Every new exploit,
on the radar.

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'

Pedalo Connector <= 2.0.5 - Authentication Bypass to Administrator

Keycloak admin API allows low privilege users to use administrative functions

POC for CVE-2024-29973

Exploiter a Vulnerability detection and Exploitation tool for CVE-2024-29973 with Asychronous Performance.

PoC and Bulk Scanner for CVE-2024-29973

Exploit for CVE-2024-9570

Bot for Telegram on WooCommerce <= 1.2.4 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass

WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal

Hello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Read

CVE-2024-44000 is a vulnerability in the LiteSpeed Cache plugin, a popular WordPress plugin. This vulnerability affects session management in LiteSpeed Cache, …

is a PoC tool designed to exploit insecurely exposed debug logs from WordPress sites and extract session cookies

CVE-2024-44000-LiteSpeed-Cache

LiteSpeed Unauthorized Account Takeover

i'm noob with saml and keycloak . J4f

Proof of Concept Exploit for CVE-2024-9465

Checkpoint SQL Injection via Time-Based Attack (CVE-2024-9465)

Checkpoint SQL Injection via Time-Based Attack (CVE-2024-9465)

Proof of Concept Exploit for CVE-2024-9464

Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak

Square <= 2.0.0 - Missing Authorization via activate_plugin

A PoC exploit for the CVE-2024-7029 vulnerability found in AvTech devices, allowing Remote Code Execution (RCE)

The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to…

PoC for CVE-2020-6287, CVE-2020-6286 (SAP RECON vulnerability)

PoC for CVE-2020-6287 The PoC in python for add user only, no administrator permission set. Inspired by @zeroSteiner from metasploit. Original Metasploit PR m…

[CVE-2020-6287] SAP NetWeaver AS JAVA (LM Configuration Wizard) Authentication Bypass (Create Simple & Administrator Java User)

sap netweaver portal add user administrator

Automated Exploit for CVE-2020-6287

Checker help to verify created account or find it's mandat

Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409) exploit

CVE-2023-35985 reproduction

tomcat使用了自带session同步功能时，不安全的配置（没有使用EncryptInterceptor）导致存在的反序列化漏洞，通过精心构造的数据包， 可以对使用了tomcat自带session同步功能的服务器进行攻击。PS:这个不是CVE-2020-9484，9484是session持久化的洞，这个是sessi…

用Kali 2.0复现Apache Tomcat Session反序列化代码执行漏洞

Remake of CVE-2020-9484 by Pentestical

Exploit for Apache Tomcat deserialization (CVE-2020-9484) which could lead to RCE

POC for CVE-2020-9484

【Teedy 1.11】Account Takeover via XSS