Exploit for SQL Injection in Sangoma Freepbx

CVE-2025-57819 — FreePBX 16 Endpoint Manager unauthenticated S...

CVE-2026-76070

CVE-2026-76070: Unauthenticated Pre-Auth Stack Buffer Overflow via Base64-Decoded Password in Netis NC63 login.cgi Leading to RCE Researcher: Özcan Ersan @ozcanpng Disclosure status CVE: CVE-2026-76070 Vendor: Netis Systems Co., Ltd. Product: Netis NC63 Wireless AC1200 Router Tested firmware:...

CVE-2023-27372

CVE-2023-27372 Exploit Exploit for CVE-2023-27372 , an unauthenticated Remote Code Execution vulnerability in the SPIP CMS affecting versions prior to 4.2.1. ⚠️ For educational purposes only. Use exclusively on systems you own or have explicit written permission to test. Unauthorized use is...

process-injection-playground

Linux Process Injection Playground A comprehensive collection of process injection techniques for Linux, demonstrating various methods of injecting code into running processes. These examples are intended for educational purposes, security research, and understanding low-level Linux process...

CVE-2025-2945-pgadmin-rce

CVE-2025-2945 — pgAdmin 4 Query Tool Authenticated RCE Proof of concept for CVE-2025-2945, a critical remote code execution vulnerability in pgAdmin 4. Affected versions: 8.10 through 9.1 Fixed in: 9.2 released April 4, 2025 CVSS v3.1: 9.9 Critical Overview The pgAdmin 4 Query Tool exposes an...

CVE-2026-38192

pluck-CMS-4.7.20-code-injection-vulnerability In admin.php, the moduleaddtosite function iterates through the entire $POST array, splits the user-controllable parameter names using explode'|', ... and directly concatenates them into data/settings/themes//moduleconf.php. This file will subsequentl...

CVE-2025-2304-PoC

CVE-2025-2304 Exploit Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment Vulnerability Description A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updatedajax' method of the UsersController is called. T...

Unauthenticated-RCE-FUXA-CVE-2023-33831

Unauthenticated RCE FUXA CVE-2023-33831 The vulnerability affects FUXA's scripting component, due to lack of control or sanitization on inputs that can be controlled by users, thus allowing the use of dangerous methods that can be scaled for remote code execution. The affected route is...

CVE-2025-65950

CVE-2025-65950: WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups Parameter Overview c. Capture the POST request sent to /wbce/admin/users/save.php when the "Save" button is clicked...

Devnull

DevNull DevNull is a Python CLI that automates the early, rep...

CVE-2025-47812

CVE-2025-47812 — Wing FTP Server Unauthenticated RCE root@kitploit: ██╗ ██╗██╗███╗ ██╗ ██████╗ ███████╗████████╗██████╗ ██║ ██║██║████╗ ██║██╔════╝ ██╔════╝╚══██╔══╝██╔══██╗ ██║ █╗ ██║██║██╔██╗ ██║██║ ███╗ █████╗ ██║ ██████╔╝ ██║███╗██║██║██║╚██╗██║██║ ██║ ██╔══╝ ██║ ██╔═══╝ ╚███╔███╔╝██║██║...

MACHINE-BASIC-PENTESTING-1

Penetration Testing Assessment Report: Basic Pentesting 1 !R...

CVE-2021-3560-PolkitPrivilegeEsclation

CVE-2021-3560-Polkit-Privilege-Esclation PoC Original research by Kevin Backhouse This is just a Bash PoC script, that automates the exploitation steps mentioned in Kevin Backhouse's blog. Read his post on this vulnerability:...

CVE-2024-51482-ZoneMinder-v1.37.-1.37.64-SQL-Injection-POC

ZoneMinder Time-Based SQL Injection CVE-2024-51482 📌 Vulnerability Overview CVE ID: CVE-2024-51482 Advisory: GHSA-qm8h-3xvf-m7j3 Affected versions: ZoneMinder 1.37. up to and including 1.37.64 Patched version: 1.37.65 📖 Description This repository contains a high-performance, parallelized...

CVE-2024-12025

CVE-2024-12025 Collapsing Categories = 3.0.8 - Unauthenticated SQL Injection Description The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due...

SOGo_web_mail-vulnerability-CVE-2025-50340

CVE-2025-50340: Insecure Direct Object Reference IDOR vulnerability in SOGo Webmail CVE ID: CVE-2025-50340 Reporter: Milad Seddigh Product: SOGo Affected Versions: v5.6.0 Impact: Insecure Direct Object Reference IDOR vulnerability → Allows the user to send emails on behalf of another user. Summar...

FOISted

root@kitploit: | / \ |/ | | | | | | | | | || | | | | | | | || | | || | \ | / / | | | | || || | | || / | | || /|/ \|,| FOISted: a MikroTik remote jailbreak Description FOISted is an exploit for two post-authentication vulnerabilities in MikroTik's RouterOS. It can be used to remotely jailbreak...

CVE-2025-52097

CVE-2025-52097 – Reflected XSS in InstantForum.NET v4.1.4 This repository contains the public advisory, proof of concept, and supporting materials for CVE-2025-52097 , a reflected cross-site scripting XSS vulnerability identified in InstantForum.NET v4.1.4. Summary Product: InstantForum.NET v4.1....

activemq-cve-2023-46604

Active MQ CVE-2023-46604 exploit This repository is a guide with examples on how to exploit the CVE-2023-46604 The exploit takes advantage of the usage of reflection for instantiating Exception classes through a malicious command that instead of being a valid command, it sends as the exception...

CVE-2022-46649

CVE-2022-46649 PoC exploit for CVE-2022-46649, a command injection vulnerability in the /cgi-bin/iplogging.cgi endpoint. The vulnerability allows authenticated attackers to execute arbitrary OS commands via crafted tcpdumpParams. Overview Vulnerability: OS Command Injection Endpoint:...