CVE-2014-3704
joaomorenorf/cve-2014-3704This code is taken from "Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)" and was converted to Python 3 to suit the exercise in…
educationexploitationlabs-practice+2
1
joaomorenorf/cve-2014-3704This code is taken from "Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)" and was converted to Python 3 to suit the exercise in…
kabir0104k/cve-2025-66947Proof-of-concept for time-based blind SQL injection in a PHP admin panel. Demonstrates exploitation via unsanitized GET parameter, with mitigation…
pouriam23/vulnerability-in-remix-react-router-cve-2025-31137-CTF challenge replicating CVE-2025-31137 in Remix/React Router Express. Learn to exploit a server-side vulnerability to find the admin flag.
0xdtc/crushftp-auth-bypass-cve-2025-31161Exploit for CrushFTP CVE-2025-31161 auth bypass: detects vulnerable targets, enumerates users, and creates unauthorized admin accounts through…
smileyface101/crushftp-as2-bypass-research-cve-2025-54309Research on CrushFTP AS2 authentication bypass allowing unauthenticated admin access. Includes PoC scripts, detection rules, and technical analysis…
caelumisme/cve-2019-9053-pocPython 3 exploit for CVE-2019-9053, an unauthenticated time-based blind SQL injection in CMS Made Simple < 2.2.10, extracting admin credentials and…
caelumisme/cve-2020-29607-pocPython 3 exploit for Pluck CMS 4.7.13 file upload restriction bypass, enabling authenticated admin to upload a PHP webshell and achieve remote code…
eyodav/cve-2025-34157A stored XSS in the project delete flow allows execution of attacker-controlled JavaScript in an administrator’s browser when the admin attempts to…
onurcangnc/cve-2025-57520-stored-xss-in-decap-cms-3.8.3-A stored cross-site scripting (XSS) vulnerability exists in Decap CMS up to version 3.8.3. The issue affects multiple input fields in the **admin…
shoucheng3/xuxueli__xxl-job_cve-2020-29204_2-2-0Exploit for CVE-2020-29204 targeting XXL-JOB distributed task scheduling framework, demonstrating remote code execution via unauthenticated access to…
jonathanrey87/cve-2020-25273Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or password SQL injection.
wrathfuldiety/cve-2025-52357Proof of Concept and Security Advisory for XSS vulnerability in the FD602GW-DX-R410 fiber router’s admin console (firmware V2.2.14). Includes…
rizqimaulanaa/cve-2023-3460Proof-of-concept exploit for CVE-2023-3460 enabling unauthorized admin access in the Ultimate Member WordPress plugin. Intended for educational…
zprototype/cve-2023-29983Proof-of-concept for CVE-2023-29983: stored cross-site scripting via unsanitized token parameter in cmaps auditlog, enabling admin cookie theft.
julio-cfa/cve-2024-34832Proof-of-concept exploit for CVE-2024-34832: directory traversal in CubeCart admin panel leading to remote code execution via crafted `_g` parameter…
0xdtc/magento-ecommerce-rce-cve-2015-1397Bash exploit for CVE-2015-1397 (Magento Shoplift) that injects crafted SQL payloads to create an admin user on vulnerable Magento stores.
asepsaepdin/cve-2023-32315Python exploit for CVE-2023-32315, a path traversal in Openfire's admin console, allowing unauthenticated access to restricted pages. Includes Docker…
vances25/cve-2024-44871Python exploit for MoziloCMS <= 3.0.1 that uploads a PHP web shell via authenticated admin access, renames the file, and executes system commands on…