CVE-2024-58391

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the...

CVE-2023-54408

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling...

CVE-2021-41647

CVE-2021-41647 CVE-2021-41647 SQL Injection in Online-Food-Ordering-Web-App The Online-Food-Ordering-Web-App is vulnerable to un-authenticated error and time-based blind SQL Injection attacks. The username parameter on the /login.php page does not sanitize the user input, an attacker is able to...

CVE-2026-63030-Wp2Shell

CVE-2026-63030 wp2shell — WordPress Core Pre-Auth RCE REST API batch route confusion chained with CVE-2026-60137 SQL injection TL;DR — An unauthenticated attacker can chain a WordPress REST API batch-routing bug with a SQL injection in WPQuery to reach full remote code execution on a stock...

CTF_CVE-2020-7471

DOBBYISFREE! CTF: 2020 Christmas CTF Category: WEB Keyword: DOBBYISFREE! Difficulty: ★★★☆☆ Background Since web hackers usually study SQL Injection on MySQL, I created this problem using PostgreSQL so that they can experience attacks on various databases. Solution Intended Solution Since the...

xpath

xpath Advanced XPath injection scanner for authorized security testing. Coded by Chokri Hammedi blue0x1 · MIT Licensed Overview xpath is a fast, multi-technique XPath injection scanner written in Nim. It focuses on practical detection, response comparison, visible extraction, blind extraction, an...

CVE-2023-43144

CVE-2023-43144 Description Assets Management System 1.0 is vulnerable to SQL injection via the id parameter in delete.php PoC sqlmap -u 'http://localhost/delete.php?id=4' --cookie="PHPSESSID=SESSID" --dbms=MySQL --dbs --batch Code review delete.php ?php include 'core/init.php'; $id = $GET'id';...

CVE-2012-2982-Exploit-Script

CVE-2012-2982-Exploit-Script A short and sweet simple exploit script for the CVE-2012-2982 Authenticated RCE vulnerability in the /file/show.cgi/bin endpoint. Webmin RCE Exploit — CVE-2012-2982 This repository contains a Python proof-of-concept exploit for Webmin 🧠 Notes Payload defaults to a bas...

Centreon-20.04

CVE-2020-12688 - Authenticated RCE Centreon 20.04 minHelpCommand.php command name variable RCE CVE-2020-12688 Centreon Latest Release Documentation: https://docs.centreon.com/current/en/releases/centreon-core.html Discovered by: TheCyberGeek Date Discovered: 30/04/2020 Date Disclosed: 15/06/2020...

WP_CROP_RCE

WordPress Image CROP RCE Analysis Report POC & Dockerfile : https://github.com/synod2/WPCROPRCE This document covers CVE-2019-8942 and CVE-2019-8943, known as WordPress Image CROP RCE, which are vulnerabilities found in WordPress versions prior to 4.9.9 and 5.0.1. CVE Number| Disclosure Date|...

CVE-2021-33564

CVE-2021-33564 PoC Exploit script for CVE-2021-33564 Argument Injection in Dragonfly Ruby Gem. Usage Arbitrary File Read python3 poc.py -u https:///system/refinery/images -r /etc/passwd Arbitrary File Write python3 poc.py -u https:///system/refinery/images -w public/test.txt -c test.txt -lu http:...

CVE-2025-69212_PoC

CVE-2025-69212: OpenSTAManager Proof of Concept PoC This repository contains a Proof of Concept PoC demonstrating the vulnerability identified as CVE-2025-69212 within OpenSTAManager, an OS Command Injection vulnerability caused by the P7M signed XML file decoding functionality. The versions...

CVE-2023-2591

CVE-2023-2591: Stored HTML Injection in Item Label in Teampass 3.0.6 - M Nadeem Qazi I recently identified a security vulnerability in nilsteampassnet/teampass, a popular password management tool. This vulnerability, identified as CVE-2023-2591, is a stored HTML injection vulnerability in the ite...

CVE-2021-45041

CVE-2021-45041 PoC for CVE-2021-45041 aka SCRMBT-177 - Authenticated SQL-Injection in SuiteCRM = 8.0.0. Defaults to False --help Show this message and exit. https://github.com/manuelz120/CVE-2021-45041 Example usage: .venv ➜ CVE-2021-45041 git:main ✗ ./exploit.py --host http://localhost --usernam...

CVE-2024-35468

CVE-2024-35468 Submitter: Kha Do Human Resource Management System 1.0 Vulnerability SQL injection Description SQL injection vulnerability in /hrm/index.php in SourceCodester Human Resource Management System 1.0 allow attackers to execute arbitrary SQL commands via the password parameters. Affecte...

CVE-2022-26134

CVE-2022-26134 - OGNL injection vulnerability. Script proof of concept that exploits the remote code execution vulnerability affecting Atlassian Confluence 7.18 and lower products. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or...

CVE-2023-38890

CVE-2023-38890 Description Online Shopping Portal Project V3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in t...

n8n-exploit-CVE-2025-68613-n8n-God-Mode-Ultimate

n8n God Mode Ultimate - CVE-2025-68613 Scanner & Exploitation Framework Advanced n8n Workflow Automation RCE Scanner & Exploitation Tool 🎯 Overview n8n God Mode Ultimate is a comprehensive security testing framework designed to detect and validate CVE-2025-68613 in n8n workflow automation...

CVE-2022-22947

CVE-2022-22947 A code injection attack on spring cloud gateway Summary of the CVE In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+, applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make ...

VulnerableSpringDataRest

Vulnerable Spring DataRest App This is an intentionally Spring Data REST Application to test and demostrate the CVE-2017-8046 vulnerability and the challenges of testing Command Injection and Remote Code Execution via REST apis It has support for Swagger UI to use with tools where Swagger...