113750 matches found
ExpStruts
ExpStruts ExpStruts is a php-based mass exploiter for CVE-2017-5638 .. Screenshots ⚠️ Requirements Python3 for MakMan's Google Scraper Abk Khan @asystolik...
CVE-2024-43363
CVE-2024-43363 CVE-2024-43363 Exploit Script This Python script is designed to test if a Cacti instance is vulnerable to CVE-2024-43363, a Remote Code Execution RCE vulnerability caused by log poisoning. How the Vulnerability Works: Log Poisoning: An attacker injects PHP code into device names,...
CVE-2026-82222-MassExploit
CVE-2026-82222 — GiveWP WordPress Plugin Unauthenticated RCE Critical Unauthenticated Remote Code Execution CVSS 9.8 — GiveWP ≤ 4.16.7.1 This tool exploits CVE-2026-82222 , a vulnerability in the WordPress GiveWP plugin that allows unauthenticated attackers to execute arbitrary commands on the...
CVE-2023-36845
CVE-2023-36845 Juniper JunOS J-Web PHP external variable modification CVE-2023-36845 exploit...
CVE-2023-36845-POC
CVE-2023-36845 PoC Automation Script This script provides an automated Proof of Concept PoC for the vulnerability identified as CVE-2023-36845, which affects the J-Web component of Juniper Networks Junos OS on EX and SRX Series devices. It demonstrates the potential for remote modification of the...
php-reverse-shell
PHP Reverse Shell Just a little refresh on the popular PHP reverse shell script pentestmonkey/php-reverse-shell. Credits to the original author! Works on Linux OS and macOS with /bin/sh and Windows OS with cmd.exe. Script will automatically detect the underlying OS. Works with both, ncat and...
php2shell-checker
PHP Version Checker Check a website or local PHP binary to see if it's vulnerable to php2shell. To install both skills, ask Codex: $skill-installer install both skills from https://github.com/openai/php2shell-checker Use phpcheck-server when you have server access, or phpcheck-url when you only...
HTB-Pterodactyl-Writeup
Penetration Test Report — HackTheBox: Pterodactyl Date: April 8, 2026 Target: Pterodactyl HackTheBox Difficulty: Medium OS: Linux openSUSE Leap 15.6 Tester: V0idW1re Executive Summary The Pterodactyl machine on HackTheBox presented a realistic attack scenario involving a misconfigured web...
CVE-2023-20209
I started looking at Cisco Expressway after I noticed quite a few of them on the internet during Red Team engagements, but never had the time during work to explore the product further. Initially I was looking for an auth bypass to chain into RCE but ran out of time and settled on a post auth RCE...
CVE-2026-21015-PHP-Filter-Chain-Arbitrary-File-Read
CVE-2026-21015 – PHP Filter Chain Arbitrary File Read Program Code PHP // vulnerable.php - Includes file based on user input via filter ?php $file = $GET'page'; // Attempt to sanitize by allowing only .php files, but vulnerable to filter wrapper include"php://filter/convert.base64-encode/resource...
CVE-2022-1329
WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Execution Ngày: 16 tháng 4 năm 2023 Khai thác Tác giả: Việt Hùng https://github.com/phanthibichtram12 Trang chủ của nhà cung cấp: https://elementor.com/ Link phần mềm: https://wordpress.org/plugins/elementor/advanced/ kéo xuống chọn phiên...
CVE-2023-29809
Exploit Title: Unauthenticated SQL injection Google Dork: Date: 27.04.2023 Exploit Author: Lucas Noki 0xPrototype Vendor Homepage: https://github.com/vogtmh Software Link: https://github.com/vogtmh/cmaps Version: 8.0 Tested on: Mac, Windows, Linux CVE : CVE-2023-29809 Description: The vulnerabili...
CVE-2016-10033-PoC
CVE-2016-10033-PoC Wrote this for PentesterLab If you are from PentesterLab's don't cheat, it's alot better to learn. Hope it's useful to someone, if not to me in the future : Has interactive shell, nice argparse stuff asw Usage usage: poc.py -h --target TARGET --backdoor BACKDOOR --proxy --raw...
CVE-2026-7222-XSS
Stored Cross-Site Scripting XSS in Coaching Management System Leads to Account Takeover Product Coaching Management System in PHP Code-Projects.org https://code-projects.org/coaching-management-system-in-php-with-source-code/ Affected Components /modules/student/complaint.php Complaint Submission...
CVE-2023-27372
CVE-2023-27372 SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1. This PoC exploits a PHP code injection in SPIP. The vulnerability exists in the oubli parameter and allows...
CVE-2025-12973
S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator = 1.7.7 - Authenticated Editor+ Arbitrary File Upload The WordPress S2B AI Assistant plugin versions 2.47 and prior contains an arbitrary file upload vulnerability that allows authenticated WordPress users with Editor role or...
MySQL-Fu.rb
MySQL-Fu.rb MySQL-Fu is a Ruby based MySQL Client Script I wrote. It does most of the stuff a normal MySQL client might do: SQL Shell, Update/Delete/Drop Database/Table, Add/Delete Users, Dump Databases/Table w/ option for gzip...... Plus a few extra options to make life a little easier for...
php-rce
PHP Remote Code Execution Exploit for CVE-2026-109618 / CVE-2026-109619. Multiple exploits to achieve RCE on vulnerable PHP targets. Usage +beginsrc sh $ uv sync $ uv run php-rce --url http://target/index.php --cmd "hostname" target: http://target/index.php cmd: hostname trying sessionlfi...
cve-2022-23636-poc
CVE-2022-23626 - m1k1o's Blog Authenticated RCE Authenticated Remote Code Execution via file upload vulnerability in m1k1o's Blog v1.3 and below. Description The ajax.php?action=uploadimage endpoint does not properly validate uploaded file types, allowing an authenticated user to upload a PHP...