CVE-2021-43609-POC

Spiceworks Sort SQLi Hay una SQLi en un parámetro sort de Spiceworks. La cadena completa de explotación es SQLi - lectura de archivos - RCE. Demo Requisitos previos apt update && apt install -y ruby-dev nodejs python3 python3-pip libsqlite3-dev pip3 install requests gem install bundler && cd rce ...

CVE-2022-40032_Simple-Task-Managing-System-V1.0-SQL-Injection-Vulnerability-Unauthenticated

CVE-2022-40032: Simple Task Managing System - 'login' and 'password' SQL Injection Unauthenticated Exploit Title: Simple Task Managing System - 'login' and 'password' SQL Injection Unauthenticated Date: 2022-01-09 Exploit Author: Hamdi Sevben Vendor Homepage:...

CVE-2022-23046

CVE-2022-23046 PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. Installation 1. Build git clone https://github.com/dnr6419/CVE-2022-23046.git cd CVE-2022-23046 &&...

cotonti-commentswidget-poc

Cotonti CommentsWidget PHP Object Injection PoC Safe local proof of concept for the PHP object injection issue identified in Cotonti's CommentsWidget implementation. Vulnerability Project: Cotonti Affected component: plugins/comments/inc/CommentsWidget.php CWE: CWE-502 — Deserialization of...

CVE-2024-4577

CVE-2024-4577 Environment Setup Files and PHP Files --poc-- Invoke-WebRequest -Method POST -Headers @"Content-Type" = "application/x-www-form-urlencoded" -Body "" -Uri "http://localhost/test.php?%ADd+allowurlinclude%3D1+%ADd+autoprepend file%3Dphp://input"...

CVE-2025-4396

CVE-2025-4396 - WordPress Relevanssi Time-Based Blind SQL Injection Toolkit Overview This repository contains a practical research and validation toolkit for CVE-2025-4396 , an unauthenticated Time-Based Blind SQL Injection affecting the WordPress Relevanssi plugin through the cats parameter. The...

OpenSource-ERP-SQL-Injection

OpenSource-ERP-SQL-Injection OpenSource ERP application has SQL Injection vulnerability. CVE-2019-5893 https://vulners.com/cve/CVE-2019-5893 https://www.exploit-db.com/exploits/46118 PoC - Get DB name POST /db/utils/query/data.xml HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64...

Axelor-vulnerability-CVE-2025-50341

CVE-2025-50341: Sql Injection on Axelor CVE ID: CVE-2025-50341 Reporter: Milad Seddigh Product: Axelor Affected Versions: v5.2.4 Impact: Sql Injection → exfiltrating database content. Summary A Boolean-based SQL injection vulnerability was discovered in the “domain” parameter of the Axelor. An...

CVE-2021-27905

CVE-2021-27905 Apache Solr ReplicationHandler Server Side Request Forgery SSRF Hit Counter Apache Solr stands for Searching On Lucene with Replication is a free, open-source search engine based on the Apache Lucene library. Written in Java. Apache Solr has RESTful XML/HTTP and JSON APIs and clien...

CVE-2023-23333

Summary: There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php. Vendor: SolarView Compact Affected Product: SolarView Compact Version: SolarView Compact =ver 6.00 poc: curl...

exploit-CVE-2016-8016-25

McAfee Virus Scan for Linux multiple remote flaws THIS EXPLOIT AND ALL THE CODE IN THIS REPO WERE REMOVED TO AVOID ANY PROBLEMS REGARDING VIOLATING ANY MCAFEE LICENSE McAfee VirusScan Enterprise for Linux is a enterprise antivirus solution by Mcafee. Its unique, Linux-based on- access scanner...

CVE-2024-43965

CVE-2024-43965 SendGrid for WordPress = 1.4 - Unauthenticated SQL Injection Description The SendGrid for WordPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

cve-2023-5044

CVE-2023-5044 Ingress Nginx Exploit Proof-Of-Concept This is a quick Go program to exploit the recent CVE in the Ingress Nginx controller. Details on how to do this are already out there via Rory McCune's blog at https://raesene.github.io/blog/2023/10/29/exploiting-CVE-2023-5044/, this just...

CVE-2025-55182-exploit

CVE-2025-55182-exploit TL;DR This is for legal penetration testing purposes only. Do not engage in any illegal activities. How to use python3 exploit.py Demo Video...

WordPress-XStore-theme-SQL-Injection

WordPress-XStore-theme-SQL-Injection CVE-2024-33559 XStore theme-SQL Injection CVE-2024-33551 is a SQL injection vulnerability found in 8theme XStore, an ecommerce platform built on WordPress. This vulnerability allows attackers to execute malicious SQL commands on the database, which can lead to...

CVE-2023-48842

CVE-2023-48842 Source : D-Link Go-RT-AC750 revAv101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi. https://drive.google.com/file/d/1y5omf2SAhNmcPqDxCSRTvJVAWwPcH/view Little upgrade : I updated the script which is now on steroids, the scrip...

CVE-2025-34030-PoC

CVE-2025-34030 - sar2html 'plot' parameter RCE CVSS: 10.0 Critical Vulnerability: OS Command Injection Programming Language: PHP Exploit Code: Python References: https://nvd.nist.gov/vuln/detail/CVE-2025-34030 https://www.vulncheck.com/advisories/sar2html-command-injection Description sar2html...

CVE-2024-4577

Just for researching Poc For Default XAMPP curl -v -d "" http://127.0.0.1/php-cgi/php-cgi.exe/?%add+allowurlinclude%3Don+-d+autoprependfile%3Dphp%3A//input+-d+cgi.forceredirect%3D0...

CVE-2025-65094

CVE-2025-65094: WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation IDOR Overview Field| Details ---|--- CVE ID| CVE-2025-65094 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products WBCE/WBCECMS Details Summary A low-privileged user in WBCE CMS...

CVE-2022-46104---POC

CVE-2022-46104 https://www.sourcecodester.com/ XSS has been discovered on Human Resource Management System Project loginn.php page: Execution payload: http://localhost/hrm/loginn.php?msg=%3Cscript%3Ealert%27XSS%27%3C/script%3E...