CVE-2025-5701

CVE-2025-5701 - Unauthenticated Privilege Escalation Exploit Severity: CRITICAL CVSS 9.8 Plugin Affected: HyperComments for WordPress Versions Affected: ≤ 1.2.2 📌 Vulnerability Summary The HyperComments plugin for WordPress is vulnerable to unauthorized modification of WordPress options due to a...

CVE-2025-3604

🚨 Flynax Bridge CVE : CVE-2025-3604 CVSS : 9.8 Critical Published : April 23, 2025 Last Updated : April 24, 2025 ⚙️ Script Output Example Detected plugin version: 2.2.0 Version is vulnerable. Attempting exploit... Exploit succeeded! Email changed to: [email protected] Exploit By Nxploited...

CVE-2025-48129

🚨 CVE-2025-48129 - Privilege Escalation in WordPress Spreadsheet Price Changer Plugin 🛡️ Vulnerability Summary Plugin Affected : Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Vulnerable Versions : Classified under: OWASP A7 – Identification and Authentication Failures 🧪...

CVE-2025-30911

Exploit for CVE-2025-30911 – WordPress RomethemeKit = 1.5.4 This script exploits a critical vulnerability in the RomethemeKit For Elementor WordPress plugin = v1.5.4 that allows authenticated arbitrary plugin installation and activation , potentially leading to Remote Code Execution RCE. 🛠️...

CVE-2025-2249

🔐 WordPress SoJ SoundSlides Plugin ⚠️ DISCLAIMER: This exploit is for educational and authorized testing purposes only. 📌 Vulnerability Summary Plugin: SoJ SoundSlides Affected Versions: = 1.2.2 Type: Authenticated Contributor+ Arbitrary File Upload Patch Status: ❌ No official fix available The So...

CVE-2025-32118

🚀 CVE-2025-32118 - WordPress CMP Plugin RCE Exploit 🔍 Title: WordPress CMP – Coming Soon & Maintenance plugin = 4.1.13 - Remote Code Execution RCE 🗓️ Published: 2025-04-04 🔐 CWE: CWE-434 - Unrestricted Upload of File with Dangerous Type 📊 CVSS: 9.1 CRITICAL —...

Some-Tools

Some-Tools Manage all your pentest tools in one place and keep them up to date with one command 😎 The goal of sometools is to be able to manage all your tools that are not include in Kali or that sudo apt install is not available. Sometools works better if tools are a repo but it can be tweak to...

security-labs-pocs

Datadog Security Labs Research and Proof of Concept Code This repository contains information, exploits, malware samples, and scripts from Datadog Security Labs. Goal This repository aims at providing proof of concept exploits, malware samples and technical demos to help the community respond to...

CVE-2024-12542-PoC

CVE-2024-12542-PoC Missing Authorization to Unauthenticated Sensitive Information Exposure Vulnerability Description The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the phpinfo function in all versions up to, and...

rapidscan

🟥 RapidScan v1.2 - The Multi-Tool Web Vulnerability Scanner RapidScan has been ported to Python3 i.e. v1.2. The Python2.7 codebase is available on v1.1 releases section. Download and use it if you still haven't upgraded to Python 3. Kindly note that the v1.1 Python2.7 will not be enhanced further...

fastnetmon

Community Edition FastNetMon - A high-performance DDoS detector/sensor built on top of multiple packet capture engines: NetFlow, IPFIX, sFlow, AFPACKET port mirror. What do we do? We detect hosts in the deployed network sending or receiving large volumes of traffic, packets/bytes/flows per second...

CVE-2024-6244

🚀 pz-frontend-manager = 1.0.5 - CSRF Profile Picture Exploit 🛠️ Description This script exploits a CSRF vulnerability in the WordPress plugin pz-frontend-manager versions = 1.0.5 to change the profile picture of a logged-in user without their consent. 🔴 CVE-2024-6244 The plugin lacks proper CSRF...

CVE-2024-7985-PoC

CVE-2024-7985-PoC FileOrganizer = 1.0.9 - Authenticated Subscriber+ Arbitrary File Upload FileOrganizer Exploit - CVE-2024-7985 📌 Overview CVE-2024-7985 - WordPress Plugin FileOrganizer = 1.0.9 is vulnerable to authenticated arbitrary file uploads , allowing attackers with Subscriber+ privileges...

CVE-2025-47539

🚨 CVE-2025-47539 – WordPress Eventin Plugin Critical Exploit 🔥 Vulnerability Summary The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthenticated privilege escalation due to a missing authorization check in the importitems function. 🔓...

gitlab-cve-2021-22205

gitlab-cve-2021-22205 A simple bash script that exploits CVE-2021-22205 against vulnerable instances of gitlab Usage Usage: cve-2021-22205.sh options Options: -h,--help Show this help -t,--target Set the target server i.e. "http://gitlab.example.com" -i,--reverse-ip Set the IP to connect back to...

CVE-2024-11972-PoC

CVE-2024-11972-PoC Hunk Companion 1.9.0 - Unauthenticated Plugin Installation Description The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin befo...

CVE-2024-10674

CVE-2024-10674 Exploit - Th Shop Mania = 1.4.9 🚀 Overview This repository contains an exploit for the vulnerability identified as CVE-2024-10674 in the Th Shop Mania WordPress theme. The vulnerability allows authenticated users with at least Subscriber-level access to install and activate arbitra...

CVE-2024-54262

CVE-2024-54262 Exploit CVE-2024-54262: Arbitrary File Upload in Import Export for WooCommerce Overview This script exploits a vulnerability in the "Import Export for WooCommerce" WordPress plugin. The vulnerability allows unauthorized users to upload arbitrary files, leading to potential remote...

WhatsPayloadRCE

WhatsPayloadRCE This is a Automated Generate Payload for CVE-2019-11932 WhatsApp Remote Code Execution 1. Auto install GCC no harm command, you can see this is open-source 2. Saving to .GIF file How To Use ? sudo apt install git git clone https://github.com/Err0r-ICA/WhatsPayloadRCE cd...

CVE-2024-10673

🔥 Overview This script exploits CVE-2024-10673 , a critical vulnerability found in the Top Store WordPress Theme = 1.5.4. The flaw allows authenticated users with subscriber-level access or higher to install and activate arbitrary plugins via unprotected AJAX requests. ⚠️ Severity & Impact...