MuhammadWaseem29

BackupFinder. BackupFinder discovers backup files on web servers by generating intelligent patterns.

CVE-2025-53770. Unauthenticated Remote Code Execution via unsafe deserialization in Microsoft SharePoint Server (CVE-2025-53770)

SubDomain-Grabber. Python

CVE-2025-29927-POC. Authorization Bypass in Next.js Middleware

SQL-Injection-and-RCE_CVE-2025-57819. FreePBX versions 15, 16, and 17 contain a Remote Code Execution (RCE) vulnerability caused by insufficient sanitization of user-supplied data in endpoints.

CVE-2025-24016. CVE-2025-24016: RCE in Wazuh server! Remote Code Execution

zip-finder. Zip-Finder is an automated tool that scans the Wayback Machine for ZIP, TAR, SQL, and other backup files. It automatically checks for snapshots and generates valid download links for accessible files.

CVE-2025-24799. CVE-2025-24799 SQLi Scanner

React2Shell_Rce-cve-2025-55182. React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack, contain a remote code execution vulnerability.

Casdoor-Exploit. Casdoor SCIM API misconfigurations to create a new user with random credentials and retrieve a list of existing users.

MuhammadWaseem29. Config files for my GitHub profile.

Shodan-Domain-Filter-Assistant. A Chrome extension designed for bug bounty hunters to refine Shodan queries by appending domain filters and opening results in new tabs.

CVE-2025-31131. YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.

CVE-2025-24813. Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../ sequences in paths.

Laragefile-subs-for-nuclei-scan.

universal-content-spoof-poc. Universal Content Spoofing Payloads ✨