CVE-2023-30253-exploit

CVE-2023-30253 — Dolibarr ERP/CRM 17.0.0 Remote Code Execution PHP code injection exploit for Dolibarr ERP/CRM v17.0.0 that allows obtaining a reverse shell as www-data user via the Website/CMS module. ⚠️ For educational purposes and authorized audits only. 📑 Table of Contents What is...

CVE-2023-29489

CVE-2023-29489 exploit This script can exploit many website by CVE-2023-29489 XSS vuln Usage python3 CVE-2023-29489.py list.txt My channel :...

trevorc2

trevorc2 TrevorC2 - Command and Control via Legitimate Behavior over HTTP Written by: Dave Kennedy @HackingDave Website: https://www.trustedsec.com Note that this is a very early release - heavy randomization and encryption to be added soon. TrevorC2 is a client/server model for masking command a...

httrack

HTTrack Website Copier - Development Repository About Copy websites to your computer Offline browser HTTrack is an offline browser utility, allowing you to download a World Wide website from the Internet to a local directory, building recursively all directories, getting html, images, and other...

Powershell-C2

Powershell-C2 This attack stems off of my Powershell Payload Excel Delivery, but it uses a really cool method for Command and Control/persistence on the box. A walk-through can be found here: http://enigma0x3.wordpress.com/2014/01/17/command-and-control-using-powershell-and-your-favorite-website/...

HawkScan

HawkScan Security Tool for Reconnaissance and Information Gathering on a website. python 3.x News Installation Special features TODO Usage Exemples Thanks Donations Tools used Wiki News v2.x - Add proxy function - Redefining priorities/tasks - Let's debug certificate subdomains results - Display...

EasyScan

EasyScan EasyScan is a Python script that analyzes the security of a given website by inspecting its HTTP headers, DNS records, and other configurations. The script generates a security report with a score, grade, and recommendations for addressing potential vulnerabilities. Features & Test Cases...

AllPhish

Hacker Destination's Twitter - Hacker Destination's Blog Webpages : 1 Facebook| 2 Gmail ---|--- 3 Instagram| 4 Twitter 5 Github| 6 Netflix 7 Paypal| 8 Origin 9 Steam| 10 Yahoo 11 LinkedIn| 12 ProtonMail 13 Wordpress| 14 Microsoft 15 IGFollowers| 16 Ebay 17 Pinterest| 18 CrytoCurrency 19 Verizon|...

CVE-2018-7669

CVE-2018-7669 Quick and dirty bruteforcer for CVE-2018-7669 Directory Traversal Vulnerability in Sitecore Usage: ./bruteforce.py https://target.com PotentialWebsiteName1 PotentialWebsiteName2 127.0.0.1:8080...

patch-checker

PatchChecker This is the code base for the service running on: https://patchchecker.com. In short, PatchChecker is a web application running on flask that provides output similar to that of Watson. However by using PatchChecker, one is not required to execute a binary on the target machine...

CVE-2023-27035

CVE-2023-27035 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Vulnerability type: Incorrect Access Control Description: An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the...

CVE-2026-62062

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-62062 CVE-2026-62062 Elementor Website Builder 4.3.1 - Elementor I am @abraxasnull. Loopback lab. The client is CVE-2026-62062-Abraxas-Labs.py. CSRF via a substring. Elementor 4.3.0-4.3.1 skips WordPress REST...

CVE-2026-12227

CVE-2026-12227: Visual Composer Website Builder Unauthenticated Local File Inclusion LFI Summary CVE-2026-12227 is a critical CVSS 9.8 unauthenticated Local File Inclusion LFI vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including...

CVE-2026-12227

CVE-2026-12227: Visual Composer Website Builder Unauthenticated Local File Inclusion LFI Summary CVE-2026-12227 is a critical CVSS 9.8 unauthenticated Local File Inclusion LFI vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including...

Visual Composer <= 45.16.0 - Unauthenticated LFI

Visual Composer Website Builder for WordPress = 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication. id: CVE-2026-12227 info:...

WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting

WordPress MF Gig Calendar plugin 1.1 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize or escape the id GET parameter before outputting back in the admin dashboard when editing an event. id: CVE-2021-24510 info: name: WordPress MF Gig Calendar =1.2 which...

Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting

Redwood Report2Web 4.3.4.5 and 4.5.3 contains a cross-site scripting vulnerability in the login panel which allows remote attackers to inject JavaScript via the signIn.do urll parameter. id: CVE-2021-26710 info: name: Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting author: pikpikcu...

WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting

WordPress Goto Tour & Travel theme before 2.0 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize the keywords and startdate GET parameters on its Tour List page. id: CVE-2021-24235 info: name: WordPress Goto Tour & Travel Theme =2.0 to mitigate the XSS...

WBCE CMS v1.5.4 - Cross Site Scripting (Stored)

A cross-site scripting XSS vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field. id: CVE-2022-45038 info: name: WBCE CMS v1.5.4 - Cross Site Scripting Stored author:...

WordPress Copyright Proof <=4.16 - Cross-Site-Scripting

WordPress Copyright Proof plugin 4.16 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users when a specific setting is enabled. id: CVE-2022-1906...