phpsploit

Full-featured C2 framework which silently persists on webserver via polymorphic PHP oneliner codeclimate maintainability Created by nil0x42 and contributors !https://assets.kitploit.com/production/public/readmes/320/aca304368ddb35833ee8b1f57c068ae36288119...

CVE-2025-32583

🚨 CVE-2025-32583 — WordPress PDF 2 Post RCE Exploit CRITICAL Vulnerability CVE-ID: CVE-2025-32583 Severity: 9.9 CRITICAL CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 📖 Description A vulnerability in the PDF 2 Post WordPress plugin developed by termel allows Remote Code Inclusion RCE...

HiveJack

HiveJack Esta herramienta puede usarse durante pruebas de penetración interna para volcar credenciales de Windows desde un host ya comprometido. Permite volcar las colmenas de registro SYSTEM, SECURITY y SAM y, una vez copiadas a las máquinas del atacante, ofrece una opción para eliminar estos...

AutoRDPwn

AutoRDPwn es un framework de post-explotación creado en Powershell, diseñado principalmente para automatizar el ataque Shadow en computadoras Microsoft Windows. Esta vulnerabilidad listada como una característica por Microsoft permite a un atacante remoto ver el escritorio de su víctima sin su...

CVE-2026-75962

The Post SMTP WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.0.1 . The root cause is insufficient input sanitization and output escaping regarding the 'user_email' parameter. Attackers can bypass the plugin's validator by using numeric HT...

EUVD-2026-92961

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2026-75962 Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

extractTVpasswords

Extract password from TeamViewer memory using Frida CVE-2018-14333 Hi there, in this article we want to tell about our little research about password security in TeamViewer. The method can help during the pentest time for post exploitation to get access to another machine using TeamViewer...

RSPET

RSPET RSPET Reverse Shell and Post Exploitation Tool es un reverse shell basado en Python equipado con funcionalidades que asisten en un escenario de post-explotación. AVISO: Este software se proporciona con fines educativos y de Penetration Testing y como prueba de concepto. El/los desarrollador...

CrossC2

Marco CrossC2 README | Documentación en chino | READMEFULL | Documentación completa en chino Soporte de CobaltStrike Compatibilidad con la evaluación de seguridad de CobaltStrike en otras plataformas Linux/MacOS/..., e incluye el soporte de desarrollo del módulo de post-explotación de Unix. |...

CVE-2025-50867

Existe una vulnerabilidad de inyección SQL en el endpoint takeassessment2.php de CloudClassroom-PHP-Project 1.0, donde el parámetro POST Q5 se inserta directamente en sentencias SQL sin desinfección. Tipo de Vulnerabilidad : Inyección SQL Proveedor del Producto :...

CVE-2024-9441

Nortek Linear eMerge E3 Pre-Auth RCE PoC CVE-2024-9441 Description: This repository contains a Proof of Concept PoC exploit for Nortek Linear eMerge E3 CVE-2024-9441, which is vulnerable to Remote Code Execution RCE in a pre-authentication state. The vulnerability is triggered via a flaw in the...

rpef

Router Post-Exploitation Framework Actualmente, el framework incluye una serie de módulos de imagen de firmware: 'Verificado' - Este módulo está confirmado para funcionar y es estable. 'No verificado' - Se cree que este módulo funciona o debería funcionar con poco esfuerzo adicional, pero está...

tiktok-scraper

TikTok Scraper & Downloader Scrape and download useful information from TikTok. No login or password are required This is not an official API support and etc. This is just a scraper that is using TikTok Web API to scrape media and related meta information. Content Features To Do Contribution...

CVE-2022-1040

CVE-2022-1040 may the poc with you 外面捡来的 curl --insecure -H "X-Requested-With: XMLHttpRequest" -X POST 'https://x.x.x.x/userportal/Controller?mode=8700&operation=1&datagrid=179&json="🦞":"test"'...

kubesploit

!Licenselicense-imglicense !Downloadsdownload Kubesploit Kubesploit es un servidor y agente de Comando y Control C&C HTTP/2 multiplataforma para post-explotación, diseñado específicamente para entornos contenerizados, escrito en Golang y construido sobre el proyecto Merlin de Russel Van Tuyl...

kubesploit

Kubesploit Kubesploit is a cross-platform post-exploitation HTTP/2 Command & Control server and agent dedicated for containerized environments written in Golang and built on top of Merlin project by Russel Van Tuyl @Ne0nd0g. Our Motivation While researching Docker and Kubernetes, we noticed that...

CVE-2024-22939

target:https://github.com/sunkaifei/FlyCms version: v1.0 FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /system/article/categoryedit Poc history.pushState'', '', '/' Success:...

sqlwinds

SQLWinds SQL Security Assessment & Post-Exploitation Toolkit SQLWinds is a command-line tool for security testing and exploiting Microsoft SQL Server. It provides an interactive environment to deeply analyze servers, escalate privileges, execute attacks, and pivot through networks all with...

ci_fuzz

Descripción: Este script realiza fuzzing en busca de vulnerabilidades de inyección de comandos que resultan en ejecución remota de comandos. Vulnerabilidades similares de OWASP se explican aquí -- https://www.owasp.org/index.php/CommandInjection El script intentará ejecutar comandos del sistema...