CVE-2026-63030-POC

wp2shell — CVE-2026-63030 + CVE-2026-60137 Cadeia de exploits RCE WordPress one-day. Sem autenticação. CVSS 9.8. Zero dependências — apenas stdlib Python 3.8+. Versões Afetadas Versão| Vulnerável| Corrigida ---|---|--- 6.9.x| 6.9.0 – 6.9.4| ≥ 6.9.5 7.0.x| 7.0.0 – 7.0.1| ≥ 7.0.2 A Cadeia Dois CVEs...

backdoor-apk

backdoor-apk backdoor-apk is a shell script that simplifies the process of adding a backdoor to any Android APK file. Users of this shell script should have working knowledge of Linux, Bash, Metasploit, Apktool, the Android SDK, smali, etc. This shell script is provided as-is without warranty of...

backdoor-apk

backdoor-apk backdoor-apk è uno script shell che semplifica il processo di aggiunta di un backdoor a qualsiasi file APK Android. Gli utenti di questo script shell dovrebbero avere una conoscenza operativa di Linux, Bash, Metasploit, Apktool, Android SDK, smali, ecc. Questo script shell viene...

wp2shell

CVE-2026-63030 + CVE-2026-60137 - « wp2shell » : RCE non authentifiée dans le cœur de WordPress API REST : confusion de routes batch CVE-2026-63030 enchaînée avec une injection SQLauthornotin de WPQuery CVE-2026-60137 → exécution de code à distance avant authentification contre une installation...

kwetza

Introduction By Chris Le Roy @brompwnie [email protected] Kwetza is a tool that allows you to infect an existing Android application with a Meterpreter payload. What does it do? Kwetza infects an existing Android application with either custom or default payload templates to avoid detection ...

firstflagPOISONED

ExploitGym first-flag causality experiment This repository te...

CVE-2019-18890

CVE-2019-18890 CVE-2019-18890 POC Proof of Concept REDMINE BIS 3.2.9/3.3.9 SQL-INJEKTION https://nvd.nist.gov/vuln/detail/CVE-2019-18890 Anforderungen: Zugangsdaten Unterprojekt erforderlich REST-API aktiviert In MySQL sieht die erste Abfrage, bei der die Injection auftritt, wie das folgende...

CVE-2025-5287

CVE-2025-5287 Plugin Likes and Dislikes = 1.0.0 - SQL Injection Non Autenticata Descrizione Il plugin Likes and Dislikes per WordPress è vulnerabile a SQL Injection tramite il parametro 'post' in tutte le versioni fino alla 1.0.0 inclusa, a causa di un escaping insufficiente sul parametro fornito...

trojanizer

TROJANIZER root@kitploit: Version release : v1.1 Stable Author : pedro ubuntu r00t-3xp10it Codename: TroiaRevisited Distros Supported : Ubuntu, Kali, Mint, Parrot OS Suspicious-Shell-Activity SSA RedTeam develop @2017 FRAMEWORK DESCRIPTION root@kitploit: The Trojanizer tool uses WinRAR SFX to...

CVE-2024-52429

CVE-2024-52429 WP Quick Setup history.pushState'', '', '/'; document.forms0.submit;...

EXCELntDonut

| \ / /|| | | | | \ | | | | \ / | || | | | ' | | | | |/ | ' | | | | | | | / \ || || || | | | || || | | | | | | | | | |//||| | || |/ /|| | |, || by @JoeLeonJr @FortyNorthSec EXCELntDonut ist ein Generator für XLM-Makros Excel 4.0. Starte mit C-Quellcode EXE und erhalte ein XLM-Makro Excel 4.0, das...

CVE-2024-50491

CVE-2024-50491 RSVP ME = 1.9.9 - अप्रमाणित SQL इंजेक्शन विवरण RSVP ME WordPress प्लगइन 1.9.9 तक के संस्करणों में SQL इंजेक्शन के लिए संवेदनशील है, क्योंकि उपयोगकर्ता द्वारा प्रदान किए गए पैरामीटर पर अपर्याप्त एस्केपिंग और मौजूदा SQL क्वेरी पर पर्याप्त तैयारी का अभाव है। इससे अप्रमाणित हमलावरों के...

CVE-2024-50488

CVE-2024-50488 Token Login history.pushState'', '...

CVE-2024-13489

CVE-2024-13489 LTL Freight Quotes – Old Dominion Edition = 4.2.10 - SQL Injection non autenticata Descrizione Il plugin LTL Freight Quotes – Old Dominion Edition per WordPress è vulnerabile a SQL Injection tramite i parametri 'editid' e 'dropshipeditid' in tutte le versioni fino alla 4.2.10...

CVE-2024-13485

CVE-2024-13485 LTL Freight Quotes – ABF Freight Edition = 3.3.7 - SQL Injection non autenticata Descrizione Il plugin LTL Freight Quotes – ABF Freight Edition per WordPress è vulnerabile a SQL Injection tramite i parametri 'editid' e 'dropshipeditid' in tutte le versioni fino alla 3.3.7 inclusa, ...

CVE-2024-13481

CVE-2024-13481 LTL Freight Quotes – R+L Carriers Edition = 3.3.4 - SQL Injection non autenticata Descrizione Il plugin LTL Freight Quotes – R+L Carriers Edition per WordPress è vulnerabile a SQL Injection tramite i parametri 'editid' e 'dropshipeditid' in tutte le versioni fino alla 3.3.4 inclusa...

CVE-2024-13478

CVE-2024-13478 LTL Freight Quotes – TForce Edition = 3.6.4 - SQL Injection non autenticata Descrizione Il plugin LTL Freight Quotes – TForce Edition per WordPress è vulnerabile a SQL Injection tramite i parametri 'dropshipeditid' e 'editid' in tutte le versioni fino alla 3.6.4 inclusa, a causa di...

CVE-2024-12270

CVE-2024-12270 ब्यूटीफुल टैक्सोनॉमी फिल्टर्स = 5.1 AND string error-based - WHERE, HAVING, ORDER BY or GROUP BY clause UPDATEXML' injectable POST parameter 'selects0term' is vulnerable. Do you want to keep testing the others if any? y/N n Ghauri identified the following injection points with a...

CVE-2023-5412

CVE-2023-5412 Image horizontal reel scroll slideshow = 13.2 - Iniezione SQL autenticata Subscriber+ tramite shortcode Descrizione: Il plugin Image horizontal reel scroll slideshow per WordPress è vulnerabile a SQL Injection tramite lo shortcode del plugin nelle versioni fino alla 13.2 inclusa a...

CVE-2023-0630

CVE-2023-0630 CVE-2023-0630 - Slimstat Analytics 4.9.3.3 - SQL Injection Subscriber+ Requisiti sqlmap installato e un nome utente e password validi con privilegi di Subscriber+ Utilizzo root@kitploit: usage: CVE-2023-0630.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help...