yaml-payload-2

yaml-payload A SnakeYAML deserialization exploit payload for CVE-2022-1471 , adapted from artsploit/yaml-payload originally based on mbechler/marshalsec. What it does When loaded via SnakeYAML's unsafe Yaml.load, this payload takes over the running application and replaces it with a "You've Been...

CVE-2026-33017

CVE-2025-62593 — Ray Unauthenticated RCE Exploit Overview CVE-2025-62593 is an unauthenticated remote code execution vulnerability in the Ray distributed AI compute engine. The root cause is the absence of authentication on critical HTTP endpoints /api/jobs, /api/jobagent/jobs. An attacker can...

hacktivity-vulns-exploits-lab

Vulnerabilities, Exploits, and Remote Access Payloads — lab writeup My walkthrough and analysis of the Hacktivity Cyber Security Labs sheet "Vulnerabilities, Exploits, and Remote Access Payloads" Ethical Hacking and Penetration Testing course, Leeds Beckett University. It covers how software...

Project-CVE-2026-75604

Next.js Windows Cache Traversal Security Research Defensive security research and authorized validation only. This repository concerns CVE-2026-75604 , a critical vulnerability that may permit unauthenticated remote code execution on certain Windows-hosted Next.js deployments. Credits Coded by:...

CVE-2026-63520

CVE-2026-63520 Sharepoint unsafe type RCE + CVE-2026-55040 chain Unauthenticated RCE on Microsoft SharePoint Server. No credentials needed. Stephen Fewer Rapid7 demonstrated CVE-2026-55040 at Pwn2Own Berlin 2026. Rapid7 then discovered CVE-2026-63520 during follow-up research, and VulnCheck...

Apache-HTTP-Server-2.4.49-2.4.50-Path-Traversal-Remote-Code-Execution

Apache HTTP-Server 2.4.49-2.4.50 Path Traversal & Remote Code Execution Description This is a PoC script for CVE-2021-41773 & CVE-2021-42013 Usage: python3 exploit.py | Example: Remote Code Execution python3 exploit.py 127.0.0.1 8080 rce 'id' Path Traversal python3 exploit.py 127.0.0.1 8080 file...

CVE-2023-4861-PoC

CVE-2023-4861 PoC This repository contains a Python proof of concept for CVE-2023-4861 , an authenticated remote code execution issue in the WordPress plugin File Manager Pro - Filester. Vulnerability Summary CVE: CVE-2023-4861 Product: File Manager Pro - Filester filester Vulnerable versions:...

DNSRPC-BOF

DNSRPC-BOF Beacon Object File BOF implementation of the dnscmd.exe functionality used to obtain remote code execution on an ADIDNS server by exploiting the ServerLevelPluginDll edge1 2 3 by using MS-DNSP. 4 Exploitation requires access to a user account that is a member of the DnsAdmins group...

By-Poloss..-..CVE-2026-18080

CVE-2026-18080 — ERP Complete HR, Accounting & CRM Suite putcontents $dir . $name, $item'data' ; The filename ../../plugins/shell.php concatenated with $dir wp-content/uploads/crm-attachments/ resolves to wp-content/plugins/shell.php — a directory...

CVE-2024-29973

CVE-2024-29973 GET /cmd,/simZysh/registermain/setCookie?c0=storageextcgi+CGIGetExtStoInfo+None+and+False+or+import"subprocess".checkoutput"id",+shell=True%23 HTTP/1.1 Host: xxxx User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0 Gecko/20100101 Firefox/115.0 Accept: / Accept-Language: en-US,en;q=0...

halo-2.25.4-backup-write-CVE-2026-67920

Halo CMS Backup Restore Arbitrary File Write Vulnerability Summary A critical arbitrary file write vulnerability exists in the backup restoration functionality of Halo CMS versions up to 2.25.4. The restoreWorkdir method in MigrationServiceImpl.java copies the workdir/ directory from a...

CVE-2026-73570

CVE-2026-73570 — Zimbra ZCS SNMP Notification RCE exploit PoC Unauthenticated Remote Code Execution via OS Command Injection in the Zimbra Collaboration Suite SNMP notification handler. Overview Field| Value ---|--- CVE| CVE-2026-73570 CVSS 3.1| 8.9 HIGH — AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L CWE|...

WhatsRCE

WhatsRCE This is a Automated Generate Payload for CVE-2019-11932 WhatsApp Remote Code Execution 1. Auto install GCC no harm command, you can see this is open-source 2. Saving to .GIF file How To Use ? sudo apt install git git clone https://github.com/KeepWannabe/WhatsRCE cd WhatsRCE && bash...

CVE-2026-39902

Vulnerability Report: Authenticated RCE Data Input Researcher: K | Product: Cacti ≤ 1.2.30 01 Vulnerability Summary Field| Value ---|--- Product| Cacti — Complete RRDtool-based Graphing Solution Affected Versions| ≤ 1.2.30 Vulnerability Type| OS Command Injection CWE-78 Attack Vector| Network...

electroniz3r

electroniz3r Take over macOS Electron apps' TCC permissions with electroniz3r. The tool has been presented for the first time on DEFCON31 in Las Vegas during my ELECTRONizing macOS privacy - a new weapon in your red teaming armory talk. Overview $ electroniz3r OVERVIEW: macOS Red Teaming tool tha...

CVE-2018-11776

Vulnerable docker container for CVE-2018-11776 docker pull bhdresh/cve-2018-11776:1.0 docker run -dit -p :8080:8080 bhdresh/cve-2018-11776:1.0 PoC PoC - 1 Request : http://:8080/struts2-showcase-2.3.14/$333+333/help.action Result : http://:8080/struts2-showcase-2.3.14/666/help.action PoC - 2...

CVE-2026-2005_lab

CVE-2026-2005 — PostgreSQL pgcrypto Heap Overflow Lab A self-contained Docker lab for practicing exploitation of CVE-2026-2005, a heap buffer overflow in PostgreSQL's pgcrypto extension that enables remote code execution without superuser privileges. Affected versions: PostgreSQL ≤ 17.7 / 16.11 /...

CVE-2026-0300

PAN-OS CVE-2026-0300 Non-Destructive Exposure Survey Tool Overview This tool is a non-destructive exposure survey utility for assessing whether a target PAN-OS service may expose network-accessible surfaces related to CVE-2026-0300. The tool is intended for authorized defensive security validatio...

PAN-OS-User-ID-Buffer-Overflow-PoC

🛡️ CVE-2026-0300: PAN-OS User-ID™ Portal RCE Analysis Research Proof-of-Concept: CWE-787 Out-of-bounds Write 📌 Overview CVE-2026-0300 is a high-severity buffer overflow vulnerability identified in the Palo Alto Networks PAN-OS User-ID™ Authentication Portal Captive Portal. This research repository...

CVE-2026-42231

GHSA-q5f4-99jv-pgg5 — n8n XML Webhook Prototype Pollution → RCE CVE: CVE-2026-42231 Severity: Critical CVSS 10.0 Affected: n8n element. xml2js 0.6.2 uses Object.defineProperty with a data descriptor to set element keys on parsed objects. Because 'proto' in obj is always true, assignOrPush wraps t...