12 matches found
Audit-BlackBox-Web-to-Root
Pentest Lab: Web and System Exploitation Chain Drupal to Root Disclaimer This project was carried out in a controlled and isolated laboratory environment for educational and academic purposes. No real infrastructure was targeted. The goal is to learn how to secure systems by understanding attack...
CVE-2025-4428
CVE-2025-4427 & CVE-2025-4428 Vulnerability Scanner Advanced detection tool for identifying systems vulnerable to the CVE-2025-4427 and CVE-2025-4428 exploit chain. This security scanner helps identify vulnerable endpoints and demonstrates proof-of-concept exploitation. Features ๐ก๏ธ Vulnerability...
CVE-2021-3129
CVE-2021-3129 Instructions: Note: A local PHP environment is required. python3 CVE-2021-3129.py -u http://127.0.0.1:80 ๏ผๅชๆฃๆตpoc๏ผ python3 CVE-2021-3129.py -u http://127.0.0.1:80 -c whoami ๏ผๅฝไปคๆง่ก๏ผ้ป่ฎคไผ้ๅๆๆๅฉ็จ้พ๏ผ python3 CVE-2021-3129.py -u http://127.0.0.1:80 -c whoami -chain laravel/rce1 ๏ผๅฆๆฃๆตๅฐๅฏ็จๅฉ็จ้พๅฏ็ดๆฅ้ๆฉ...
NocoBase 2.0.27 - VM Sandbox Escape
Exploit Title: NocoBase 2.0.27 - VM Sandbox Escape Date: 2026-03-26 Exploit Author: Onurcan Genรง Vendor Homepage: https://www.nocobase.com/ Software Link: https://github.com/nocobase/nocobase Version: -u -P --cmd "id" python3 exploit.py -t TARGE...
wendor_labs_exploitation
Wendor Vending Machine Exploitation & Security Research Lab T...
CVE-2026-2471 WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field
The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the BaseModel class constructor calling maybeunserialize on all properties retrieved...
SecLeak
SecLeak Assessment This repository contains the s...
CVE-2025-9191
CVE-2025-9191 โ Houzez WordPress Theme PHP Object Injection . The Houzez theme (WordPress) is vulnerable to PHP Object Injection via deserialization in saved-search-item.php for all versions up to 4.1.6. Exploitation requires authenticated access at Subscriber level or higher; a POP chain is not ...
CVE-2025-8871
The Everest Forms Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mimecontenttype function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may ...
PT-2024-39061
Name of the Vulnerable Software and Affected Versions: VICIdial affected versions not specified Description: The issue allows an attacker with authenticated access as an "agent" to execute arbitrary shell commands as the "root" user. This can potentially be chained with other exploits to achieve...
WordPress Releases Update 6.4.2 to Address Critical Remote Attack Vulnerability
WordPress has released version 6.4.2 with a patch for a critical security flaw that could be exploited by threat actors by combining it with another bug to execute arbitrary PHP code on vulnerable sites. "A remote code execution vulnerability that is not directly exploitable in core; however, the...
CVE-2021-31201
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability Recent assessments: architect00 at June 09, 2021 6:55am UTC reported: This vulnerability is abused in an exploitation chain. According to the Microsoft advisory it is abused with Adobe Acrobat CVE-2021-28550. gwillcox-...