pocexploitCVE-2025-11554
Proof of concept for exploitation of the vulnerability described in CVE-2025-11554, which concerns the possibility of a privilege escalation through arbitrary requests to user types change endpoint in the i-Educar software.
THREE different reproduction, WORKDIR, EXEC & RUNC.
CVE-2025-60378 — Stored HTML Injection in RISE — Ultimate Project Manager & CRM < 3.9.4 (Invoices & Messaging)
CVE-2025-8088 based path traversal tool
Exploit for CVE-2025-10351. Unauthenticated File Uploa on Melis Platform Framework that leads to RCE
Exploit for CVE-2025-10352. Admin account creation on Melis Platform Framework
Authenticated API Key Exposure in Nagios Log Server 2024R1.3.1
CVE-2025-32462 & CVE-2025-32463
Exploit for CVE-2025-61882 (do not use without any written permission).
Detection for CVE-2025-61882
🔍 Detect SQL injection risks in FreePBX's admin interface safely and efficiently, providing actionable insights and clean JSON reports for security teams.
OxygenOS Telephony provider permission bypass
CVE-2025-60787 Poc - RCE - MotionEye <= 0.43.1b4
This PoC demonstrates the Remote Code Execution (RCE) vulnerability in Apache Pyfory (versions 0.12.0-0.12.2 and legacy PyFury 0.1.0-0.10.3) due to insecure pickle fallback deserialization (CVE-2025-61622).
This repository contains ZAARA's implementation of the exploit for CVE-2021-4034 (PwnKit), a local privilege escalation vulnerability in polkit's pkexec. This tool demonstrates advanced exploitation techniques while maintaining operational security.
AdForest <= 6.0.9 - Authentication Bypass to Admin
🚀 Enhance your penetration testing with PwnKit Helper, a simple tool for exploiting the CVE-2021-4034 vulnerability in pkexec for local privilege escalation.
WordPress License Manager for WooCommerce Plugin <= 3.0.12 is vulnerable to SQL Injection