CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Multiple cross-site scripting XSS vulnerabilites in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data in the Content Manager Menu. Attack Vectors:...

CVE-2025-22964

CVE-2025-22964: Time-based blind SQL injection in DDSN Interactive cm3 Acora CMS version 10.1.1 DDSN Interactive cm3 Acora CMS version 10.1.1 has a time-based blind SQL Injection vulnerability caused by insufficient input sanitization and validation in the "table" parameter. This flaw allows...

CVE-2016-5640

CVE-2016-5640 Crestron AirMedia AM-100 RCE CVE-2016-5640 Metasploit Module Module for exploiting a Remote Command Injection vulnerability in the wireless diagnostics page for Crestron AirMedia AM-100 devices with a firmware version 1.4.0.13. Commands execute as the account running the service i.e...

opentsdb_key_cmd_injection

opentsdbkeycmdinjection An exploit for OpenTSDB = 2.4.1 cmd injection CVE-2023-36812/CVE-2023-25826 written in Fortran About This is an exploit for a command injection vulnerability in OpenTSDB verions 2.4.1 and prior CVE-2023-36812/CVE-2023-25826. The exploit is written in modern Fortran and...

Exploit_CVE-2025-37164

ExploitCVE-2025-37164 ! This Script is made for educational purpose only Exploit for the CVE-2025-37164 Description : This script provide a simple exploit for the CVE-2025-37164 impacting HPE OneView that can be used to validate if an asset is vulnerable. usage : git clone...

Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Html-Injection

CVE-2021-46079 Exploit Title: Vehicle Service Management System - 'Multiple' File upload Leads to Html Injection Exploit Author: SANU P.L CVE: CVE-2021-46079 CVSS: 7.2 HIGH References: https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-html-injection...

CVE-2014-6271-Shellshock-

Exploiting Shellshock CVE-2014-6271: A Complete, Modern Demonstration Lab Shellshock CVE-2014-6271 is one of the most influential remote code execution vulnerabilities ever discovered. The flaw affects Bash and allows attackers to execute arbitrary commands simply by injecting crafted payloads in...

CVE-2025-52694-POC

CVE-2025-52694: Advantech SaaS Composer SQL Injection This repository contains Proof-of-Concept PoC tools for CVE-2025-52694 , a critical unauthenticated SQL Injection vulnerability affecting Advantech IoTSuite and IoT Edge Products. Vulnerability Overview Attribute| Details ---|--- CVE ID|...

RootQuest-CTF-Box-Multi-Stage-Exploitation-VM

RootQuest CTF Box — Multi-Stage Exploitation VM 💀 Kalaichelvan Thieveshkar CB013248 · Staffordshire University · COMP50003 - Cyber Security II Overview RootQuest is a purpose-built CTF virtual machine that contains a 10-stage , sequential attack path spanning 5 security domains. Each challenge...

CVE-2019-19781-CitrixRCE

Citrix Unauthorized Remote Code Execution Attacker - CVE-2019-19781 References: https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/ Bypassing: 1 - Deleted / Modified scripts at: /vpn/../vpns/portal/scripts/ 2 - Forward Slash "/" issues after perl commnad...

cve-2026-54316-lab

CVE-2026-54316 — Claude Code WebFetch HuggingFace exfiltration lab A self-contained, disposable lab that reproduces GHSA-fg94-h982-f3mm / CVE-2026-54316: Claude Code pre-approved huggingface.co as a bare hostname for the WebFetch tool, so any path on that domain — including attacker-controlled...

CVE-2022-RCE

CVE-2022-XXXX Reverse junk data injection CVE subscription tools exploitation tutorials Exploit POC RCE LOG4j deserialization JNDI Payload CVE-2022-20550 CVE-2022-20551 CVE-2022-20552 CVE-2022-20553 CVE-2022-20554 CVE-2022-20555 CVE-2022-20556 CVE-2022-20557 CVE-2022-20558 CVE-2022-20559...

CVE-2021-26084

CVE-2021-26084 Proof of concept for CVE-2021-26084. Confluence Server Webwork OGNL injection Pre-Auth RCE Disclaimer This is for educational purposes only. I am not responsible for your actions. Use at your own discretion. Command Limiations Due to the payload, it is not possible to pass some...

CVE-2024-41312.

CVE-2024-41312. InstantCMS - Stored Cross Site Scripting XSS Affected Version: InstantCMS 2.16.3 Steps to Reproduce: 1. Log in to https://demo.instantcms.io as an demo user. 2. Visit https://demo.instantcms.io/photos/upload. 3. Upload the image with the embedded payload test in the Camera Model...

llm-prompt-injection-resources

llm-prompt-injection-resources A curated collection of resources for learning and researching LLM prompt injection attacks, defenses, and security. Donate Support the maintenance of this project with PayPal or by scanning the QR code below...

Log4Shell-CVE-2021-44228-ENV

Log4Shell Reproduction Environment Example Description Victim machine IP: 47.47.47.47 Attacker machine IP: 48.48.48.48 Running the Vulnerable Docker on the Victim Machine Use the DockerFile to build the docker image and run: docker build . -t vuln docker run -p 8080:8080 --name vuln vuln Running...

CVE-2023-48842

CVE-2023-48842 Source : D-Link Go-RT-AC750 revAv101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi. https://drive.google.com/file/d/1y5omf2SAhNmcPqDxCSRTvJVAWwPcH/view Little upgrade : I updated the script which is now on steroids, the scrip...

CVE-2016-6662

CVE-2016-6662 From SQL injection to root shell with CVE-2016-6662 by MaYaSeVeN Proof of Concept: https://www.youtube.com/watch?v=lyc7GFE3q2U...

HavocPwn

Havoc-PWN Authenticated This SSRF-RCE Chain was inspired by chebuya's CVE-2024-41570 SSRF POC and IncludeSecurity's Havoc Auth RCE both exploits are amazing and well crafted, please do give these creators appriciation for their hardwork! chebuya hyperreality How does it Work? The SSRF vulnerabili...

CVE-2026-72550-poc

CVE-2026-72550 — Friendica Unauthenticated SQL Injection Unauthenticated stacked-query SQL injection in the photos endpoint in Friendica allows any visitor to run arbitrary SQL. Field| Value ---|--- CVE ID| CVE-2026-72550 Product| Friendica self-hosted federated social network Affected| =...