitecore.com/downloads Version: Sitecore 10.3 - 10.4 CVE : CVE-2025-27218 Link: https://github.com/yealvarez/CVE/blob/main/CVE-2025-27218/exploit.py from requests import...
Malicious code in zora-exploit-payload (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a09d84c94c165c768d88481e00efa77860f1237a66dc441e253dd480f1e476a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-4959 Malicious code in zora-exploit-payload (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a09d84c94c165c768d88481e00efa77860f1237a66dc441e253dd480f1e476a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Hax CMS Stored Cross-Site Scripting vulnerability
Summary The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site. Although t...
Ivanti Connect Secure 22.7R2.5 - Remote Code Execution (RCE)
Exploit Title: Ivanti Connect Secure 22.7R2.5 - Remote Code Execution RCE Date: 2025-01-11 Exploit Author: @absholi7ly CVE: CVE-2025-0282 import requests import sys import struct import socket import ssl import urllib3 import time Disable SSL warnings...
CVE-2025-21609 SiYuan has an arbitrary file deletion vulnerability
SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the POST /api/history/getDocHistoryContent endpoint. An attacker can craft a payload to exploit this vulnerability,...
CVE-2025-21609
CVE-2025-21609 affects SiYuan Note 3.1.18. The vulnerability exists in the POST /api/history/getDocHistoryContent endpoint, where an attacker can craft a payload to cause arbitrary file deletion on the server. The issue is addressed by commit d9887aeec1b27073bec66299a9a4181dc42969f3, with a fix e...
CVE-2025-21609 SiYuan has an arbitrary file deletion vulnerability
SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the POST /api/history/getDocHistoryContent endpoint. An attacker can craft a payload to exploit this vulnerability,...
Exploit for Out-of-bounds Write in Exim
CVE-2023-42115: Exploit and Payload Generator Scripts This r...
CE Phoenix 1.0.8.20 Remote Code Execution Exploit
Exploit Title: CE Phoenix v1.0.8.20 - Remote Code Execution RCE Authenticated Date: 2023-11-25 Exploit Author: tmrswrr Category: Webapps Vendor Homepage: CE Phoenix Version: v1.0.8.20 Tested on: Softaculous Demo - CE Phoenix EXPLOIT : import requests from bs4 import BeautifulSoup import sys impor...