CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution

CWP Control Web Panel 0.9.8.1205 contains a remote code execution caused by shell metacharacters in the ttotal parameter in filemanager changePerm request, letting unauthenticated attackers execute code remotely, exploit requires knowledge of a valid non-root username. id: CVE-2025-48703 info:...

Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection

The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among...

Cisco IOS XE WLC - Arbitrary File Upload

A vulnerability in the Out-of-Band Access Point AP Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.This vulnerability is due to the presence of a hard-coded JSON Web...

lazyrecon

/ \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | Utilizzo ./lazyrecon.sh -d domain.com Per escludere sottodomini specifici: ./lazyrecon.sh -d domain.com -e excluded.domain.com,other.domain.com...

NodeGoat

NodeGoat Essendo leggero, veloce e scalabile, Node.js sta diventando una piattaforma ampiamente adottata per lo sviluppo di applicazioni web. Questo progetto fornisce un ambiente per apprendere come i rischi di sicurezza OWASP Top 10 si applicano alle applicazioni web sviluppate con Node.js e com...

web-application-firewall-

Web Application Firewall Simulation Overview This project demonstrates a Web Application Firewall WAF simulation using Flask and a vulnerability checker for CVE-2017-5638. The WAF middleware blocks HTTP requests containing specific patterns, and the vulnerability checker tests for and exploits th...

CVEs

CVE List CVE-2024-22890: My e-Diary App - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22890.md CVE-2024-22909 : Online-Exam-System - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22909.md...

CVE-2024-4577

CVE-2024-4577 - PHP-CGI Argument Injection RCE | | ---|---|--- CVE| Description| CVSSv3 CVE-2024-4577| PHP-CGI Argument Injection Vulnerability| 9.8 | | "CVE-2024-4577 is a critical argument injection vulnerability in PHP that can be exploited to achieve remote code execution RCE. According to...

CVE-2025-24813-POC

JSP Web Shell Uploader A simple Python tool for uploading a basic JSP web shell to one or more targets via HTTP PUT requests. ⚠️ For educational and authorized penetration testing only. Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../...

CVE-2012-1723

Web browser drive-by that exploits CVE-2012-1723 for remote code execution. A walk-through and technical details can be found at https://ethaniel.me/2017/02/09/practice-the-past-cve-2012-1723/...

CVE-2026-10290-SQLI

Hotel and Tourism Reservation System - Unauthenticated SQL Injection in tour.php Vulnerability Details Field| Details ---|--- Title| Hotel and Tourism Reservation System - SQL Injection via tour GET Parameter Vendor| code-projects.org Vendor URL|...

vcenter-cve-2021-21980-lab

CVE-2021-21980 Vulnerable Test Environment Overview Realistic test environment simulating VMware vSphere Web Client path traversal vulnerability. ⚠️ WARNING: Vulnerable test environment. Do NOT expose to internet! Quick Start Build and Run podman build -t vcenter-lab . podman run -d -p 443:443...

CVE-2026-57517-CWP

CVE-2026-57517 CWP Exploit This repository contains a Go-based proof-of-concept tool for testing a known Control Web Panel CWP vulnerability scenario related to CVE-2026-57517. The implementation targets a blind SQL injection path and includes optional webshell deployment and command execution fl...

web-check — Updated!

Web-Check Comprehensive, on-demand open source intelligence for any website 🌐web-check.xyz Kindly supported by: NinjaPear API to get a full B2B profiles from any URL | Hostinger Deploy Web-Check with one click on Hostinger | Warp Built for coding with multiple AI agents ---|---|--- Contents About...

static-code-analysis-helper

Static-Code-Analysis-Helper Description It detects functions that are likely to cause attack methodologies in many web programming languages ​​and frameworks in your project folder. Helps you perform static code analysis. Note : Many of the functions described here may not cause vulnerabilities...

FinalRecon

Twitter - Telegram - il blog di thewhiteh4t FinalRecon è uno strumento di ricognizione web automatico tutto in uno scritto in Python. L'obiettivo di FinalRecon è fornire una panoramica del bersaglio in breve tempo, mantenendo l'accuratezza dei risultati. Invece di eseguire diversi strumenti uno...

certbot

.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...

kismet-docs

DEPRECATED This repo is now merged into the kismet-web-docs repo, and all future changes should go there. The new site engine uses Hugo, and a number of the documentation parts have been converted to YAML data with templates...

dbdtct

dbgdtct Desctiption dbgdtct is a Python-based tool designed to help you detect if a web application is deployed in debug mode—a critical misconfiguration that can expose sensitive information and increase the risk of exploitation in production environments. Installation git clone...

DeliberatelyVulnerableWebApp

Deliberately Vulnerable Web Application Struts 2 This project is a Java web application using the Struts 2 framework. It is built with Maven and can be run using the Jetty server. Prerequisites Java Development Kit JDK 8 or higher Apache Maven 3.6.0 or higher Getting Started Build the project mvn...