📄 Veno File Manager 4.4.9 Log Disclosure

This Metasploit module allows unauthenticated attackers to download application logs from Veno File Manager version 4.4.9 by exploiting the save-csv.php endpoint. ================================================================================================================================== |...

📄 Android Kernel /dev/umts_ipc0 Out-Of-Bounds Read / Write

Proof of concept exploit targeting a vulnerability in an Android kernel driver related to GNSS/UMTS IPC /dev/umtsipc0. ================================================================================================================================== | Title : Android Kernel Exploit OOB Read/Write...

📄 TOTOLINK N300RH Buffer Overflow

This is a Metasploit auxiliary module that targets a stack-based buffer overflow in the TOTOLINK N300RH router's setWiFiBasicConfig CGI handler. The vulnerability occurs when the KeyStr parameter is copied into a fixed-size stack buffer without proper bounds checking. Version V6.1c.1390B20191101 ...

📄 HP Poly Voice Unauthenticated Remote Code Execution

CVE-2026-0826 is a critical unauthenticated stack-based buffer overflow vulnerability affecting all models in the VVX series VVX 150, VVX 250, VVX 350, and VVX 450, as well as three models from the Trio IP Conference series Trio 8800, Trio 8500, and Trio 8300. A remote attacker can leverage...

📄 Veno File Manager 4.4.9 Arbitrary File Read / Log Disclosure

Veno File Manager version 4.4.9 proof of concept exploit that demonstrates file and log disclosure vulnerabilities. ================================================================================================================================== | Title : Veno File Manager 4.4.9 - Exploit Tool |...

📄 Wing FTP Server 8.1.2 Remote Code Execution via Session Poisoning

This proof of concept remote code execution exploit abuses a flaw in how Wing FTP Server handles admin session serialization, specifically the mydirectory basefolder field. Version 8.1.2 is affected...

📄 WordPress WP Maps Pro 6.1.0 Authentication Bypass

A vulnerability in the WP Maps Pro plugin for WordPress allows unauthenticated attackers to generate valid authentication tokens via the wpgmptempaccessajax AJAX action. The vulnerability exists because the nonce check can be bypassed, allowing attackers to obtain a temporary access token that...

📄 Microsoft Windows Kernel ISO Mount / Oplock Deserialization Denial of Service

Proof of concept exploit for a logic-based denial of service vulnerability in Windows 11 25H2 Build 26200 that causes permanent kernel state corruption through ISO mounting, oplocks, and Windows Defender scanning...

📄 WordPress Contest Gallery 28.1.4 SQL Injection

WordPress Contest Gallery plugin version 28.1.4 unauthenticated blind SQL Injection exploit written in Python3. ================================================================================================================================== | Title : WordPress Contest Gallery 28.1.4...

📄 Microsoft Windows Defender MsMpEng.exe Race Condition / Privilege Escalation

This PowerShell script demonstrates a local privilege escalation attack targeting a race condition in the Windows Defender engine MsMpEng.exe. ================================================================================================================================== | Title : Windows...

📄 WordPress PickPlugins 2.0.46 OTP Bypass

WordPress PickPlugins plugin version 2.0.46 proof of concept user verification OTP authentication bypass exploit. ================================================================================================================================== | Title : WordPress PickPlugins 2.0.46 User...

📄 Grav CMS Zip Slip Remote Code Execution

This Metasploit module exploits a vulnerability in Grav CMS versions prior to 2.0.0-beta.2. The Direct Install feature in the Admin plugin allows administrators to upload plugins as ZIP files...

📄 CMS Academy Booking 1.0 SQL Injection

CMS Academy Booking version 1.0 suffers from a remote SQL injection vulnerability. ================================================================================================================================== | Title : CMS academy booking v1.0 sql injection vulnerability | | Author : indoush...

📄 Genetec RabbitMQ Local Privilege Escalation

Genetec RabbitMQ local privilege escalation proof of concept exploit for Windows mimicking techniques used in token impersonation-based attacks such as Rotten Potato–style methods...

📄 Microsoft Windows Defender MsMpEng.exe Race Condition / Privilege Escalation

A race condition exists between Windows Defender's MpCleanCallbackFunction cleanup routine and Volume Shadow Copy creation. This vulnerability allows an attacker to escalate privileges to NT AUTHORITY\SYSTEM. This Metasploit module demonstrates the issue...

📄 Wing FTP Server 8.1.2 Authenticated Remote Code Execution

Wing FTP Server versions prior to 8.1.3 allows authenticated administrators to execute arbitrary Lua code on the server. ================================================================================================================================== | Title : Wing FTP Server 8.1.2 - Authenticat...

📄 WordPress OrderConvo 13.5 Path Traversal / File Read

This Metasploit module exploits a path traversal vulnerability in WordPress OrderConvo plugin versions prior to 14 for WooCommerce. The vulnerability exists in the download-file endpoint which fails to properly sanitize the filename parameter, allowing attackers to read arbitrary files from the...

📄 CMS SINDEHOTÉIS 1.2.4 Cross Site Request Forgery

CMS SINDEHOT�IS version 1.2.4 suffers from a cross site request forgery vulnerability. ================================================================================================================================== | Title : CMS SINDEHOTÉIS 1.2.4 CSRF | | Author : indoushka | | Tested on :...

📄 Grav CMS Remote Code Execution

This Python exploit targets a vulnerability in Grav CMS versions prior to 2.0.0-beta.2 by abusing the administrative Direct Install plugin feature to achieve remote code execution...

📄 EspoCRM 9.3.3 Server-Side Request Forgery

This Metasploit module exploits an authenticated server-side request forgery vulnerability in EspoCRM versions up to 9.3.3. The vulnerability exists in the Attachment/fromImageUrl API endpoint which allows users to fetch images from remote URLs. By using alternative IPv4 notations octal, hex,...

📄 EternalBlue MS17-010 SMB Remote Code Execution

This Metasploit module exploits the SMBv1 vulnerability in Microsoft Windows MS17-010 known as EternalBlue. ================================================================================================================================== | Title : EternalBlue MS17-010 SMB Remote Code Execution |...

📄 D-Link DSL2600U rom-0 Admin Password Disclosure

Proof of concept that demonstrates a vulnerability in D-Link DSL2600U routers with firmware version 1.08 that allows unauthenticated attackers to download the rom-0 configuration file containing the administrator password...

📄 dedoc/scramble 0.13.2 Remote Code Execution

This is a Metasploit exploit module for CVE-2026-44262, an unauthenticated remote code execution vulnerability in the Laravel-based tool dedoc/scramble. ================================================================================================================================== | Title :...

📄 CMSsiam 2 SQL Injection

CMSsiam version 2 suffers from a remote SQL injection vulnerability that allows for login bypass. ================================================================================================================================== | Title : CMSsiam v2 Auth by pass | | Author : indoushka | | Tested ...

📄 Discuz! X5.0 Chained Remote Code Execution

This Metasploit module uses race condition and local file inclusion vulnerabilities in Discuz! X5.0 in order to achieve remote code execution. ================================================================================================================================== | Title : Discuz! X5.0...

📄 Discuz! X5.0 Local File Inclusion

This is a Metasploit auxiliary module targeting a local file inclusion vulnerability in Discuz! X5.0. ================================================================================================================================== | Title : Discuz! X5.0 LFI Metasploit Module | | Author :...

📄 NTLM Relay to Self (HTTP to LDAP) Post Exploitation

This Metasploit module performs an NTLM relay-to-self privilege escalation attack. It starts an HTTP-to-LDAP relay server on the compromised host, then triggers the WebClient service via an ETW event allowing a low-privilege user to start it, and coerces the local machine account to authenticate...

📄 Apache Flink Kubernetes Operator 1.14.0 Server-Side Request Forgery

This is a Metasploit auxiliary module to demonstrate a service-side request forgery vulnerability in Apache Flink Kubernetes Operator version 1.14.0. ================================================================================================================================== | Title : Apache...

📄 Casdoor 3.54.1 Path Traversal / Arbitrary File Write

This Metasploit module exploits a path traversal vulnerability in the storage provider management component of Casdoor versions prior to 3.54.1. By creating a Local File System provider with a manipulated pathPrefix, an authenticated administrator can bypass the storage sandbox to write, overwrit...

📄 nginx 1.27.4 Insecure TLS Session Reuse / SSL Certificate Validation Bypass

Proof of concept exploit for nginx version 1.27.4 that demonstrates insecure TLS session reuse leading to certification validation bypass. ================================================================================================================================== | Title : nginx 1.27.4...

📄 BookStack Denial of Service

This Python3 script demonstrates a denial of service condition against a BookStack search endpoint by generating extremely large search queries and sending them with high levels of concurrency. Versions prior to 25.12.1 are affected...

📄 Apache 2.4.66 HTTP/2 mod_http2 Double-Free Denial of Service

This script is a multi-mode security tool that triggers a denial of service against Apache HTTP Server version 2.4.66 related to a double-free condition in HTTP/2 handling...

📄 YAMCS 5.12.6 LdapAuthModule LDAP Injection / Authentication Bypass

This Metasploit module exploits an LDAP injection vulnerability in the YAMCS LdapAuthModule. The username parameter is inserted directly into LDAP search filters without RFC 4515 escaping, allowing an attacker to bypass authentication. By crafting a malicious username containing LDAP special...

📄 BookStack Denial of Service

This Metasploit auxiliary module targets a denial of service vulnerability in BookStack versions prior to 25.12.1 by abusing the search system. ================================================================================================================================== | Title : BookStack...

📄 Wertheim SafeController Software for VAULT ROOMS Traversal / Bypass / Broken Controls

Wertheim SafeController Software for VAULT ROOMS with AssemblyVersion 6.15.8328.28014 suffer from violation of least privilege, broken websocket authorization, broken access control, IP restriction bypass, path traversal, upload restriction bypass, unauthenticated access, hardcoded secret,...

📄 Bloodbank CMS 1.0 SQL Injection

Bloodbank CMS version 1.0 suffers from a remote SQL injection vulnerability. ================================================================================================================================== | Title : bloodbank cms v1.0 sql injection vulnerability | | Author : indoushka | | Teste...

📄 Xerte Online Toolkits 3.15 Shell Upload

This Metasploit module bypasses authentication failure, extension blacklist, and path traversal vulnerabilities in the /editor/elfinder/php/connector.php endpoint to upload and execute a shell in Xerte Online Toolkits versions 3.15 commit 4e40f8030a2e3267267db7ce03e0ff57270be6f5 as there are no...

📄 AnyDesk 9.7.5 Unquoted Service Path

AnyDesk version 9.7.5 unquoted service path privilege escalation to SYSTEM exploit. ================================================================================================================================== | Title : AnyDesk v9.7.5 Unquoted Service Path Privilege Escalation to SYSTEM | |...

📄 Waves Central 16.6.0 Local Privilege Escalation

Waves Central versions 13.0.8 through 16.6.0 suffer from multiple local privilege escalation vulnerabilities. SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Local Privilege Escalation Vulnerabilities product:...

📄 Google Chrome V8 Type Confusion

This Metasploit module exploits a type confusion vulnerability in Google Chrome's V8 JavaScript engine versions prior to 149.0.7827.103. The vulnerability is triggered by a specific pattern that causes type confusion between internal V8 objects, leading to out-of-bounds memory access. Successful...

📄 HotelDruid 3.0.x Credential Exposure / Stress Tester

Proof of concept denial of service and credential disclosure exploit for HotelDruid versions 3.0.0 and 3.0.7. ================================================================================================================================== | Title : HotelDruid 3.0.x Credential Exposure & Stress...

📄 Apache Flink Kubernetes Operator 1.14.0 Server-Side Request Forgery

This ia proof of concept Metasploit module for the Apache Flink Kubernetes Operator version 1.14.0 server-side request forgery vulnerability that also provides metadata extraction...

📄 Casdoor 3.54.1 Arbitrary File Write / Shell Upload

This Python3 script exploits a path traversal flaw in Casdoor version 3.54.1 that allows an authenticated attacker to write files anywhere on the server via a misconfigured storage provider. If written to an executable location, a shell can be minted...

📄 Google Chrome V8 Type Confusion

This JavaScript exploit targets a type confusion vulnerability in the V8 engine of Google Chrome versions prior to 149.0.7827.103. It runs inside the browser and attempts to trigger a JIT optimization flaw using repeated object construction patterns...

📄 Netis N5VN AC1200 1.0.1.1742 Buffer Overflow / Denial of Service

A buffer overflow vulnerability in the Netis N5VN AC1200 router allows an attacker to crash the web server by sending a crafted request. Version 1.0.1.1742 is affected. Exploit Title: Netis N5VN AC1200 - Buffer Overflow DOS Denial of Service Application: Netis N5VN AC1200 Router Version:...

📄 FreeType Font Rendering Overflow Test Harness / Crash Detection

This C program is a testing harness built around the FreeType font rendering library to detect potential memory corruption issues such as heap buffer overflows when loading malicious or malformed TrueType font files...

📄 InnoShop 0.8.2 File Manager File Deletion / Path Traversal

This Metasploit module exploits a path traversal vulnerability in the InnoShop version 0.8.2's File Manager API. The destroyFiles endpoint does not properly validate file paths, allowing an authenticated administrator to escape the intended media/storage sandbox using ../ sequences...

📄 FreeType SHZ 2.14.3 Heap Buffer Overflow

This Python proof of concept framework is designed for security research into a reported heap buffer overflow condition affecting the FreeType TrueType bytecode interpreter. The code constructs specially crafted font structures intended to exercise the SHZ instruction path, generates malformed...

📄 FreePBX SQL Injection / Shell Upload / Remote Root

This Python3 script exploits a remote SQL injection vulnerability in FreePBX and adds a remote shell that achieves root privileges. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3...

📄 BIRD 2.18 Stack Buffer Overflow / Denial of Service Scanner

This Metasploit auxiliary module is designed to assess a vulnerability in the BGP implementation of the BIRD Internet Routing Daemon. The module establishes a BGP session with a target router, performs standard protocol negotiation, and then sends a specially crafted BGP UPDATE message containing...