CVE-2025-26198

🛡️ CVE Disclosure: CVE-2025-26198 — SQL Injection in CloudClassroom-PHP-Project Disclosure Date: 18 June 2025 CVE ID: CVE-2025-26198 Severity: CRITICAL CVSS 9.8 🧩 Summary A critical SQL Injection vulnerability exists in CloudClassroom-PHP-Project v1.0, specifically within the loginlinkadmin.php...

CVE-2014-0094-test-program-for-struts1

About CVE-2014-0094 and Struts 1 Countermeasures Introduction This article summarizes the impact of CVE-2014-0094 on Struts 1. Unless otherwise noted, all versions were verified using Java 1.7.002, Struts 1.3.10, Apache Tomcat 6.0.39, and FreeBSD 8.2. In no event shall we be liable for the conten...

CVE-2026-55168

CVE-2026-55168 This repository contains a simple PoC for CVE-2026-55168 in Runtipi. The issue is an authenticated arbitrary file write that can be reached through the backup restore flow. A crafted backup archive can plant a symlink into restored application data, and a later normal config update...

Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority. id: CVE-2024-7399 info: name: Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution author:...

Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass

Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code via the sgcgoogleanalytic parameter that runs on all pages served by WordPress. The saveGoogleCode function in smartgooglecode.php does not check if the...

XML-RPC Server - Remote Code Execution

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisor namespace lookups. id: CVE-2017-11610 info: name: XML-RPC Serve...

Vite - Arbitrary File Read

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it...

LG Simple Editor <= v3.21.0 - Command Injection

LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within t...

XStream <1.4.6/1.4.10 - Remote Code Execution

Xstream API before 1.4.6 and 1.4.10 is susceptible to remote code execution. If the security framework has not been initialized, an attacker can run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. This can allow an attacker to...

CVE-2022-0847-dirty-pipe-checker

CVE-2022-0847-dirty-pipe-checker Bash script to check for CVE-2022-0847 "Dirty Pipe" https://dirtypipe.cm4all.com/ Usage Check current kernel version ./dpipe.sh Check specific kernel version ./dpipe.sh 5.10.11...

CVE_2020_2546

Twitter: @Hktalent3135773 1、Weblogic RCE exploit CVE20202546 CVE-2020-2915 CVE-2020-2801 CVE-2020-2798 CVE-2020-2883 CVE-2020-2884 CVE-2020-2950 WebLogic RCE T3 payload exploit poc python3 2、exploit GIOP + send bind CVE-2020-2555、CVE-2019-2888、CVE-2019-2888 or others GIOP + send jta rmi or others...

CVE-2024-7591-PoC

CVE-2024-7591-PoC These PoC python scripts test the Kemp LoadMaster for remote code execution. THIS TOOL IS INTENDED FOR TESTING PURPOSES ONLY These scripts were based on Marius Walter's writeup on the specifics of this exploit. You can read their post at:...

CVE-2025-13834-A-Bluetooth-RFCOMM-Out-of-Bounds-Read-Vulnerability-in-Modern-Wireless-Devices

= doi.org/10.5281/zenodo.18323302 = orcid.org/0009-0007-7728-256X README.md: CVE-2025-13834 RFCOMM Bluetooth "Heartbleed" Exploitation Framework Author: Sastra Adi Wiguna Purple Elite Teaming Date: January 20, 2026 Version: 1.0 Full-System Replication License: RED TEAM USE ONLY Do not distribute...

etaHEN

etaHEN - AIO Homebrew enabler 🚀 Support the Project If you find this project useful and would like to support its continued development, consider buying me a coffee! Building from Source The Source code is provided in the Source code folder under GPLv3 with all the necessary files to build it as...

needrestart-sudo-escalate-cve-2024-4890

CVE-2024-4890: needrestart Sudo Privilege Escalation PoC Disclaimer For lab-only use in controlled environments. Do not exploit on production systems without explicit authorization. This PoC is for educational purposes only. The author is not responsible for any misuse or unauthorized access...

CVE-2023-38545

CVE-2023-38545: Curl Vulnerability Proof of Concept This repository contains a Proof of Concept PoC designed to test systems for the CVE-2023-38545 vulnerability. The vulnerability affects the curl utility, specifically versions between 7.69.0 and 8.3.1, and is related to the handling of HTTP...

llm-security-101

LLM Security 101 Delving into the Realm of LLM Security: An Exploration of Offensive and Defensive Tools, Unveiling Their Present Capabilities. As we embrace Large Language Models LLMs in various applications and functionalities, it is crucial to grasp the associated risks and actively mitigate, ...

CVE-2024-4040-SSTI-LFI-PoC

CVE-2024-4040 SSTI & LFI PoC - Exploitation | CrushFTP This is a proof of concept for a Server Side Template Injection SSTI & Local File Inclusion LFI vulnerability in CrushFTP. Features Taking leverage of Critical Severity Vulnerabilities in CrushFTP servers through Server Side Template Injectio...

CVE-2025-5304

CVE-2025-5304 PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation 🚀 PT Project Notebooks ≤ 1.1.3 — Unauthenticated Privilege Escalation CVE-2025-5304 PoC & exploit helper for PT Project Notebooks versions 1.0.0–1.1.3 : Missing authorization in...

CVE-2025-58360

CVE-2025-58360 The vulnerability in question is CVE-2025-58360 CVSS score: 8.2, an unauthenticated XML External Entity XXE flaw that affects all versions prior to and including 2.25.5, and from versions 2.26.0 through 2.26.1. It has been patched in versions 2.25.6, 2.26.2, 2.27.0, 2.28.0, and...