augustus

Augustus - LLM vulnerability scanner for prompt injection, jailbreak, and adversarial attack testing Augustus - LLM Vulnerability Scanner Test large language models against 210+ adversarial attacks covering prompt injection, jailbreaks, encoding exploits, and data extraction. Augustus is a Go-bas...

PhantomEvasion

PHANTOM EVASION 3.0 Phantom-Evasion is an antivirus evasion tool written in python both compatible with python and python3 capable to generate almost fully undetectable executable even with the most common x86 msfvenom payload. The following OSs officialy support automatic setup: 1. Kali Linux 2...

DonkAI

Hands-on lab for the OWASP Top 10 for LLM Applications 2025 - no real LLM required. DonkAI is deliberately vulnerable web app you can run in one command and use to learn how LLM-integrated systems get broken by actually breaking them. Every OWASP LLM Top 10 category is represented by at least one...

CVE-2020-2034-POC

CVE-2020-2034-POC Determine the Version Running on the Palo Alto Network Firewall for the Global Protect Portal Recently a lot of critical vulnerabilities were announced by Palo Alto Networks here: https://security.paloaltonetworks.com/?severity=CRITICAL&product=PAN-OS&sort=-date This is a PoC to...

CVE-2023-30854

WWBN Avideo Authenticated RCE - OS Command Injection CVE-2023-30854 WWBN Avideo sqlFile $objClone-cloneSiteURLvideos/cache/clones/$json-sqlFile"; $log-add"Clone 2 of $totalSteps: Geting MySQL Dump file"; exec$cmd . " 2&1", $output, $returnval; We can control $objClone-cloneSiteURL through the adm...

CVE-2023-23333

Summary: There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php. Vendor: SolarView Compact Affected Product: SolarView Compact Version: SolarView Compact =ver 6.00 poc: curl...

spring-cloud-gateway-rce

Spring Cloud Gateway Actuator API SpEL Expression Injection Command Execution CVE-2022-22947 1. Installation pip3 install -r requirements.txt 2. Usage $ python3 spring-cloud-gateway-rce.py -h / \ /\ /\ /\ | \ / \ | \ | \ | \ | \ / \ | || | | | / / \ \ / / /\ || | | | | | | || || || | / / / / \ V...

telnet_scan

Telnet Vulnerability Scanner CVE-2026-24061 & CVE-2026-32746 A Python-based security assessment tool that detects and where applicable exploits two critical vulnerabilities in GNU InetUtils telnetd: CVE-2026-24061 – Authentication bypass via USER environment variable injection CVSS 9.8...

CVE-2017-6079-Blind-Command-Injection-In-Edgewater-Edgemarc-Devices-Exploit

Introduction This exploit was developed based on the technical description by depthsecurity https://depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices Description The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden pag...

CVE-2023-49314

CVE-2023-49314 Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and enableNodeCliInspectArguments, and thus electroniz3r can be used to perform an attack. There is a tool...

CVE-2024-1698-Exploit

CVE-2024-1698 Exploit Script - Wordpress NotificationX = 2.8.2 - SQL Injection This is an exploit script to find out wordpress admin's username and password hash by exploiting CVE-2024-1698. This Python script is intended for educational purposes only. It demonstrates a proof of concept for...

CVE-2026-112032 aircheng-org iWebShop-5 util.php search sql injection

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was...

CVE-2026-112032

A SQL injection vulnerability exists in aircheng-org iWebShop-5 versions up to 5.16 . The flaw is located in the Util::search function within the classes/util.php file. An attacker can initiate this attack remotely to manipulate database queries. While the project was notified early via an issue ...

CVE-2023-50094_POC

reNgine 2.2.0 - Command Injection - CVE-2023-50094 Description This Python script exploits an authenticated command injection vulnerability in reNgine 2.2.0. The exploit targets the nmapcmd parameter in the Scan Engine configuration, allowing attackers to execute arbitrary commands. Features...

CVE-2026-112032 aircheng-org iWebShop-5 util.php search sql injection

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was...

Next.js-RCE-Scanner-BurpSuite-Extension-

CVE-2025-55182 Next.js RCE Burp Extension Plugin Features Passive Scanning : Automatically detect all Next.js sites passing through Burp Memory Shell Injection v2.2 New! Right-click on the target request, select Inject AntSword Memory Shell AntSword, supports both GET and POST types of memory...

cve-2022-22947

Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 Build $ git clone https://github.com/twseptian/cve-2022-22947.git $ cd cve-2022-22947 $ docker build . -t cve-2022-22947 $ docker run -p 9000:9000 --name cve-2022-22947 cve-2022-22947 PoC send the following request to add a rout...

CVE-2023-38891

CVE-2023-38891 Authenticated SQL Injection Vulnerability in VTiger Open Source CRM v7.5 Discovered by: Jacob Elliott 07/13/23 Summary In the Reports module in VTiger CRM v7.5.0, there is insufficient checking of the selected fields for the report which are stored and then later reintroduced as a...

PHPUnit_eval-stdin_RCE

PHPUniteval-stdinRCE CVE-2017-9841 PHPUniteval-stdinphp Remote Code Execution A code injection vulnerability in PHPUnit, a PHP unit testing framework which part of the Mailchimp , Mailchimp E-Commerce moduels in Drupal The vulnerability within the /phpunit/src/Util/PHP/eval-stdin.php file through...

CVE-2025-24659

CVE-2025-24659 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Premium Packages – Sell Digital Products Securely Vulnerable version Since the Premium Packages plugin is an addon...