CVE-2026-46587

camel-couchbase CCB Header Injection Reproducer CVE-2026-46587 This project demonstrates a message-header injection in Apache Camel's camel-couchbase component, tracked as CVE-2026-46587. The component reads several Exchange headers to control its behaviour — CCBKEY document key, CCBID document i...

CVE-2026-46585

camel-lucene QUERY Header Injection Reproducer CVE-2026-46585 This project demonstrates a message-header injection / authorization bypass in Apache Camel's camel-lucene component, tracked as CVE-2026-46585. The Lucene query producer reads the full-text search phrase from an Exchange header, but t...

CVE-2026-47323

camel-cxf-rest / camel-cxf / camel-knative-http Header Injection Reproducer CVE-2026-47323 This project demonstrates a message-header injection in Apache Camel's CXF and Knative HTTP header-filter strategies, tracked as CVE-2026-47323. CxfRsHeaderFilterStrategy camel-cxf-rest,...

CVE-2026-46726

CVE-2026-46726 — camel-vertx-websocket Header Injection SSRF + Secret Disclosure Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

CVE-2025-6335

Title: Template injection command execution vulnerability in dedeCMS 5.7 sp2 BUGAuthor: Ewoji Affected Version: dedeCMS 5.7.2 Vendor: Shanghai Zhuozhuo Network Technology Co., LTD Software: dedeCMS Vulnerability Files: /include/dedetag.class.php Description: 1. After install，Log in to the...

CVE-2026-46584

CVE-2026-46584 — camel-mail mail.smtp. Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

CVE-2022-31061

CVE-2022-31061 PoC for GLPI CVE-2022-31061 A Proof of Concept for GLPI = 9.3.0 and 10.0.2 - Unauthenticated SQL injection on login page Legal disclaimer : Use of this script for attacking à target without mutual consent is illegal. It's is the end user responsibility to obey all applicables laws...

bubblewrap

Bubblewrap Many container runtime tools like systemd-nspawn, docker, etc. focus on providing infrastructure for system administrators and orchestration tools e.g. Kubernetes to run containers. These tools are not suitable to give to unprivileged users, because it is trivial to turn such access in...

xwiki-cve-2025-24893

XWiki SolrSearch Unauthenticated RCE CVE-2025-24893 Contributors White Hat School 4th Cohort, Class 25 임두연@endusdksla Summary XWiki interprets wiki syntax and macros on the server side and renders them. The issue is that the Main.SolrSearch page is open to guests, yet it evaluates the user input...

CVE-2026-46456

CVE-2026-46456 — camel-aws2-sqs Inbound Message-Attribute Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

CVE-2020-23583

CVE-2020-23583 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" REMOTE CODE EXECUTION found in "OPTILINK OP-XT71000N". The issue occurs when the attacker sends an arbitrary code on "/diagpingadmin.asp" to "PingTest" interface that leads t...

sRDI

sRDI - Shellcode Reflective DLL Injection sRDI allows for the conversion of DLL files to position independent shellcode. It attempts to be a fully functional PE loader supporting proper section permissions, TLS callbacks, and sanity checks. It can be thought of as a shellcode PE loader strapped t...

geoserver-

GeoServer CVE-2024-36401 Exploitation Tool GeoServer CVE-2024-36401 Environment: JDK8 Disclaimer: For authorized testing only. The author bears no responsibility for any consequences caused by user misuse. Please comply with laws and regulations! 1. Default payload: POST /geoserver/wfs HTTP/1.1...

Ghazi

Ghazi Ghazi is a BurpSuite Plugins For Testing various PayLoads Like "XSS,SQLi,SSTI,SSRF,RCE and LFI" through Different tabs , Where Each Tab Will Replace Every GET or POST Parameters With Selected TAB in "Proxy" or "Repeater" TAB XSS tab of Ghazi Replacing Every Parameters to XSS PayLoad SSTI...

Wormy

Wormy - The challenge In this repo I will write some functions in python3 in my free time to add "some spreading features like worms" to any python backdoor. After finishing I will make it a real worm ToDo list : 1Spread in drivers, add to startup and continuous check✓ 2Spread in python scripts b...

CVE-2026-69084-PoC

CVE-2026-69084 / CVE-2026-69085 — SiYuan Arbitrary SQL Execution & SQLi CVE-2026-69084: Arbitrary SQL Execution via /api/search/searchEmbedBlock CVE-2026-69085: SQL Injection via /api/filetree/searchDocs CVSS 9.9 Critical each · CWE-89 · SiYuan = v3.7.2 fixed in v3.7.3 Published 2026-08-03 · no...

wordpress-cve-2026-63030

WordPress REST API Batch Route Confusion + SQL Injection → RCE Pre-authentication, unauthenticated, no plugins required. Works against a stock WordPress install via the REST API batch endpoint...

CVE-2024-54160-Opensearch-HTML-And-Injection-Stored-XSS

CVE-2024-54160-Opensearch-HTML-Injection + Stored XSS It was found that the Opensearch plugin called "reports" was vulnerable to HTML-injection in version 2.18.0. The report functionality allowed users to store HTML in the header and footer while creating a new report definition. Below is a quick...

CVE-2025-69212-PoC

CVE-2025-69212 OpenSTAManager = 2.9.8 — OS Command Injection in P7M File Processing Overview...

CVE-2026-25089

CVE-2026-25089 - Draft - Fortinet FortiSandbox ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: root@kitploit: git clone...