Catálogo de exploits

Proof of Concept for the Log4Shell vulnerability (CVE-2021-44228), developed as part of the coursework for the curricular unit TPAS in the Master's degree in Information Security at FCUP.

TeamCity server scanner to detect CVE-2023-42793

Automated Exploit for CVE-2020-6287

Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409) exploit

is a PoC tool designed to exploit an authenticated Remote Code Execution (RCE) vulnerability in specific versions of PostgreSQL (9.3 - 11.7)

CVE-2023-22527 | RCE using SSTI in Confluence

is a PoC tool demonstrating an exploit for a known vulnerability in the WebDAV component of IIS6

Zimbra - Remote Command Execution (CVE-2024-45519)

The CVE-2019-16172 Scanner is designed to check LimeSurvey instances for the stored XSS vulnerability.

CVE-2024-26304 is a critical vulnerability (CVSS score of 9.8) affecting ArubaOS

A simple Python script to test an off-by-one vulnerability in the OPIE library (CVE-2010-1938). This vulnerability affects certain FTP servers and may allow for Denial of Service (DoS) or arbitrary code execution.

Python implementation of a tool for decrypting and encrypting sensitive data in Grafana, specifically addressing the vulnerabilities associated with CVE-2021-43798. Grafana encrypts all data source passwords using the AES algorithm with the secret_key found in the defaults.ini configuration file.

Simple hash cracker for Apache Shiro hashes written in Golang. Useful for exploiting CVE-2024-4956.

RCE in pyload prior to 0.5.0b3.dev31.

A Bash script designed to scan multiple domains for the CVE-2024-4577 vulnerability in PHP-CGI.

Exploit of CVE-2021-23639 for the vulnerable library 'md-to-pdf' in JS

EuJin03/CVE-2021-4034-PoC

Woo Inquiry <= 0.1 - Unauthenticated SQL Injection

Nortek Linear eMerge E3 Pre-Auth RCE PoC (CVE-2024-9441)

CVE-2023-41425 (Wonder CMS XSS to RCE) exploit which serves required scripts locally. Good if you're lost at sea and have found a problem with your bike.

Wechat Social login <= 1.3.0 - Authentication Bypass

This Python script helps to detect the Etherleak (CVE-2003-0001) vulnerability on a target host by analyzing the padding data in network packets. The script uses Scapy to send various types of requests (ICMP, ARP, or TCP) and checks if the responses contain any padding data that could potentially leak sensitive memory contents.

GiveWP PHP Object Injection exploit

is a PoC for CVE-2024-4040 tool for exploiting the SSTI vulnerability in CrushFTP

POC - Jenkins File Read Vulnerability - CVE-2024-23897

p33d/CVE-2024-43917

CVE-2021-3129 (Laravel Ignition RCE Exploit)

PoC script for CVE-2024-24919 vulnerability. It scans a list of target URLs to identify security issues by sending HTTP POST requests and analyzing server responses

p33d/CVE-2024-45519

GeoServer CVE-2024-36401: Remote Code Execution (RCE) Vulnerability In Evaluating Property Name Expressions