Catálogo de exploits

K7 Ultimate Security < v17.0.2019 "K7RKScan.sys" Null Pointer Dereference PoC

This script is a proof-of-concept exploit for pfBlockerNG <= 2.1.4_26 that allows for remote code execution. It takes a single target URL or a list of URLs, tries to upload a shell using multiple payloads, executes a command, and then deletes the shell.

This repository contains detailed documentation and code related to the exploitation, detection, and mitigation of two significant vulnerabilities: CVE-2020-0796 (SMBGhost) and Print Spooler.

CVE-2024-37085 unauthenticated shell upload to full administrator on domain-joined esxi hypervisors.

A bash automation that exploits the vulnerable endpoints for the Joomla! API 4.0 - 4.2.7

CVE-2017-16921: In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.

Wonder CMS RCE (XSS)

A PoC Exploit for CVE-2024-3105 - The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress Remote Code Execution (RCE)

检测RDL服务是否运行，快速排查受影响资产

基于135端口检测目标是否存在CVE-2024-38077漏洞

lworld0x00/CVE-2024-38077-notes

Unauthenticated Remote Code Execution in SPIP versions up to and including 4.2.12

Perform With Massive Apache OFBiz Zero-Day Scanner & RCE

RDL的堆溢出导致的RCE

远程探测 remote desktop licensing 服务开放情况，用于 CVE-2024-38077 漏洞快速排查

it is script designed to interact with a router by sending a payload to its system tools. The script retrieves the router's configuration from environment variables to ensure security. It includes functions for generating an authorization header, sending a payload, and logging the process.

Sec-Link/CVE-2024-38077

CVE-2024-38077，本仓库仅用作备份，

psl-b/CVE-2024-38077-check

elliotosama/CVE-2012-2982

jtoalu/CTF-CVE-2019-9053-GTFOBins

SecStarBot/CVE-2024-38077-POC

it is script designed to exploit certain vulnerabilities in routers by sending payloads through SNMP (Simple Network Management Protocol). The script automates the process of authorization, payload generation, and execution, allowing for remote command execution on the target device.

Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.

An alternative solution(as a Magento 2 extension) to fix the XXE vulnerability CVE-2024-34102(aka Cosmic Sting). If you cannot upgrade Magento or cannot apply the official patch, try this one.

Apache OFBiz RCE Scanner & Exploit (CVE-2024-38856)

exploit que vulnera Jenkins hecho en Python

CVE-2024-41651

bolkv/CVE-2024-4320

This repository details a SQL Injection vulnerability in Inventio Lite v4's, including exploitation steps and a Python script to automate the attack. It provides information on the vulnerable code, recommended fixes, and how to extract and decrypt administrative credentials.