MaccaroniC2

MaccaroniC2 - Empowering Command & Control using AsyncSSH MaccaroniC2 is a proof-of-concept Command and Control framework that utilizes the powerful AsyncSSH Python library which provides an asynchronous client and server implementation of the SSHv2 protocol and use PyNgrok wrapper for ngrok...

SharpWMI

SharpWMI SharpWMI is a C implementation of various WMI functionality. This includes local/remote WMI queries, remote WMI process creation through win32process, and remote execution of arbitrary VBS through WMI event subscriptions. Alternate credentials are also supported for remote methods...

WmiExec

WmiExec.ps1 Remote execution tools for Windows that rely only on WMI and PowerShell. Execute console commands remotely and capture stdout/stderr streams without relying on PowerShell Remoting, WinRM or PsExec. Examples Blog post and video about this technique. The example below shows you how...

gargamel

Gargamel Compile Compiled and tested with Rust 1.50+. Open terminal in the project directory and to compile a release build type cargo build --release Debug build can be compiled using cargo build Compiled executable is located at target/release/gargamel.exe or target/debug/gargamel.exe,...

WMIExec

WMIexec Set of python scripts which perform different ways of command execution via WMI protocol. Blog Post https://whiteknightlabs.com/2023/06/26/navigating-stealthy-wmi-lateral-movement/ Usage wmiexecscheduledjob.py Is a python script which authenticates to a remote WMI instance and execute...

SharpMove

SharpMove - .NET authenticated execution for remote hosts Building To compile open Visual Studio project and compile for release. Options WMI SCM DCOM Multiple Task Scheduler Service DLL Hijack DCOM Server Hijack Modify Scheduled Task Modify Service binpath SharpMove.exe action=query...

Chimay-Red

Chimay-Red Reverse engineering of Mikrotik exploit from Vault 7 CIA Leaks See the PDF for more info not updated Vulnerable versions Until RouterOS 6.38.4 What's new in 6.38.5 2017-Mar-09 11:32: ! www - fixed http server vulnerability; Proof of concepts CrashPOC Simple crash sending -1 as...

Webasyst Shop-Script CMS SQL Injection

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

Webasyst Shop-Script CMS SQL Injection

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

Webasyst Shop-Script CMS SQL Injection

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

pg_dump Code Execution

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

SIMATIC RTLS Locating Manager Code Execution

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager is related to deficiencies in the mechanism for verifying input data during backup scenario execution. Exploiting this vulnerability could allow an attacker, operating...

n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution

n8n versions = 0.123.0 and = 0.123.0 and = 0.123.0 and 1.121.3 contain a critical authenticated remote code execution vulnerability via arbitrary file write. An authenticated user can exploit the Git node to overwrite critical files and execute untrusted code on the n8n server, potentially leadin...

MajorDoMo thumb.php - OS Command Injection

MajorDoMo aka Major Domestic Module before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager. id: CVE-2023-50917 info: name: MajorDoMo thumb.php - OS Command Injection author: DhiyaneshDK severity: critical...

Langflow <= 1.8.4 - Path Traversal to RCE via File Upload

The application contains a path traversal vulnerability caused by unsanitized 'filename' parameter in the 'POST /api/v2/files' multipart form data, letting attackers write files to arbitrary filesystem locations, exploit requires crafted request. id: CVE-2026-5027 info: name: Langflow = 1.8.4 -...

TYPO3 ceselector Extension - Insecure Deserialization

TYPO3 extension contains a PHP Object Injection caused by passing attacker-controlled cookie to unserialize without validation, letting remote unauthenticated attackers achieve remote code execution, exploit requires Persistent Mode: Static configuration. id: CVE-2026-46725 info: name: TYPO3...

LiteLLM 1.18.10 - Command Injection

LiteLLM 1.18.10 contains a remote code execution caused by lack of validation of arbitrary command and args in MCP server creation, letting attackers execute OS commands remotely, exploit requires crafted JSON configuration. id: CVE-2026-30623 info: name: LiteLLM 1.18.10 - Command Injection autho...

Dockwatch <= 0.6.567 - OS Command Injection

Dockwatch through 0.6.567 contains an unauthenticated command injection caused by missing exit after authentication redirect in loader.php and unsanitized input in ajax/compose.php, letting remote attackers execute arbitrary shell commands, exploit requires seeding a session flag via incomplete...

Cuppa CMS v1.0 - Authenticated Local File Inclusion

The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using function parameter value as LFI payload. id: CVE-2022-37191 info: name: Cuppa CMS v1.0 - Authenticated Local File Inclusion author: theamanrawat...

ChanCMS <= 3.3.0 - SQL Injection

yanyutao0402 ChanCMS = 3.3.0 contains a SQL injection caused by manipulation of the "key" argument in app/modules/api/service/Api.js Search function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request. id: CVE-2025-10210 info: name: ChanCMS = 3.3.0 - SQL...