CVE-2021-32708

CVE-2021-32708 Affected versions of this package are vulnerable to Race Condition. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. How the Exploit Works...

CVE-2025-56515

CVE-2025-56515 Cross-Site Scripting XSS Vulnerability in Fiora Chat Application CVE-2025-56515: Cross-Site Scripting XSS Vulnerability in Fiora Chat Application Vulnerability Overview CVE ID : CVE-2025-56515 Vulnerability Type : Cross-Site Scripting XSS Attack Type : Remote Impact : Code Executio...

CVE-2024-46377

CVE-2024-46377 PoC for Arbitrary File Upload Vulnerability in Best House Rental Management System 1.0 Overview This Python script demonstrates how to exploit the arbitrary file upload vulnerability in Best House Rental Management System 1.0. The vulnerability allows an attacker to upload a...

CVE-2026-23499

CVE-2026-23499: Saleor vulnerable to stored XSS via Unrestricted File Upload Overview Field| Details ---|--- CVE ID| CVE-2026-23499 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products saleor/saleor Details Saleor allowed authenticated staff users or Apps to upload...

Modified-CVE-2015-3306-Exploit

Modified-CVE-2015-3306-Exploit How to 1. Create a php reverse shell 2. Start server to host shell in the same directory python3 -m http.server 3. Start netcat listener on local port of choice example: nc -nlvp port of choice 4. Run exploit example provided below python3 modifiedCVE20153306.py...

CVE-2021-46078

CVE-2021-46078 Exploit Title: Vehicle Service Management System - 'Multiple' File upload Leads to Stored Cross-Site Scripting Exploit Author: SANU P.L CVE: CVE-2021-46078 CVSS: 4.8 MEDIUM References:...

Upload_Bypass

UploadBypass v3 About Upload Bypass is a simple tool designed to assist penetration testers and bug hunters in testing file upload mechanisms. It leverages various bug bounty techniques to simplify the process of identifying and exploiting vulnerabilities, ensuring thorough assessments of web...

OpenEMR_Vulnerabilities

OpenEMR Remote Code Execution Vulnerability OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious php codes. PoC git clone https://github.com/EmreOvunc/OpenEMRVulnerabilities.git cd OpenEMRVulnerabilities python3 openemrrcepoc.py -t http://127.0.0.1/openemr -u admin -p...

CVE-2026-3891

CVE-2026-3891 — Pix for WooCommerce Unauthenticated File Upload RCE Nonce Leak → certificatecrtpath Upload → Code Execution Overview CVE-2026-3891 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin by linknacional versio...

Thunderstorm

Thunderstorm Thunderstorm is a modular framework to exploit UPS devices. For now, only the CS-141 and NetMan 204 exploits will be available. The beta version of the framework will be released on the future. CVE Thunderstorm is currently capable of exploiting the following CVE: CVE-2022-47186 –...

CVE-2025-29009-POC

CVE-2025-29009-POC Medical Prescription Attachment Plugin for WooCommerce = 1.2.3 - Unauthenticated Arbitrary File Upload. Watch demo here: https://youtu.be/WvW2shDBIFs...

CVE-2018-7600

Drupal 7 CVE-2018-7600 / SA-CORE-2018-002 Install required libraries with: pip install requests pip install bs4 $ python3 drupa7-CVE-2018-7600.py -h ============================================================================= | DRUPAL 7 = 7.57 REMOTE CODE EXECUTION CVE-2018-7600 | | by pimps |...

CVE-2026-15282

CVE-2026-15282 — Instant Appointment Mass RCE Exploit Pre-Auth filegetcontents + fileputcontents → PHP Webshell Overview CVE-2026-15282 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Instant Appointment WordPress plugin ≤ 1.2. The addservicefront AJAX action is...

CVE-2025-57298

Stored XSS via Unsafe Markdown Rendering in Kotaemon Summary Kotaemon is an open-source RAG Retrieval-Augmented Generation based document QA system that provides a web interface for querying uploaded documents such as PDF, Word, and Excel files. A stored cross-site scripting XSS vulnerability...

exploits

exploits Published PoCs can be found at exploitdb.com Patient Appointment Scheduler System v1.0: Inbit Messenger v4.6.0:...

CVE-2023-2825-PoC

CVE-2023-2825-PoC Proof-of-concept for CVE-2023-2825, an arbitrary file read vulnerability in GitLab CE/EE 16.0.0. The script logs in with a valid GitLab account, creates the required public nested group structure, creates a public project, uploads an attachment, and uses the vulnerable upload pa...

CVE-2023-50164

CVE-2023-50164 A scanning utility and PoC for CVE-2023-50164 Considerations CVE-2023-50164's exploitation is very environment specific. This PoC attempts to generalize the exploitation process by requiring the user to enter environment specific details through the script flags. The script attempt...

lazyweb

LazyWeb - Vulnerable Web Application LazyWeb is a demonstration web application designed to showcase common server-side application vulnerabilities. Each vulnerability is categorized with its respective difficulty rating to provide a comprehensive learning experience for developers and security...

CVE-2023-50164-ApacheStruts2-Docker

CVE-2023-50164 : Apache Struts 2 vulnerable Docker container Apache has recently released an advisory regarding CVE-2023-50164, a critical vulnerability with a severity rating of 9.8 that affects Apache Struts 2. CVE-2023-50164 is intricately tied to an organization's Apache Struts architecture a...

CVE-2023-32315

CVE-2023-32315 Openfire Console Authentication Bypass Vulnerability with RCE plugin Setup git clone https://github.com/miko550/CVE-2023-32315.git cd CVE-2023-32315 pip3 install -r requirements.txt Usage python3 CVE-2023-32315.py -t http://127.0.0.1:9090 python3 CVE-2023-32315.py -l lists.txt Step...