CVE-2025-6783

Inject an always-true condition into the WHERE clause so that every row matches: curl -i -X POST \ -H "Content-Type: application/json" \ -H "forms-id: poc-001' OR '1'='1' -- " \ -H "domain-id: example.com" \ -d ' "emabedtype":"iframe", "shortcodetitle":"INJECTED", "shortcodetag":"xss", "active":0...

FORTIWEB_CVE-2025-64446-58034

FortiWeb Exploit Simulation CVE-2025-64446 & CVE-2025-58034 Note: This document is for educational and security research purposes only. Do not use to attack systems without authorization. 1. Overview FortiWeb is a Web Application Firewall WAF device used to protect web applications. In 2025, two...

HTB-TwoMillion-Writeup

HTB-TwoMillion-Writeup HackTheBox TwoMillion machine writeup — API abuse, command injection & CVE-2023-0386 HackTheBox — TwoMillion Writeup HackTheBox — TwoMillion Writeup Machine Info Field| Details ---|--- Name| TwoMillion Difficulty| Easy OS| Linux IP| 10.10.11.221 CVE| CVE-2023-0386 Summary...

Injectus

Injectus Simple python tool that goes through a list of URLs trying CRLF and open redirect payloads. ▪ ▐ ▄ ▐▄▄▄▄▄▄ . ▄▄· ▄▄▄▄▄▄• ▄▌.▄▄ · ██ •█▌▐█ ·██▀▄.▀·▐█ ▌▪•██ █▪██▌▐█ ▀. ▐█·▐█▐▐▌▪▄ ██▐▀▀▪▄██ ▄▄ ▐█.▪█▌▐█▌▄▀▀▀█▄ ▐█▌██▐█▌▐▌▐█▌▐█▄▄▌▐███▌ ▐█▌·▐█▄█▌▐█▄▪▐█ ▀▀▀▀▀ █▪ ▀▀▀• ▀▀▀ ·▀▀▀ ▀▀▀ ▀▀▀ ▀▀▀▀...

CVE-2026-76060_ZoneMinder_CommandInjection-PoC

just wait and see Proof of concept for an OS command injection vulnerability in ZoneMinder's event export functionality web/includes/downloadfunctions.php. Monitor names are interpolated directly into shell commands using manual single-quote wrapping instead of escapeshellarg. An attacker who can...

GoRedOps

GoRedOps Telegram: https://t.me/ebytelabs GoRedOps is a collection of Golang projects designed specifically for red teamers and offensive security operations. This repository provides various tools and techniques essential for penetration testing, exploitation, and security research. Table of...

eBPF-hid_guard

eBPF-hidguard See Why This Was Archived below. A Linux kernel-space security monitor for detecting and blocking HID injection attacks Rubber Ducky, O.MG Cable, ESP32-based keyboard emulators using eBPF HID-BPF structops. What This Does Malicious HID devices emulate keyboards and inject keystrokes...

EUVD-2026-95334

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

EUVD-2026-95338

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection...

EUVD-2025-211053

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

GoDefender

🛡️ GoDefender 🛡️ A powerful Go-based security toolkit designed to detect and defend against debugging, virtualization, and DLL injection attacks. GoDefender provides comprehensive protection mechanisms to make reverse engineering and analysis significantly more difficult. ⚠️ WINDOWS ONLY - Designed...

DumpChromeSecrets

!IMPORTANT This project is no longer maintained. Please useDumpBrowserSecrets instead, which supports Chrome, Edge, Brave, Firefox, Opera, Opera GX, and Vivaldi. DumpChromeSecrets Extract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsi...

CVE-2025-55182-POC

CVE-2025-55182 Next.js RCE Scanner CVE-2025-55182 vulnerability scanning and exploitation tool for remote code execution in Next.js applications. Supports batch detection, command execution, Godzilla memory shell injection, and reverse shell functionality. ⚠️ This tool is intended for security...

CVE-2025-15545

CVE-2025-15545 Information Vendor: TP-Link Vendor's website: TP-Link Model: Archer RE605X Hardware version: RE605X v3.0 Firmware version: RE605XEUV31.1.5 Build 20240905 Firmware download address: TP-Link A chain of vulnerabilities — including the use of hardcoded cryptographic keys and a command...

TPASLog4ShellPoC

TPAS Log4Shell PoC This repository contains a Proof of Concept PoC for the Log4Shell vulnerability CVE-2021-44228, developed as part of the coursework for the curricular unit TPAS in the Master's degree in Information Security at FCUP. It features: A React SPA frontend that simulates a generic...

SC3010-Computer-Security

SC3010-Computer-Security — CVE-2017-5638 Attack Recreation This repository is part of the SC3010 Computer Security course project. It recreates CVE-2017-5638 , a critical Remote Code Execution vulnerability in Apache Struts 2 versions 2.3.5–2.3.31 and 2.5–2.5.10, famously exploited in the 2017...

CVE-2018-1270

CVE-2018-1270 - Spring Messaging SpEL Code Execution Vulnerability Yesterday, Spring disclosed an RCE vulnerability. Take a look: CVE-2018-1270: Remote Code Execution with spring-messaging Affected Versions Spring Framework 5.0 to 5.0.4 Spring Framework 4.3 to 4.3.14 This vulnerability does not...

CVE-2019-14339

CVE-2019-14339 Content Provider URI Injection on Canon PRINT 2.5.5 CVE-2019-14339. Proof of concept by @0x48piraj The ContentProvider in the Canon PRINT 2.5.5 application for Android does not properly restrict data access. This allows an attacker's malicious application to obtain sensitive...

CVE-2026-26832

CVE-2026-26832: OS command injection in node-tesseract-ocr Summary node-tesseract-ocr through version 2.2.1 allows OS command injection in recognize in src/index.js. The package builds a shell command string and executes it with childprocess.exec. Because the input path is only wrapped in double...

CVE-2022-22947

CVE-2022-22947 CVE-2022-22947 Spring-Cloud-Gateway En el primer trimestre de 2022, se descubrió una vulnerabilidad interesante y crítica puntuación base de 10.0 de inyección de código en Spring Cloud Gateway que aprovecha la API Actuator para realizar una inyección SpEL, lo que puede llevar a...