CVE-2021-21972

Usage:CVE-2021-21972.py option -u or --url: Target URL -t or --type: Payload type ssh/webshell -f or --file: File to upload webshell or authorizedkeys Example: CVE-2021-21972.py -u https://127.0.0.1 -t webshell -f shell.jsp -p or --proxy: Set proxy Example: CVE-2021-21972.py -u https://127.0.0.1 ...

SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...

Eclipse Jetty ConcatServlet - Information Disclosure

Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information,...

CVE-2021-21424

CVE-2021-21424 Directory Traversal and file exposure • CVE-2021-21424 • Description: WebProfiler exposes internal server paths if it is not disabled in production. • Affected versions: Symfony 2.8 to 5.x. • Typical bypass: direct access to /appdev.php/profiler/. Summary of CVE-2021-21424 • CVE:...

CVE-2025-29927-Proof-of-Concept

Walkthrough Step 1 5 min Hint Which network services are exposed by the target? — — — Solution kali@kali:$ nmap kali@kali:$ nmap -sC -sV -p Step 2 5 min Hint 1 The landing page only reveals a login page, but web servers often expose additional paths. Hint 2 Try using a directory brute-forcing too...

WebShells

WebShells WebShell studying...

ai-agent-gateway

@tuskira/gateway-web Admin console for the Tuskira AI Agent Gateway. React 19 + Vite + TypeScript strict + Tailwind CSS 4 + shadcn/ui. Develop Requires Node 26+ and npm 11+ no pnpm. npm install npm run dev The dev server proxies /api to http://localhost:8081 see vite.config.ts, so run the gateway...

SmartScanner-Source

SmartScanner A web vulnerability scanner built with C++17 and Qt 6, featuring graphical and command-line interfaces. This repository contains a reconstruction of SmartScanner 3.0.0 for educational purposes. It combines a web crawling engine, vulnerability detection modules, and JSON reporting...

CVE-2023-41080

vulnerable: http://localhost:8081//secret.html;@example.com Redirect to arbitrary web site in this case, https://example.com. patched: http://localhost:8082//secret.html;@example.com ref: https://github.com/advisories/GHSA-q3mw-pvr8-9ggc...

CVE-2026-6356

Augmentt: Privilege Escalation via Parameter Tampering Credits This CVE was a collaborative effort between: HelloWorld Author – GitHub: https://github.com/Penquinsecq Raznov – GitHub: https://github.com/basraznov Description A vulnerability in the web application allows standard users to escalate...

SECMON

SECMON - Infosec Watching Tool -red Description SECMON is a web-based tool for the automation of infosec watching and vulnerability management with a web interface. A demo is available here. A Discord channel is available here Features Mail alerting when a new CVE is published and which concerns...

Source

LibreWolf Source Repository This repository contains all the patches and theming that make up LibreWolf, as well as scripts and a Makefile to build LibreWolf. There also is the Settings repository, which contains the LibreWolf preferences. LibreWolf overview graph LR FFSRCFirefox Source...

CLEANSTART-2026-JH53704 Werkzeug is a comprehensive WSGI web application library

CVE-2026-102598 affects multiple packages. Werkzeug is a comprehensive WSGI web application library. See references for individual vulnerability details...

CVE-2026-18782-TREX-MES-Uygulamalarinda-SQL-Zafiyeti

TREX-MES-Uygulamalarında-SQLi-Zafiyeti CVE-2026-18782 Genel Bakış TREX MES, üretim sahasından veri toplamak ve yönetmek için kullanılan ticari bir Üretim Yürütme Sistemi MES / Endüstri 4.0 platformudur. Uygulamanın web API'si, istemciden gelen sql parametresi doğrudan arka uçtaki Microsoft SQL...

PT-2026-108882

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0...

PT-2026-108911

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...

PT-2026-108845

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through 1.4.3.2...

PT-2026-108854

Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1...

PT-2026-108822

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11...

PT-2026-108831

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10...