Catálogo de exploits

is a PoC tool that targets a vulnerability in the TeamCity server (CVE-2024-27198)

Proof of Concept for the Log4Shell vulnerability (CVE-2021-44228), developed as part of the coursework for the curricular unit TPAS in the Master's degree in Information Security at FCUP.

wargame, CVE-2024-4367

Apache CouchDB 3.2.1 - Remote Code Execution (RCE) Checker

TeamCity server scanner to detect CVE-2023-42793

bka/magento-cve-2024-34102-exploit-cosmicstring

Performs an IPv6 vulnerability scan and packet flood attack on specified targets. The script simulates a SYN flood and ICMP flood attack and optionally sends exploit packets.

Agilevatester/FlaskCache_CVE-2021-33026_POC

The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attac

Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409) exploit

Automated Exploit for CVE-2020-6287

CVE-2023-22527 | RCE using SSTI in Confluence

is a PoC tool demonstrating an exploit for a known vulnerability in the WebDAV component of IIS6

is a PoC tool designed to exploit an authenticated Remote Code Execution (RCE) vulnerability in specific versions of PostgreSQL (9.3 - 11.7)

Python implementation of a tool for decrypting and encrypting sensitive data in Grafana, specifically addressing the vulnerabilities associated with CVE-2021-43798. Grafana encrypts all data source passwords using the AES algorithm with the secret_key found in the defaults.ini configuration file.

A simple Python script to test an off-by-one vulnerability in the OPIE library (CVE-2010-1938). This vulnerability affects certain FTP servers and may allow for Denial of Service (DoS) or arbitrary code execution.

Zimbra - Remote Command Execution (CVE-2024-45519)

CVE-2024-26304 is a critical vulnerability (CVSS score of 9.8) affecting ArubaOS

The CVE-2019-16172 Scanner is designed to check LimeSurvey instances for the stored XSS vulnerability.

Woo Inquiry <= 0.1 - Unauthenticated SQL Injection

Simple hash cracker for Apache Shiro hashes written in Golang. Useful for exploiting CVE-2024-4956.

A Bash script designed to scan multiple domains for the CVE-2024-4577 vulnerability in PHP-CGI.

EuJin03/CVE-2021-4034-PoC

RCE in pyload prior to 0.5.0b3.dev31.

Exploit of CVE-2021-23639 for the vulnerable library 'md-to-pdf' in JS

Nortek Linear eMerge E3 Pre-Auth RCE PoC (CVE-2024-9441)

CVE-2023-41425 (Wonder CMS XSS to RCE) exploit which serves required scripts locally. Good if you're lost at sea and have found a problem with your bike.

This Python script helps to detect the Etherleak (CVE-2003-0001) vulnerability on a target host by analyzing the padding data in network packets. The script uses Scapy to send various types of requests (ICMP, ARP, or TCP) and checks if the responses contain any padding data that could potentially leak sensitive memory contents.

Wechat Social login <= 1.3.0 - Authentication Bypass

GiveWP PHP Object Injection exploit