vuln-chain-lab
echosecure/vuln-chain-labPoC Docker lab: chaining file upload bypass + stored XSS to create admin accounts. Educational resource for pen testers.
ctfeducationlabs-practice+5
1
echosecure/vuln-chain-labPoC Docker lab: chaining file upload bypass + stored XSS to create admin accounts. Educational resource for pen testers.
calfcrusher/cve-2023-31853Proof-of-concept for reflected XSS in Cudy LT400 web interface, demonstrating session cookie theft and admin takeover via crafted requests.
v1n1v131r4/exploit-csrf-on-scopia-xt-desktop-version-8.3.915.4Proof of concept demonstrating Cross-Site Request Forgery (CSRF) on Avaya SCOPIA XT Desktop, allowing admin password change without anti-CSRF token.
shenal01/cve-2025-60880Proof-of-concept for a stored XSS vulnerability in Bagisto admin panel, demonstrating SVG upload with malicious JavaScript and providing mitigation…
hossainshadat/cve-2025-63420Proof-of-concept for CVE-2025-63420: stored HTML injection in CrushFTP Admin Panel Reports. Includes reproduction steps, CVSS scoring, and payload…
xbz0n/cve-2024-0566Proof-of-concept exploit for CVE-2024-0566, a post-authenticated time-based SQL injection in Smart Manager 8.27.0 WordPress plugin. Demonstrates…
xbz0n/cve-2024-0399Proof-of-concept exploit for CVE-2024-0399, a post-authenticated time-based SQL injection in WooCommerce Customers Manager 29.4, targeting…
baroi-ai/nepstech-xpon-router-cve-2024-40119Cross-Site Request Forgery (CSRF) vulnerability in the password change function, which allows remote attackers to change the admin password without…
pouriam23/vulnerability-in-remix-react-router-cve-2025-31137-CTF challenge replicating CVE-2025-31137 in Remix/React Router Express. Learn to exploit a server-side vulnerability to find the admin flag.
ninjazan420/cve-2026-1729-poc-adforest-wordpress-authentication-bypassThe AdForest theme for WordPress is vulnerable to authentication bypass in all versions including, 6.0.12. This is due to the plugin not properly…
maxmnml/majordomo-cve-2026-27174-pocCVE-2026-27174 - An unauthenticated remote code execution via the admin panel's PHP console feature
clearcdq/zabbix-saml-sso-_cve-2022-23131Exploit for CVE-2022-23131 targeting Zabbix SAML SSO authentication bypass vulnerability. Enables session hijacking and unauthorized admin access.
onurcangnc/cve-2025-57520-stored-xss-in-decap-cms-3.8.3-A stored cross-site scripting (XSS) vulnerability exists in Decap CMS up to version 3.8.3. The issue affects multiple input fields in the **admin…
hossainshadat/cve-2025-57310Proof-of-concept exploit for CVE-2025-57310: CSRF vulnerability in Simple-Faucet-Script v1.07 enabling stored XSS via crafted POST requests to the…
himanshurahi1996/e107_2.1.9_csrf_pocProof-of-concept exploit for CVE-2018-17081, a Cross-Site Request Forgery vulnerability in e107 CMS 2.1.9, demonstrating unauthorized admin actions…
wrathfuldiety/cve-2025-52357Proof of Concept and Security Advisory for XSS vulnerability in the FD602GW-DX-R410 fiber router’s admin console (firmware V2.2.14). Includes…
cve-vuln/cve-2019-20059Yetishare SQL Injection in sSortDir_0 parameter - v3.5.2 - v4.5.4. Apart from an admin being able to exploit this, it could also be used in a CSRF…
gh0st56/cve-2020-13889Proof-of-concept for a stored/reflected XSS vulnerability in Bludit's admin panel showAlert() function, demonstrating unsanitized user input leading…