CVE-2025-10230

CVE-2025-10230 — Samba WINS Hook Command Injection The author assumes no liability for misuse or damage caused by this tool. Research is provided strictly for educational and defensive purposes. Description This repository contains a Proof-of-Concept PoC for CVE-2025-10230 , a command-injection...

CVE-2026-47103-python-statemachine-rce

CVE-2026-47103: Python StateMachine Remote Code Execution via SCXML eval Injection Severity: Critical, CVSS 4.0 9.3 , CVSS 3.1 9.8 assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...

CVE-2025-59470-PostgreSQL-Command-Injection

Affected Software: PostgreSQL 15.x before 15.7, 16.x before 16.3. Vulnerability Type: Command injection in the pgbackup extension. Description: The pgbackup extension fails to properly sanitize user‑supplied parameters, allowing a backup operator to inject arbitrary commands that are executed as...

CVE_2024_20356

CVE-2024-20356 Esta es una prueba de concepto para CVE-2024-20356, una vulnerabilidad de inyección de comandos en Cisco CIMC. Escrito por Aaron y oxidado por SherllyNeo Los detalles técnicos completos se pueden encontrar en...

POC_SQL_injection_in_Parse_Server_prior_6.5.7_-_7.1.0

Database Ghost 🔥 Advanced PostgreSQL SQL Injection Exploitation Tool 🚨 DISCLAIMER FOR AUTHORIZED SECURITY TESTING ONLY Unauthorized use is illegal. Use only on systems you own or have explicit permission to test. ⚡ QUICK START Install & Run root@kitploit: git clone...

CVE-2019-13027

CVE-2019-13027 Details for disclosing CVE-2019-13027 Vendor contact timeline: 1st July 2019 - No response, no email back. 4th July 2019 - No response, no email back. 8th July 2019 - Email sent, Github created. 11 July 2019 - No Vendor response. Vuln disclosed. Vulnerability Type SQL Injection...

CVE-2025-55182

CVE-2025-55182 RCE Herramienta de comprobación de uso propio para verificar la vulnerabilidad CVE-2025-55182 Principio de la vulnerabilidad React Server Components presenta un defecto en el análisis de rutas al decodificar los payloads enviados al endpoint de la función del servidor. Utiliza el...

xwiki_solrsearch-rce-exploit

solrsearch-rce-exploit Unauth RCE PoC for XWiki SolrSearch CVE-2025-24893. Command exec + reverse shell. CVE-2025-24893 – XWiki SolrSearch RCE PoC Proof-of-concept for the XWiki SolrSearch template injection leading to unauthenticated remote code execution. Tested against XWiki Debian 15.10.8...

CVE-2026-82222-MassExploit

CVE-2026-82222 — GiveWP WordPress Plugin Unauthenticated RCE -red.svg Critical Unauthenticated Remote Code Execution CVSS 9.8 — GiveWP ≤ 4.16.7.1 This tool exploits CVE-2026-82222 , a vulnerability in the WordPress GiveWP plugin that allows unauthenticated attackers to execute arbitrary commands ...

CVE-2023-5044

CVE-2023-5044 Inyección de código mediante nginx.ingress.kubernetes.io/permanent-redirect annotation Primero, necesitas desplegar un Pod y un Service: root@kitploit: kind: Pod apiVersion: v1 metadata: name: apple-app labels: app: apple spec: containers: - name: apple-app image: hashicorp/http-ech...

CVE-2026-86841 Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

EUVD-2026-87891

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

CVE-2026-86841

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

CVE-2022-23046

CVE-2022-23046 PHPIPAM 1.4.4 - SQLi Autenticado Orignal Exploit se puede encontrar aquí Autor original del exploit: Rodolfo "Inc0gbyt3" Tavares Script ajustado para CVE-2022-23046 Estaba teniendo problemas para ejecutar el script original. Lo ajusté para mi caso de uso. Usado mientras completaba ...

the-backdoor-factory

¡La nueva versión de BACKDOOR FACTORY está disponible! Obtén acceso aquí: https://github.com/sponsors/secretsquirrel ADVERTENCIA: Las Pull Requests SERÁN IGNORADAS Y CERRADAS. The Backdoor Factory BDF Solo para profesionales de la seguridad e investigadores. El objetivo de BDF es parchear binario...

CVE-2022-37205

CVE-2022-37205 CVE-2022-37205 POC Descripción sugerida RESERVADO JFinal CMS 5.1.0 está afectado por: Inyección SQL. Estas interfaces no usan el mismo componente, ni tienen filtros, sino que cada una utiliza su propio método de concatenación SQL, lo que resulta en inyección SQL. Información...

cve-2019-15107-lab

CVE-2019-15107 – Webmin Unauthenticated RCE Lab 1. Project Overview This project demonstrates CVE-2019-15107, a critical Remote Code Execution RCE vulnerability in Webmin, within a controlled and isolated Docker environment. The lab covers the complete vulnerability lifecycle from deployment and...

CVE-2024-39304

Descripción Este script es un PoC para CVE-2024-39304, donde es posible una SQLi debido a la falta de sanitización en el proyecto ChurchCRM. Uso python3 CVE-2024-39304.py -u -p -b -v Ejemplo: python3 CVE-2024-39304.py -u FirstLast -p Password123 -b http://localhost/churchcrm -v Enlaces...

CVE-2023-38646

CVE-2023-38646 Python script to exploit CVE-2023-38646 Metabase Pre-Auth RCE via SQL injection The script will GET /api/session/properties to get the setup token and assess exploitability of the target. If it's vulnerable will then print the setup token, else it will quit after an error message. ...

n8n-Authenticated-Expression-Injection-RCE-CVE-2025-68613

n8n Authenticated Expression Injection RCE – CVE-2025-68613 Critical Remote Code Execution CVSS 9.9 in n8n Workflow Automation Tool Proof of Concept – For educational and authorized security research use only ⚠️ Important Legal Warning This code is provided STRICTLY for educational purposes and...