vucsa

Vulnerable Client-Server Application VuCSA Vulnerable client-server application VuCSA is made for learning/presenting how to perform penetration tests of non-http client-server applications. It is written in Java with JavaFX graphical user interface. Currently, the vulnerable application contains...

CVE-2025-14598

CVE-2025-14598 CVSS: 9.8 Remote Unauthenticated SQL Injection leading to Remote Code Execution. Executive Summary A SQL Injection vulnerability was identified in the login functionality of BET e-Portal, a software solution widely deployed across educational institutions for student information an...

CVE-2025-11177

Trigger the SQLi with a time-based payload in the public login curl -w '\nTIME:%timetotal\n' -s \ -d 'log=anything%27%3B%20SELECT%20pgsleep5%3B%20--&pwd=irrelevant&wp-submit=Log+In' \ -d 'redirectto=' \ -d 'testcookie=1' \ 'http://target/wp-login.php'...

Pybelt

NOTE: This project is no longer updated, this will be the last push to this project, if you would like more info, feel free to ping me on Twitter: @staysalty Pybelt Pybelt is an open source hackers tool belt complete with: A port scanner SQL injection scanner Dork checker Hash cracker Hash type...

CVE-2024-43018

CVE-2024-43018 Assign an ID Be officially populated in CVE - Mitre Index Description Technologies used Source and Sink How to execute it Fix Authors Description While investigating for the thesis https://hdl.handle.net/10316/118126 and https://hdl.handle.net/10316/118059 a new vulnerability on...

CVE-2025-10351-POC

CVE-2025-10351 POC - SQL Injection Exploit 💉 POC for CVE-2025-10351: An unauthenticated SQL Injection vulnerability that affects a specific endpoint in Melis Platform Framework. 🔗 References 📄 CVE-2025-10351 on MITRE 📄 Melis Platform Warning on INCIBE Spanish National Cybersecurity Institute 🚀...

CVE-2025-25257-Exploit-Tool

CVE-2025-25257 Exploit Tool Credits Based on watchTowr Labs, 0xbigshaq, and pwner.gg analyses. Warnings For educational purposes only. Use on authorized systems. Modifies database/filesystem. Enhanced Python tool for detecting and exploiting CVE-2025-25257 Pre-Auth SQLi to RCE in Fortinet FortiWe...

Tiredful-API

What is Tiredful API? Tiredful API is intentionally designed broken app. The aim of this web app is to teach developers, QA or security professionals about flaws present in webservices REST API due to insecure coding practice. Who can use Tiredful API? Web developers Web Pentesters Security...

CVE-2024-2876

CVE-2024-2876 POC for SQLi vulnerability in Icegram express Legal Disclaimer The Proof of Concept PoC script provided in this repository serves solely for educational and research objectives. Its purpose is to showcase a specific vulnerability and aid in comprehending associated security risks. A...

CVE-2025-61246

CVE-2025-61246 - SQL Injection Vulnerability in Online Shopping System Overview This repository contains a Proof of Concept PoC for CVE-2025-61246 , a critical SQL Injection vulnerability discovered in the Online Shopping System PHP application. The vulnerability allows an unauthenticated attacke...

ncrack

ncrack Ncrack is a high-speed network authentication cracking tool. It was built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords. Security professionals also rely on Ncrack when auditing their clients. Ncrack was designed...

soc-log-hunter

🛡️ soc-log-hunter — Automated Server Log Threat Detection &...

CVE-2024-9465

CVE-2024-9465 Checkpoint SQL Injection via Time-Based Attack CVE-2024-9465 SHODAN SEARCH https://www.shodan.io/search?query=html%3A%22Expedition+Project%22 html:"Expedition Project" FOFA SEARCH https://en.fofa.info/ body="Expedition Project" || title="Expedition Project" USAGE python3...

CVE-2022-23046

CVE-2022-23046 PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. Installation 1. Build git clone https://github.com/dnr6419/CVE-2022-23046.git cd CVE-2022-23046 &&...

CVE-2024-58290-Xhibiter-SQLi

CVE-2024-58290-Xhibiter-SQLi Proof of Concept PoC for SQL Injection in Xhibiter NFT Marketplace 1.10.2 Collections Endpoint. Discovered by Sohel Yousef. CVE-2024-58290: Xhibiter NFT Marketplace SQL Injection Exploit Title: Xhibiter NFT Marketplace 1.10.2 - SQL Injection Unauthenticated Date:...

CVE-2019-9053-python3-remastered

CVE-2019-9053-python3-remastered The script has been remastered by Teymur Novruzov to ensure compatibility with Python 3. This tool is intended for educational purposes only. Unauthorized use of this tool on any system or network without permission is illegal. The author is not responsible for an...

sqlipy

sqlipy SQLiPy is a Python plugin for Burp Suite that integrates SQLMap using the SQLMap API. SQLMap comes with a RESTful based server that will execute SQLMap scans. This plugin can start the API for you or connect to an already running API to perform a scan. Requirements Jython 2.7 up to 2.7.2 D...

CVE-2025-48932---exploit

Invision Community SQL Injection Exploit CVE-2025-48932 A proof-of-concept exploit demonstrating a SQL injection vulnerability in Invision Community versions = 4.7.20. ⚠️ Disclaimer This tool is provided for educational and authorized security testing purposes ONLY. Unauthorized access to computer...

CVE-2023-49989

CVE-2023-49989 Hotel Booking Management v1.0 - SQL Injection Vulnerability in the "id" parameter at update.php Description : Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php. Vulnerable Product Version : Hotel Booking...

FreePBX-Multiple-CVEs-2025

FreePBX-Multiple-CVEs-2025 This repository documents three security vulnerabilities discovered in FreePBX CVE-2025-66039, CVE-2025-61678, CVE-2025-61675, including analysis, impact, and proof-of-concept details for security research and awareness purposes. Description CVEs 🔴 CVE-2025-61675 A...