136537 matches found
CVE-2021-40438
CVE-2021-40438 exploit PoC with Docker setup CD into the directory containing the Apache configuration and Dockerfile shared in repo. Building Image: docker build -t cve-2021-40438:1.0 . Running the Docker Image: docker run --rm -d -p 4444:80 cve-2021-40438:1.0 Note: You can also use Image ID...
CVE-2025-63585
CVE-2025-63585 Blind Time-Based SQL Injection in /action/rtcomments/status parameter: timestamp A blind, time-based SQL injection vulnerability was found in the timestamp parameter of the /action/rtcomments/status endpoint. An authenticated attacker who can supply this parameter may be able to...
CVE-2025-64459
CTF Challenge: Django ORM Injection CVE-2025-64459 Category: Web Security Difficulty: Medium Vulnerability: CVE-2025-64459 - Django ORM Filter Injection 📝 Description We built a secure merch shop with admin panel. Can you bypass the authentication and find the private admin note URL:...
cve-2022-33891
CVE-2022-33891 Apache Spark Shell Command Injection Vulnerability A Python POC for exploiting the Apache Spark Shell Command Injection vulnerability. I saw some other POCs out there but they looked mega sus. This one is clean and simple. I did not discover this exploit/vulnerability. I just wante...
ParamPamPam
ParamPamPam This tool for brute discover GET and POST parameters. Installation With Docker Install Docker git clone https://github.com/Bo0oM/ParamPamPam.git cd ParamPamPam docker build -t parampp . echo -e '!'"/bin/bash\ndocker run -ti --rm parampp $@" /usr/local/bin/parampp parampp -u...
CVE-2024-28995-Nuclei-Template
CVE-2024-28995 Nuclei Template Checks for directory traversal vulnerability in Serv-U versions 15.4.2 and below, which allows reading sensitive files like /etc/passwd. Template Details id: CVE-2024-28995 info: name: Serv-U Directory Traversal Vulnerability author: Hüseyin TINTAŞ severity: high...
cve-2022-31749
CVE-2022-31749 by 1vere$k Simple PoC-checker for CVE-2022-31749 by 1vere$k. It exploits a parameter injection vulnerability in the WatchGuard SSH interface. The vulnerability allows a low privileged user to exfiltrate arbitrary system files to an attacker controlled FTP server. Fortunately, there...
CVE-2023-40924
BUGAuthor: YE Affected version: Contec SolarView Compact 6.00 Vendor: https://www.contecinc.com/ Vulnerability File: downloader.php Description: Attacker exploit the vulnerability through downloader.php? The file parameter reads sensitive files through the directory pass. downloader.php?file...
ParaForge
ParaForge ParaForge is a simple Burp Suite extension to extract the paramters and endpoints from the request to create custom wordlist for fuzzing and enumeration. This is just a simple extension for easy usage. There are more advance and better options available. Features Extract endpoint Extrac...
cve-2024-10914
POC - CVE-2024–10914- Command Injection Vulnerability in name parameter for D-Link NAS Overview A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgiuseradd of the file...
FOXCMS-CVE-2025-29306-POC
FOXCMS Parameter Injection RCE – CVE-2025-29306 This repository contains a Python-based PoC for a Remote Code Execution RCE vulnerability affecting FOXCMS v1.2, a Chinese open-source content management system. CVE-ID: CVE-2025-29306 Affects: FOXCMS v1.2 Type: Service Parameter Injection → Code...
CVE-2024-29671-POC
NEXTU FLETA Wifi6 Router RCE Exploit POC This document describes how the CVE-2024-29671 vulnerability was exploited in the NEXTU FLATA AX1500 Router firmware. Execution Environment This router is based on the MIPS architecture using the Realtek chipset with Little-Endian. The target router firmwa...
CVE-2022-27434
CVE-2022-27434 UNIT4 TETA Mobile Edition 29HF13 was discovered to contain a SQL injection vulnerability via the ProfileName parameter in the errorReporting page. The vulnerability exist in the error page generated by the application in this case: while changing password. Adding quotation mark to...
CVE-2014-2383-LFI-to-RCE-Escalation
CVE-2014-2383 LFI/RFI escalation to RCE Testing environment: dompdf 0.6.0 - php 7.3.33 - apache 2.4.25 During a security assessment the presence of CVE-2014-2383 was discovered. This document is a proof of concept and does not include the details from the initial discovery in order to protect...
CVE-2024-48762
CVE-2024-48762 Description Command injection vulnerability in /usr/www/application/models/settingscamera.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. POC GET /settings/applyfirmware/;idtest123.txt;/false HTTP/1.1 Host: XXXX Response HTTP/1.1 20...
CVE-2024-46658
CVE-2024-46658 Syrotech SY-GOPON-8OLT-L3 v1.6.0240629 Command Injection Vulnerability Usage 1- Edit the URL in the script. 2- Edit the CookieLogin value in the script. 3- Run the script, it will allow you to executing commands. Vulnerability Details GET...
CVE-2018-14699
CVE-2018-14699 UnAuth Command injection in the enableuser function of DroboAccess v2.1 Usage: To use First startup a listener ncat -nvlp 1337 Next run the exploit example: exploit.py -t 192.168.1.122:8080 -l 192.168.1.2 -p 1337 '-t', '--target', help='host for exploitation, ex...
Mass-Assigner
Mass Assigner Mass Assigner is a powerful tool designed to identify and exploit mass assignment vulnerabilities in web applications. It achieves this by first retrieving data from a specified request, such as fetching user profile data. Then, it systematically attempts to apply each parameter...
CVE-2025-52399-SQLi-Institute-of-Current-Students
CVE-2025-52399 - SQL Injection in Institute of Current Students Summary The loginlinkfaculty endpoint in the Institute-of-Current-Students application is vulnerable to SQL Injection via the fid POST parameter. The parameter is not properly sanitized before being used in a SQL query, allowing remo...