CVE-2023-5965

PoC for Espo CRM 7.2.4 CVE-2023-5965 & CVE-2023-5965 CVE-2023-5965 Advisory An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution. To upload the file go to...

CVE-2025-52122

CVE CraftCMS Freeform CraftCMS Freeform contains an SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title. Vulnerable versions are v5.0.0 test % set form = freeform.form'pentest' % % if form % form.render % else % Form not foun...

GHSA-PFHG-Q3QV-9Q6R SvelteKit: URL redirection to untrusted site via enhanced form submission

Impact Applications using enhanced form actions use:enhance on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect. Patches A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later. The fix preserves leading...

SvelteKit: URL redirection to untrusted site via enhanced form submission

Impact Applications using enhanced form actions use:enhance on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect. Patches A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later. The fix preserves leading...

cve-2026-15748

CVE-2026-15748 — Forminator Security Scanner A Python-based security research and vulnerability assessment scanner for identifying WordPress installations that use the Forminator plugin and assessing version-related exposure. For Educational & Authorized Testing Only Run this project only against...

CVE-2026-PoCs

💀 Exploit-Index: The Ultimate CVE Proof of Concept PoC & Exploit Database 150,000+ Verified Exploits & PoCs for Cybersecurity Research All In One Place Explore the Interactive Portal • View the JSON Index • Browse CVEs 📖 Abo...

CVE-2024-21378

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ 🛡️ CVE-2024-21378...

CVE-2025-6934

🛡️ CVE-2025-6934 - Unauthenticated Privilege Escalation in Opal Estate Pro 📝 Description The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme , is vulnerable to Privilege Escalation in all versions up to and...

CVE-2021-42665

CVE-2021-42665 CVE-2021-42665 - SQL Injection authentication bypass vulnerability in the Engineers online portal system. Technical description: An SQL Injection vulnerability exists in the Engineers Online Portal login form which can allow an attacker to bypass authentication. Affected components...

CVE-2026-19500-poc

CVE-2026-19500 Poc and writeup Description Sureforms is vulnerable to a DOS vulnerability , when attacker can submit unlimited key-value pair, leads to resource exhaustion and the administrator can not watch entries temporary. How to reproduce Submit the Form which is made by Sureforms plugin, an...

CVE-2026-71204-PoC

CVE-2026-71204 — changedetection.io: Omitted Checkbox in /settings Save Silently Disables API Key Enforcement Product: dgtlmoon/changedetection.io — v0.55.7 Files: changedetectionio/blueprint/settings/init.py, changedetectionio/forms.py CWE: CWE-284 — Improper Access Control CVSS 3.1:...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

CVE-2020-9495

CVE-2020-9495 PoC CVE-2020-9495 is medium severity LDAP injection vulnerability in Apache Archiva versions before 2.2.5. It allows an attacker to retrieve any LDAP attribute values of users that exist on the LDAP server. From the official Apache Archiva advisory: By providing special values to th...

CSRFER

CSRFER / / | \ | | \ | / /\ --.| |/ / | | | | |/ / | | --. \ /| | | || / | /// / |\ | | | || |\ \ //| \| /| | -.--. " '-, ',' 2 \ \q \ . \ .--' '----. / . . \ .'.' \ .-.\ '-, ,/ .---;- . \ \ .\ // '-. \ \ | '. , '-. c=' Cooo -. '-. '. '-. \ snd '-. '. '-. \ ---' CSRFER is a tool to...

CVE-2025-27590

CVE-2025-27590 - PoC Exploit Command Injection via Multipart Form Upload 📌 Description This is a Proof-of-Concept PoC exploit for CVE-2025-27590 , a command injection vulnerability affecting web applications that process multipart file uploads without proper sanitization. The vulnerability allows...

Malware-Analysis

Malware Analysis A repository to organize my malware write-ups that are too long or just don't work as Twitter threads...

CVE-2021-41349

Microsoft Exchange Exploit CVE-2021-41349 Exploiting: CVE-2021-41349 This exploiting tool creates a Form for posting XSS Payload to the target Exchange server. You need to create a js containing your desire to do. Usage 1. Create Your js Payload and upload it somewhare. 2. run the CVE-2021-41349....

CVE-2025-7384

CVE-2025-7384 — PHP Object Injection to RCE Plugin: Database for Contact Form 7 contact-form-entries ≤ 1.4.3 CVSS: 9.8 Critical CWE: CWE-502 — Deserialization of Untrusted Data Authentication Requirement: None Unauthenticated Impact: Remote Code Execution Table of Contents 1. Vulnerability Overvi...

phptopwn

PHP2Shell Threat-Intelligence Honeypot A safe, high-interacti...

Nextjs_Exploit_Tool

Next.js RSC RCE Exploit Tool CVE-2025-55182 Project Introduction CVE-2025-55182 is a high-severity vulnerability in Next.js's Server Component RSC processing chain. An attacker can craft special multipart/form-data requests and forged RSC response chunks to induce the server to execute arbitrary...