CVE-2025-57310

CVE-2025-57310 A Cross-Site Request Forgery CSRF vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code. CWE CWE-352: Cross-Site Request Forgery CSRF CVSS v3.1 Base Score: 8.8 High...

CVE-2013-4322_PoC

CVE-2013-4322PoC A simple python script PoC demonstrating the slow POST chunked transmission vulnerability...

Heroinn

Heroinn A cross platform C2/post-exploitation framework implementation by Rust. This project is for research and study purposes only, and any illegal behavior using this project has nothing to do with this project. Features GUI Interactive PTY shell System infomations collect File manager support...

cve-2022-1040

Environment In Python Environment3.10 It's strongly recommended to use the virtual environment pip3 install baseproxy python3.10 will raise an AttributeError if the version of pyOpenSSLdownloaded with baseproxy is too low. Reinstalling the latest version will fix it. pip3 uninstall pyOpenSSL pip3...

WordPress Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Smash Balloon Social Post Feed versions = 4.13.0...

WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability discovered by Ivaylo in WordPress Plugin Photo Reviews for WooCommerce versions = 1.2.30...

Metasploit-Red-Pentest-Lab

Metasploit-Red-Pentest-Lab Lab exercise involving exploitation of the vsftpd 2.3.4 vulnerability CVE-2011-2523 on Metasploitable 2 and post-exploitation steps...

SQLRecon

SQLRecon SQLRecon is a Microsoft SQL Server toolkit that is designed for offensive reconnaissance and post-exploitation. For detailed information on how to use each technique, refer to the wiki. You can download a copy of SQLRecon from the releases page. Alternatively, feel free to compile the...

s3cXSSer

s3cXSSer This extension will help you to detect GET/POST based XSS vulnerability in any website easily , S3C - XSSER - Chrome extension How to add it to chrome or brave browser 1- Go to brave://extensions/ or chrome://extensions/ 2- enable Developer mode and click Load unpacked 3- locate the fold...

TokenMan

Access and Refresh Token Suite. Token Man is a tool for supporting post-exploitation activities using AAD access and/or refresh tokens. Table of Contents Usage Commands Fetch Search Swap FOCI Application Client ID Map AZ OAuth Usage usage: tokenman.py -h fetch,search,swap,az,oauth ... Token Man -...

CVE-2021-44228

CVE-2021-44228 Using Log4j 2.14 library Vulnerable in User-Agent, POST method and entrypoint /admin/cores?foo= I have uploaded it in Docker Hub: you can pull and run it https://hub.docker.com/repository/docker/iamnewbie/log4j-vuln...

Dragnmove

Dragnmove Dragnmove is a post-exploitaition tool that infects files shared between users in order to move from one system to another. Dragnmove can detect actions like dropping a file into the browser window or attaching a file to an email client. After Dragnmove detects the action, it hooks...

StopDefender

StopDefender Stop Windows Defender programmatically creating a new token using TrustedInstaller and Windefend service accounts. One button stop action, no need for supply commandline options nor pid. Usefull for integration with Post Explotation frameworks. Blogpost...

CVE-2026-97644

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the createcontact function in the v3 REST endpoint POST /gh/v3/contacts ...

CVE-2026-97644

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 4.9 . The flaw exists because the create_contact function in the v3 REST endpoint (POST /gh/v3/contacts) is only gated by the add_contacts cap...

Tenda Router AC11 - Remote Command Injection

Tenda Router AC11 is susceptible to remote command injection vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-31755 info: name: Tenda Router AC11 - Remote Comman...

cisco-CVE-2023-20198-tester

Cisco Tester: Vulnerability Detection Script Table of Contents Overview Features Prerequisites Installation Usage Output Contributing Overview The ciscotester.py script is designed to assess multiple IP addresses for a specific Cisco vulnerability CVE-2023-20198. It performs an HTTP or HTTPS POST...

CVE-2026-37064

CVE-2026-37064 User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user...

PT-2026-104490

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.17.5 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when a malicious filename is supplied to the ppress...

CVE-2026-97644: Improper Privilege Management

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the createcontact function in the v3 REST endpoint POST /gh/v3/contacts ...