Tools

mmakingdom/cve-2025-63420

CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent…

kabir0104k/cve-2025-66947

Proof-of-concept for time-based blind SQL injection in a PHP admin panel. Demonstrates exploitation via unsanitized GET parameter, with mitigation…

hossainshadat/cve-2025-63420

Proof-of-concept for CVE-2025-63420: stored HTML injection in CrushFTP Admin Panel Reports. Includes reproduction steps, CVSS scoring, and payload…

shoucheng3/xuxueli__xxl-job_cve-2020-29204_2-2-0

Exploit for CVE-2020-29204 targeting XXL-JOB distributed task scheduling framework, demonstrating remote code execution via unauthenticated access to…

julio-cfa/cve-2024-34832

Proof-of-concept exploit for CVE-2024-34832: directory traversal in CubeCart admin panel leading to remote code execution via crafted `_g` parameter…

r-pradyun/cve-2025-67315

CSRF vulnerability PoC and remediation guide for employee deactivation in an admin panel. Includes CVSS scoring, attack reproduction steps, and…

abdugafforov-bobur/cve-2026-54415-poc

PoC for CVE-2026-54415 — Azuriom CMS (<1.2.11) Broken Access Control → account takeover

capture0x/gallery-plugin-sql-injection

Exploit for SQL injection in WordPress Video Gallery plugin (version 2.3.6) via orderby parameter, enabling unauthenticated database extraction.

sromanhu/totalcms-arbitrary_file-upload--xss_steal_cookies---totaldepot

TotalCMS is affected by Arbitrary File Upload - XSS vulnerability which allows Cross-Site Scriting (XSS) Stored and also stealing session cookies

ch4120n/cve-2026-55579

Python exploit for CVE-2026-55579, an unauthenticated RCE in Pheditor via hardcoded default credentials. Executes commands and uploads files through…

nakiami/mellivora

PHP-based CTF engine for hosting capture-the-flag competitions with arbitrary challenges, scoreboards, hints, team management, and admin console.…

ajayrandhawa/cryptolocker

Open-source ransomware simulator with AES-256 file encryption, system lockdown, and multi-threaded encryption. Includes a web admin interface for key…

awakecoding/wireshark-rdp

Curated RDP Wireshark captures illustrating Kerberos, NTLM, smartcard, NLA, Restricted Admin, Credential Guard, RD Gateway, and clipboard redirection…

catzsec/forceadmin

⚡ Create infinite UAC prompts forcing a user to run as admin ⚡

0xdamian/cve-2018-9995-rs

Rust proof-of-concept that exploits an authentication bypass in DVR/NVR devices to dump admin credentials via vulnerable login endpoints.

cappricio-securities/camjacking

Simulates camera permission phishing attacks for security awareness training, featuring realistic templates, an admin dashboard, and real-time alerts…

aiex-3/confluence-hack

Exploit for CVE-2023-22515 in Atlassian Confluence that creates a new admin user and deploys a web-based shell plugin for command execution on the…