Catálogo de exploits

CVE-2022-44268 ImageMagick Arbitrary File Read - Payload Generator

Unauthenticated SQL Injection - Paid Memberships Pro < 2.9.8 (WordPress Plugin)

imbas007/Atlassian-Bitbucket-CVE-2022-36804

miko550/CVE-2022-46169

Microsoft Exchange CVE-2021-26855&CVE-2021-27065

Trinadh465/linux-4.1.15_CVE-2017-1000371

Control Web Panel 7 (CWP7) Remote Code Execution (RCE) (CVE-2022-44877) (Unauthenticated)

Cisco SmartInstall Exploit [CVE-2018-0171]

CVE-2023-23924 (Dompdf - RCE) PoC

paulotrindadec/CVE-2019-9193

Proof of concept for CVE-2022-41220

mistymntncop/CVE-2022-26485

Vulnerability CVE-2021-44228 allows remote code execution without authentication for several versions of Apache Log4j2 (Log4Shell). Attackers can exploit vulnerable servers by connecting over any protocol, such as HTTPS, and sending a specially crafted string.

Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform c CVE project by @Sn0wAlice

Adobe Acrobat Reader - CVE-2023-21608 - Remote Code Execution Exploit

Joomla JCK Editor 6.4.4 - 'parent' SQL Injection

This is a vulnerability in the Linux kernel that was discovered and disclosed in 2017.

The official exploit for Froxlor Remote Code Execution CVE-2023-0315

windows 10 SMB vulnerability

This script implements a lab automation where I exploit CVE-2021-43798 to steal user secrets and then gain privileges on a Linux system.

Exploit for CVE-2022-40684 vulnerability

vulnerabilities, CVE-2022-41903, and CVE-2022-23521, that affect versions 2.39 and older. Git for Windows was also patched to address an additional, Windows-specific issue known as CVE-2022-41953.

In Paradox Security System IPR512 web panel, an unauthenticated user can input JavaScript string, such as </script> that will overwrite configurations in the file "login.xml" and cause the login form to crash and make it unavailable.

Relativ3Pa1n/CVE-2014-2383-LFI-to-RCE-Escalation

DDoS Tool which exploits vulnerability CVE-2004-2449 from vendor GameSpy (now known as OpenSpy). User is prompted for input IP address, and port. (NOTE: Please use this responsibly, I made this as a proof of concept of vulnerability exploitation ONLY. I do not endorse DOSing, DDoSing, or cheating in any way. Use this at your own risk.)

A pwnkit N-Day exploit

A proof of concept exploit for a wordpress 5.6 media library vulnerability

Drity Pipe Linux Kernel 1-Day Exploit

A critical command injection vulnerability was found in multiple API endpoints of the Atlassian Bit bucket Server and Data center. This vulnerability affects all versions of Bitbucket Server and Data Center released before versions <7.6.17, <7.17.10, <7.21.4, <8.0.3, <8.1.2, <8.2.2, and <8.3.1

The manage engine mass loader for CVE-2022-47966