CVE-2022-24086-RCE-PoC

CVE-2022-24086 RCE POC About CVE-2022-24086 which Adobe saw being “exploited in the wild in very limited attacks” received a severity score of 9.8 out of 10, and adversaries exploiting it can achieve remote code execution on affected systems without the need to authenticate. Issue that is now...

CVE-2015-1397

POC for CVE-2015-1397 Magento SQL Injection. Read more at : https://blog.checkpoint.com/security/analyzing-magento-vulnerability/...

Magento-CVE-2016-4010

Analysis and Exploitation of Magento Unauthenticated Remote Code Execution Vulnerability CVE-2016-4010 0x00 Preface On May 17, foreign security researcher Netanel Rubin publicly disclosed an unauthenticated remote code execution vulnerability in Magento CVE-2016-4010. This vulnerability actually...

LetMeFuckIt-Scanner

LetMeFuckIt Scanner AutoPWNED Escáner y Exploit Magento El Escáner explora la vulnerabilidad SQLi Vulnerability 1.9.1.0 CE de Magento. La vulnerabilidad fue corregida en el Patch SUPEE-5344 , sin embargo, el escáner sirve para localizar y probar los sistemas que no aplicaron el parche de segurida...

session_reaper_lab

CVE-2025-54236 - SessionReaper Lab Docker environment for practical demonstration of CVE-2025-54236 SessionReaper: PHP Object Deserialization leading to RCE in Magento Open Source 2.4.7. Exclusive use in controlled environment. Do not run against systems without explicit authorization. About the...

CVE-2022-24086-RCE

CVE-2022-24086-RCE CVE-2022-24086 Exploitation tool written in Python 3 compatible with lists of URL/IPs. This download includes a list of over 334,300 potentially vulnerable hosts according to shodan.io and personal scans. This tool is NOT free to prevent abuse. As of now patches are being appli...

CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento

CosmicSting: critical unauthenticated XXE vulnerability in Adobe Commerce and Magento CVE-2024-34102 CVE-2024-34102 is a severe security flaw arising from improper handling of nested deserialization in Adobe Commerce and Magento. This vulnerability permits attackers to exploit XML External Entiti...

CVE-2022-24086

CVE-2022-24086 Tested with: magento 2.4.3 and sample data Docker image: docker.io/bitnami/magento:2.4.3-debian-10-r0 First Name: root@kitploit: var this.getTemplateFilter.filter$order.shippingaddress.cityvar...

NekoBotV1

NekoBotV1Rev | Auto Explotador con más de 500 Exploits y 2000+ Shells Para la versión antigua NekobotV1 NekoBotV1Rev es una herramienta de auto explotación para facilitar la penetración de uno o muchos sitios web Wordpress, Joomla, Drupal, Magento, Opencart, etc.. Características : + Wordpress :...

Magento-CVE-2019-7139-SQLi-PoC

CVE-2019-7139 PoC: Magento SQL Injection This repository contains a proof-of-concept PoC exploit for CVE-2019-7139 PRODSECBUG-2198, an unauthenticated SQL injection vulnerability in Magento, discovered by Charles Fol of Ambionics Security. Vulnerability Details CVE ID : CVE-2019-7139 Affected...

PoC-Funcional---CVE-2026-45247-Mirasvit-Full-Page-Cache-Warmer-RCE-

markdown CVE-2026-45247 - Mirasvit Full Page Cache Warmer for Magento 2 - PHP Object Injection → RCE -red 📋 Descripción CVE-2026-45247 es una vulnerabilidad crítica de Inyección de Objetos PHP PHP Object Injection en la extensión Mirasvit Full Page Cache Warmer para Magento 2 y Adobe Commerce. Un...

CVE-2011-2461_Magento_Patch

CVE-2011-2461MagentoPatch By Edmonds Commerce This CVE relates to a CSRF vulnerability in the Adobe Flex .swf files used by Magento. You can find more information regarding the CVE here: Peter O'Callaghan - Magento CSRF vulnerability via Adobe Flex Minded Security - The old is new, again...

Magento-ver.-2.4.6

Exploit Title: FireBear Studio Improved Import & Export ver. 3.8.6 for Magento 2.4.6 - XSLT Server Side Injection Date: 2023-11-17 Exploit Author: tmrswrr Vendor Homepage: FireBear Studio Software Link: FireBear Studio Improved Import & Export Version: FireBear Improved Import & Export ver. 3.8.6...

magento2-cosmic-sting-patch

Magento 2 Patch for CVE-2024-34102aka Cosmic Sting An alternative solutionas a Magento 2 extension to fix the XXE vulnerability CVE-2024-34102aka Cosmic Sting. If you cannot upgrade Magento or cannot apply the official patch, try this one. If you don't fix this vulnerability, the attacker can RCE...

CVE-2022-35501

CVE-2022-35501 Stored Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The post creation functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the title field, leading to XSS...

magescan

Mage Scan The idea behind this is to evaluate the quality and security of a Magento site you don't have access to. The scenario when you're interviewing a potential developer or vetting a new client and want to have an idea of what you're getting into. Installation .phar Download the magescan.pha...

magescan

Mage Scan La idea detrás de esto es evaluar la calidad y seguridad de un sitio Magento al que no tienes acceso. Es el escenario cuando estás entrevistando a un posible desarrollador o evaluando a un nuevo cliente y quieres tener una idea de lo que te espera. Instalación .phar Descarga el archivo...

CVE-2022-35500

CVE-2022-35500 Stored Cross-site Scripting XSS in leave comment functionality in Amasty Blog Pro for Magento 2 Description The leave comment functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the AmBlogLeaveComment mutation in name...

CVE-2015-1397-Magento-Shoplift

CVE-2015-1397-Magento-Shoplift Vulnerability Details Vulnerability as seen in HackTheBox - SwagShop Stage 1 = exploit.py Gain administrator credentials to Magento CMS dashboard Stage 2 = postauth.py With credentials gained from exploit.py added to postauth.py run: root@kitploit: python3 postauth....

cosmicsting-validator

Un Cosmicsting POC, con un script bash para verificar todos nuestros sitios alojados y confirmar el parche. Este repositorio se proporciona para permitir que los propietarios de tiendas / anfitriones confirmen que el parche se ha aplicado en las tiendas. Dentro de check.bash, agregue dominios a l...