FreePBX-SQLi-Exploit-Privilege-escalation

FreePBX: From Unauthenticated SQL Injection to Root Shell CVE-2025-57819 • FreePBX 16.0.40.7 • HTB Connected 📋 Executive Summary This walkthrough documents the complete compromise of the HTB machine Connected. The attack chain begins with an unauthenticated SQL injection vulnerability in FreePBX,...

meta-ai-support-prompt

Meta AI Support Assistant System Prompt Extracted system prompt from Meta's AI Support Assistant on June 1, 2026. Files system-prompt.md — Extracted system prompt ⚠️ Disclaimer & Legal Notice Purpose This repository is published strictly for educational and authorized security research purposes...

CVE-2026-27641-Flask-Reuploaded

CVE-2026-27641 is a critical security vulnerability affecting versions of the Flask-Reuploaded library. It allows remote attackers to achieve arbitrary file writes Versions affected: 1.5.0 To test the vulnerability: python3 -m venv flaskreuploadedvenv In flaskreuploadedvenv: pip install...

CVE-2026-58480

CVE-2026-58480 — Blocksy Companion Pro Unauthenticated File Upload RCE Advanced Reviews → saveattachments → Custom Fonts strpos Bypass → shell.woff2.php Overview CVE-2026-58480 also tracked as CVE-2026-15158 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in Blocksy...

nmap

nmap This library aims at providing idiomatic nmap bindings for go developers, in order to make it easier to write security audit tools using golang. What is nmap Nmap Network Mapper is a free and open-source network scanner created by Gordon Lyon. Nmap is used to discover hosts and services on a...

chamilo-lms-unauthenticated-rce-poc

Chamilo LMS Unauthenticated RCE PoC This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220. The system is vulnerable in versions preceding 1.11.24. Usage Clone the repository to your machine and install the dependenci...

CVE-2022-22947-POC

Spring-Cloud-Gateway-CVE-2022-22947 Security advisory for a remote code execution vulnerability in Spring Cloud Gateway. When Spring Cloud Gateway is enabled and the Gateway Actuator endpoint is exposed, applications using Spring Cloud Gateway are susceptible to code injection attacks. An attacke...

n8n-exploit-CVE-2025-68613-n8n-God-Mode-Ultimate

n8n God Mode Ultimate - CVE-2025-68613 Scanner & Exploitation Framework Advanced n8n Workflow Automation RCE Scanner & Exploitation Tool 🎯 Overview n8n God Mode Ultimate is a comprehensive security testing framework designed to detect and validate CVE-2025-68613 in n8n workflow automation...

FrostedFastPair

About POC for CVE-2025-36911 WhisperPair vulnerability, allowing you to connect to supported devices with no authentication info. This firmware only performs discovery and vulnerability confirmation and does not implement complete audio listening. Output on during tests: Testing Mac: will use the...

DonkAI

Hands-on lab for the OWASP Top 10 for LLM Applications 2025 - no real LLM required. DonkAI is deliberately vulnerable web app you can run in one command and use to learn how LLM-integrated systems get broken by actually breaking them. Every OWASP LLM Top 10 category is represented by at least one...

medusa

🐍 MEDUSA - AI Security Scanner...

CVE-2018-11686

CVE-2018-11686 CVE-2018-11686 - FlexPaper PHP Publish Service RCE = 2.3.6 found by Red Timmy Security Technical Analysis: https://www.exploit-db.com/docs/english/46521-flexpaper-=-2.3.6-remote-code-execution-whitepaper.pdf Security advisory: unknow Proof Of Concept: 1. Removing the config files T...

CVE-2022-35914-poc

CVE-2022-35914 PoC Referencias https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr Uso root@kitploit: pip install -r requirements.txt root@kitploit: ./CVE-2022-35914.py -h usage: CVE-2022-35914.py -h -u URL -c CMD -f HOOK --check --user-agent USERAGENT CVE-2022-35914 - GL...

linuxprivcheck

linuxprivcheck Script de Python para escalada de privilegios en Linux El autor original es Mike Czumak Tv3rn1x -- @SecuritySift. Guiones old-linuxprivchecker.py: Famous linuxprivchecker.py Python con actualizaciones - Ya no lo actualizaré. linuxprivchecker3.py: Famous linuxprivchecker.py,...

CVE-2022-29056

CVE-2022-29056 Exploit Automation For Educational Purposes 🚨 📌 Description This is a Python script with a graphical interface Tkinter that allows the user to test automated request submissions to a login endpoint. The goal is to simulate how servers respond to different payload sizes and analyze...

uafuzz

UAFuzz: Binary-level Directed Fuzzing for Use-After-Free Vulnerabilities Directed Greybox Fuzzing DGF like AFLGo aims to perform stress testing on pre-selected potentially vulnerable target locations, with applications to different security contexts: 1 bug reproduction, 2 patch testing or 3 stati...

opa

Open Policy Agent Open Policy Agent OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. OPA is proud to be a graduated project in the Cloud Native Computing Foundation CNCF landscape. For details read the CNCF...

awesome-incident-response

Awesome Incident Response A curated list of tools and resources for security incident response, aimed to help security analysts and DFIR teams. Digital Forensics and Incident Response DFIR teams are groups of people in an organization responsible for managing the response to a security incident,...

CVE-2024-23700

CVE-2024-23700 - Android Companion Device Privilege Escalation PoC This project demonstrates CVE-2024-23700, a privilege escalation vulnerability related to the Companion Device mechanism on Android. The PoC shows how an app can exploit the companion device association flow to obtain certain...

live-server-evil-crawler

Live Server Evil Crawler Un sitio de GitHub Pages para demostrar la vulnerabilidad de la extensión Live Server de VSCode CVE-2025-65717. Resumen Esta herramienta demuestra una vulnerabilidad donde Live Server permite solicitudes desde cualquier origen, lo que permite que páginas web maliciosas...