SugarCRM Enterprise 9.0.0 - Cross-Site Scripting

SugarCRM Enterprise 9.0.0 contains a cross-site scripting vulnerability via mobile/error-not-supported-platform.html?desktopurl. id: CVE-2019-14974 info: name: SugarCRM Enterprise 9.0.0 - Cross-Site Scripting author: madrobot severity: medium description: SugarCRM Enterprise 9.0.0 contains a...

Omnia MPX 1.5.0+r1 - Local File Inclusion

Telos Alliance Omnia MPX Node through 1.5.0+r1 is vulnerable to local file inclusion via logs/downloadMainLog. By retrieving userDB.json allows an attacker to retrieve cleartext credentials and escalate privileges via the control panel. id: CVE-2022-36642 info: name: Omnia MPX 1.5.0+r1 - Local Fi...

WordPress Download Manager <2.9.94 - Cross-Site Scripting

WordPress Download Manager plugin before 2.9.94 contains a cross-site scripting vulnerability via the category shortcode feature, as demonstrated by the orderby or searchpublishdate parameter. id: CVE-2019-15889 info: name: WordPress Download Manager 2.9.94 - Cross-Site Scripting author: daffainf...

L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting

L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter. id: CVE-2019-15501 info: name: L-Soft LISTSERV 16.5-2018a - Cross-Site Scripting author: LogicalHunter,arafatansari severity: medium description: | L-Soft LISTSERV befor...

Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery

WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value in com/wavemaker/studio/StudioService.java, leading to disclosure of local files and server-side request forgery. id: CVE-2019-8982 info: name: Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request...

XAttacker

XAttacker V2.5 Tool FREE XATTACKER A Massive Exploiting Tool capable of scanning and auto-exploiting vulnerabilities in web applications, By providing a target website to the tool, it auto detects its’ architecture if using a Content Management Service CMS and tries to find vulnerabilities based ...

CVE-2025-5548

🛡️ Research and Exploitation: CVE 2025-5548 This is the main repository where I document my progress in the analysis of CVE 2025-5548. In this space I record each phase of the process: from lab preparation to final exploit development. 📂 Repository Structure Below is the organization of the...

Joomla-v4.2.8---CVE-2023-23752

Joomla! v4.2.8 - Unauthenticated Information Disclosure Exploit Script This Bash script exploits an unauthenticated information disclosure vulnerability in Joomla! versions 4.0.0 to 4.2.8. sudo apt-get update sudo apt-get install jq ./exploit.sh http://example.com...

CVE-2017-15950

CVE-2017-15950 PoC exploit for vulnerability CVE-2017-15950 SyncBreeze XML Parser and/or Sync functionality Stack-Based Buffer Overflow. Usage When running the XML payload generator, the script will output a XML file xplSyncBreeze.xml containing the payload to import using SyncBreeze. python3...

CVE-2014-6287

CVE-2014-6287 python3 script Usage: 1. Start a local smb service hosting nc.exe 2. Execute exploit script to getshell...

cve-2026-40369-exploit

This references https://voidsec.com/cve-2026-40369-browser-sandbox-escape/, the approach differs significantly from https://github.com/orinimron123/CVE-2026-40369-EXPLOIT, and since I didn't see any public exp from them, I documented it...

go-exploit-cache

go-exploit-cache go-exploit-cache builds an HTTP cache SQLite database used by the go-exploit framework to enable cross-exploit sharing and scanless target verification. Instead of actively connecting to targets, go-exploit can consult the cache to run version checks and other scans using...

CVE-2022-4395

MASS CVE-2022-4395 Usage apt install python3 python3-pip -y pip3 install -r require.txt python3 main.py Preview Reference https://wpscan.com/vulnerability/80407ac4-8ce3-4df7-9c41-007b69045c40...

CVE-2025-4255---Buffer-Overflow

PCMan FTP Server 2.0.7 - Stack-Based Buffer Overflow A comprehensive proof-of-concept exploit tool suite, and cross-platform analysis targeting PCMan FTP Server v2.0.7 CVE-2025-4255. This repository documents the progress and efforts required to discover a protocol crash, calculate raw memory...

cve-2022-21907

CVE-2022-21907 This package will detect exploits of CVE-2022-21907 https://corelight.com/blog/detecting-cve-2022-21907 Detection Method: HTTP HTTP data must be = 1750 bytes, and The HTTP/1.1 is not observed at the end of the exploit HTTP request. Usage: $ zeek -Cr your.pcap packages $ cat...

CVE-2023-28252-Compiled-exe

CVE-2023-28252-Compiled-exe A modification of Fortra's excellent CVE-2023-2852 Privesc Exploit. Works on Windows 11 21H2 clfs.sys version 10.0.22000.1574 - also works on Windows 10 21H2, Windows 10 22H2, Windows 11 22H2 and Windows server 2022. This version retains the original functionality, but...

CVE-2026-70559-PoC

CVE-2026-70559-PoC To Get This PoC - Join https://t.me/thecodeb0ss...

malicious-exploit-CVE-2023-51385

malicious-exploit-CVE-2023-51385...

CVE-2026-0163-EXP

CVE-2026-0163 DISCLAIMER This repository is for educational and research purposes only. The author is not responsible for any misuse, damage, or illegal activities caused by the use of this material. Use at your own risk. Respect applicable laws and ethical guidelines. Overview A functional remot...

CVE-2022-46196

CVE-2022-46196 Description This Python code exploits an unauthenticated command injection vulnerability in Cacti versions up to and including 1.2.22. It uses argparse to parse arguments from the command line, requests to get the HTML content of a target Cacti instance, and BeautifulSoup to extrac...