Catálogo de exploits

Woo Inquiry <= 0.1 - Unauthenticated SQL Injection

Exploit of CVE-2021-23639 for the vulnerable library 'md-to-pdf' in JS

local

Nortek Linear eMerge E3 Pre-Auth RCE PoC (CVE-2024-9441)

client-side

CVE-2023-41425 (Wonder CMS XSS to RCE) exploit which serves required scripts locally. Good if you're lost at sea and have found a problem with your bike.

Wechat Social login <= 1.3.0 - Authentication Bypass

This Python script helps to detect the Etherleak (CVE-2003-0001) vulnerability on a target host by analyzing the padding data in network packets. The script uses Scapy to send various types of requests (ICMP, ARP, or TCP) and checks if the responses contain any padding data that could potentially leak sensitive memory contents.

openSIS 9.1 - SQLi (Authenticated)

initial-access

is a PoC for CVE-2024-4040 tool for exploiting the SSTI vulnerability in CrushFTP

infoleak

POC - Jenkins File Read Vulnerability - CVE-2024-23897

GiveWP PHP Object Injection exploit

infoleak

CVE-2021-3129 (Laravel Ignition RCE Exploit)

initial-access

infoleak

PoC script for CVE-2024-24919 vulnerability. It scans a list of target URLs to identify security issues by sending HTTP POST requests and analyzing server responses

p33d/CVE-2024-43917

infoleak

p33d/CVE-2024-45519

infoleak

initial-access

initial-access

GeoServer CVE-2024-36401: Remote Code Execution (RCE) Vulnerability In Evaluating Property Name Expressions

infoleak

initial-access

ADManager Plus Build < 7210 Elevation of Privilege Vulnerability

This project contains a Python script that exploits **CVE-2023-38831**, a vulnerability in **WinRAR** versions prior to 6.23. The exploit generates a **malicious RAR archive** that triggers the execution of arbitrary code when the victim opens a benign-looking file within the archive (such as a PDF).