Nosql-MongoDB-injection-username-password-enumeration

Nosql injection username and password enumeration script Using this script, we can enumerate Usernames and passwords of Nosqlmongodb injecion vulnerable web applications. Exploit Title: Nosql injection username/password enumeration. Author: Kalana Sankalpa Anon LK. Website:...

CVE-2025-5548

⚡ CVE-2025-5548: Vulnerability Research & Exploitation This repository provides a technical analysis and proof-of-concept walkthrough for CVE-2025-5548. This research covers the complete lifecycle of the vulnerability, from initial binary inspection to successful exploitation. ⚠️ Legal & Ethical...

CVE-2026-95819

A SQL injection vulnerability exists in the login.php file of anirbandutta9 College-Notes-Gallery (up to commit 8c1cf3d98f30982d069c88ca172612c001eb39f6). The root cause is the improper handling of the user/pass arguments, allowing for remote manipulation. The exploit has been disclosed to the pu...

CVE-2026-95819: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this vulnerability is an unknown functionality of the file login.php. Such manipulation of the argument user/pass leads to sql injection. The attack may be performed...

GHSA-MM5F-8Q57-4FC4 Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal

Summary plugin/Meet/iframe.php echoes the attacker-controlled user and pass query parameters unescaped into a JavaScript double-quoted string literal inside a block. An attacker who sends a victim to a crafted URL can break out of the string and execute arbitrary JavaScript in the victim's browse...

CVE-2025-9742: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in code-projects Human Resource Integrated System 1.0. This issue affects some unknown processing of the file /login.php. Such manipulation of the argument user/pass leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly...

PT-2024-2490

Name of the Vulnerable Software and Affected Versions Ruijie RG-EG350 versions prior to 20240319 Description A critical issue exists in the vpnAction function of the /itbox pi/vpn quickset service.php?a=set vpn file within the HTTP POST Request Handler component. The issue stems from a failure to...

TEM Opera Plus FM Family Transmitter 35.45 Cross Site Request Forgery Vulnerability

CSRF Change Forward Power: -------------------------...

CVE-2015-10063 saemorris TheRadSystem _login.php redirect sql injection

A vulnerability was found in saemorris TheRadSystem and classified as critical. This issue affects the function redirect of the file login.php. The manipulation of the argument user/pass leads to sql injection. The attack may be initiated remotely. The identifier of the patch is...

CVE-2015-10063: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in saemorris TheRadSystem and classified as critical. This issue affects the function redirect of the file login.php. The manipulation of the argument user/pass leads to sql injection. The attack may be initiated remotely. The identifier of the patch is...

Easy Social Icons < 3.1.4 - Admin+ SQL Injection

The plugin does not sanitize the selectedicons attribute to the cnsswidget before using it in an SQL statement, leading to a SQL injection vulnerability. PoC Author : Qerogram import requests from bs4 import BeautifulSoup BASEURL = "http://localhost:8000" id = "wordpress" pw = "wordpress" def...

PT-2020-14098

Name of the Vulnerable Software and Affected Versions Sourcecodester Pisay Online E-Learning System version 1.0 Description The issue allows remote unauthenticated attackers to bypass authentication and achieve Remote Code Execution RCE via the user email, user pass, and id parameters on the admi...

PT-2019-7445

Name of the Vulnerable Software and Affected Versions ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress Description The issue allows remote attackers to obtain sensitive information, such as user login, user pass, and user email values, via a direct request for the...

Advertiz PHP Script 0.2 Cross Site Request Forgery

Exploit Title: Advertiz PHP Script 0.2 - Cross-Site Request Forgery Update Admin User&Pass Dork: N/A Date: 06.09.2017 Vendor Homepage: http://www.dijiteol.com/ Software Link: http://www.dijiteol.com/p-Advertiz-PHP-Script--No-Accounts-Required--i-2.html Demo: http://dijiteol.com/demos/advertiz/...

Advertiz PHP Script 0.2 - Cross-Site Request Forgery (Update Admin)

Advertiz PHP Script 0.2 - Cross-Site Request Forgery Update Admin Exploit Title: Advertiz PHP Script 0.2 - Cross-Site Request Forgery Update Admin User&Pass Dork: N/A Date: 06.09.2017 Vendor Homepage: http://www.dijiteol.com/ Software Link:...

Advertiz PHP Script 0.2 - Cross-Site Request Forgery (Update Admin)

Exploit Title: Advertiz PHP Script 0.2 - Cross-Site Request Forgery Update Admin User&Pass Dork: N/A Date: 06.09.2017 Vendor Homepage: http://www.dijiteol.com/ Software Link: http://www.dijiteol.com/p-Advertiz-PHP-Script--No-Accounts-Required--i-2.html Demo: http://dijiteol.com/demos/advertiz/...

PT-2015-5928

Name of the Vulnerable Software and Affected Versions GoAdmin CE versions prior to 3.3-1421902800 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the user name or user pass parameter in 'go login.php' or the PATH INFO to 'go login/validate...

Western Digital MyBook Live Login Utility

This module simply attempts to login to a Western Digital MyBook Live instance using a specific user/pass. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/credentialcollection' require...

Jenkins-CI Login Utility

This module attempts to login to a Jenkins-CI instance using a specific user/pass. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/credentialcollection' require...

Extcalendar <= 2 (profile.php) Remote User Pass Change Exploit

No description provided by source. form name=userform action=http://target/register.php method=post input name=step type=hidden value=regform tr td class='tableh2' colspan='2'Account Information/td /tr tr td class='tableb' width='160'Username/td td class='tableb' /td /tr tr td class='tableb'...