CVE-2024-44000

ES GenCookieSessionHijack es una herramienta PoC diseñada para explotar registros de depuración expuestos de forma insegura en sitios WordPress y extraer cookies de sesión. Esto permite al atacante secuestrar sesiones activas de administrador y obtener acceso no autorizado al panel de...

CVE-2025-46178

CVE-2025-46178 Cross-Site Scripting XSS vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project. This allows remote attackers to inject arbitrary JavaScript in the context of a victim s browser session by sending a crafted URL, leading to session hijacking or...

CVE-2025-46173

CVE-2025-46173 - Stored Cross-Site Scripting XSS in Online Exam Mastering System 1.0 📌 Summary CVE-2025-46173 is a stored Cross-Site Scripting XSS vulnerability discovered in the Online Exam Mastering System 1.0 by code-projects. The vulnerability exists in the feedback.php component where user...

CVE-2025-67875

CVE-2025-67875: ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking Overview...

CVE-2025-61922-PoC

CVE-2025-61922 Exploit: PrestaShop Checkout Account Takeover A simple, educational proof-of-concept script demonstrating the zero-click account takeover vulnerability in the PrestaShop Checkout module CVE-2025-61922. ⚠️ Legal & Ethical Notice: Use Responsibly This tool is for educational purposes...

CVE-2025-55579

CVE-2025-55579 - SolidInvoice Stored Cross-Site Scripting XSS in Tax Rates Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Tax Rates Feature. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users'...

CVE-2025-25747-HotelDruid-3-0-7-Reflected-XSS

CVE-2025-25747 - Vulnerabilidad XSS Reflejado en HotelDruid 3.0.7 Descripción Vulnerabilidad de Cross Site Scripting en DigitalDruid HotelDruid v.3.0.7 permite a un atacante ejecutar código arbitrario y obtener información sensible a través del parámetro ripristinabackup en el endpoint...

CVE-2022-45436

CVE-2022-45436 Reflected Cross Site Scripting leading to session hijacking in pandorafms Exploit Title: Reflected Cross Site Scripting Date: 15/02/2023 Exploit Author: Damodar Naik Vendor Homepage: https://pandorafms.com/en/ Software Link: https://github.com/pandorafms/pandorafms Version: = v765 ...

LockBit-Ransomware-Analysis

🔐 LockBit Ransomware Analysis – Citrix Bleed Exploitation 📌 Overview This project presents a detailed threat intelligence and incident response analysis of the October 2023 LockBit ransomware attack targeting Boeing. The attackers exploited CVE-2023-4966 Citrix Bleed to hijack NetScaler session...

CVE-2021-24807

CVE-2021-24807 Support Board 3.3.4 Authenticated Stored XSS Authenticated Stored Cross Site Scripting XSS Vulnerability exists in Support Board Version 3.3.4 via Notes parameter. The impact of cross-site scripting vulnerabilities can vary from one web application to another. It ranges from sessio...

CVE-2025-29015

CVE-2025-29015 - Internet Banking System 2.0.0 Stored XSS in pagesaccount.php Description A Stored Cross-Site Scripting XSS vulnerability exists in Code Astro Internet Banking System 2.0.0 via the name parameter in /admin/pagesaccount.php. Malicious JavaScript code can be injected and stored in t...

CVE-2026-41940-PoC-Exploit

🚀 CVE-2026-41940 - cPanel/WHM Authentication Bypass Exploit cPanel & WHM Edition - CRLF Injection to Authentication Bypass & Full Session Hijacking 📌 Overview This exploit leverages CVE-2026-41940 , a critical authentication bypass vulnerability in cPanel/WHM. By injecting a crafted CRLF payload...

CVE-2022-0155-PoC

CVE-2022-0155 Proof-of-Concept PoC This repository contains a demonstration of the CVE-2022-0155 vulnerability. The vulnerability was detected by ranjit-git and is described in detail here. The purpose of this PoC is to demonstrate that the vulnerability doesn't just apply to scenarios where...

CVE-2025-25461

📌 CVE-2025-25461 - Cross-Site Scripting XSS Almacenado en SeedDMS 6.0.29 📝 Descripción Existe una vulnerabilidad de Cross-Site Scripting XSS Almacenado en SeedDMS 6.0.29. Un usuario o administrador malintencionado con el permiso "Add Category" puede inyectar un payload XSS malicioso en el campo d...

ssh-mitm

SSH-MITM - ssh audits made simple An interactive SSH interception tool for authorized security audits. Intercept sessions, monitor live traffic, inject commands, and manipulate file transfers — all in real time. !Follow me on...

QRLJacking

QRLJacking - Un Nuevo Vector de Ataque de Ingeniería Social Encuentra documentación en nuestra Wiki. ¿Qué es QRLJacking? QRLJacking o Quick Response Code Login Jacking es un sencillo vector de ataque de ingeniería social capaz de realizar secuestro de sesión que afecta a todas las aplicaciones qu...

CVE-2025-26202-Details

Detalles de CVE-2025-26202 CVE-2025-26202: Cross-Site Scripting XSS en la Interfaz Web del Router DZS Descripción Existe una vulnerabilidad Cross-Site Scripting XSS en el campo WPA/WAPI Passphrase de la configuración de Seguridad Inalámbrica bandas de 2.4 GHz y 5 GHz en la Interfaz Web del Router...

RDPHijack-BOF

BOF - RDPHijack Cobalt Strike Beacon Object File BOF that uses WinStationConnect API to perform local/remote RDP session hijacking. With a valid access token / kerberos ticket e.g., golden ticket of the session owner, you will be able to hijack the session remotely without dropping any beacon/too...

CVE-2025-52689-PoC

CVE-2025-52689 PoC Code PoC code for CVE-2025-52689 Alcatel-Lucent Enterprise AP1361D Wi-Fi Access Point Authentication Bypass Vulnerability. This POC was developed for the SpiritCyber 2024 competition held during Singapore International Cyber Week 2024. Usage 1. Install requirements with pip...

CookieCatcher

CookieCatcher CookieCatcher is an open source application which was created to assist in the exploitation of XSS Cross Site Scripting vulnerabilities within web applications to steal user session IDs aka Session Hijacking. The use of this application is purely educational and should not be used...