Foxit-Reader-RCE-with-virualalloc-and-shellcode-for-CVE-2018-9948-and-CVE-2018-9958

Custom Exploit : Foxit Reader version 9.0.1.1049 Use After Free with ASLR and DEP bypass on heap My Custom Exploit : Foxit-Reader-RCE-with-virualalloc-and-shellcode-for-CVE-2018-9948-and-CVE-2018-9958 Custom exploit for Win 7 Has space for shellcode My custom ROP chain makes space for shellcode i...

spring-shell-vuln

spring-shell-vuln Spring4Shell: Spring core RCE vulnerability Spring has Confirmed the RCE in Spring Framework. The team has just published the statement along with the mitigation guides for the issue. Now, this vulnerability can be tracked as CVE-2022-22965. Some information about the Spring4She...

CVE-2026-64638-WordPress-Core-XSS2Shell

CVE-2026-64638 — Nuclei Detection Template Template Nuclei for non-intrusive detection of XSS2Shell , a pre-authenticated differential parser in WordPress Core that allows injection of DOM elements into the login page, serving as the basis for an XSS → RCE chain. ⚠️ This template only detects the...

Telerik_CVE-2019-18935

TelerikUI Python Scanner telerikrcescan.py Examples Assess an IP for CVE-2019-18935 $ python3 telerikrcescan.py -t 192.168.44.21 Assess a hostname for CVE-2019-18935 $ python3 telerikrcescan.py -t vulnerable.telerik.net Assess a CIDR network range for CVE-2019-18935 $ python3 telerikrcescan.py -r...

STIG-Edge-RCE-CVE2025-9478

STIG – Microsoft Edge Chromium 139.0.3405.125 Remote Code Execution CVE-2025-9478, Plugin ID: 258091 Before Finding: Microsoft Edge version 139.0.3405.86 was outdated and vulnerable to a critical Remote Code Execution RCE flaw CVE-2025-9478. Risk: Attackers could exploit a use-after-free in ANGLE...

CVE-2022-24637

CVE-2022-24637 Exploit for the Unauthenticated RCE in Open Web Analytics OWA 1.7.3. This work is based on https://devel0pment.de/?p=2494. DISCLAIMER: This script is made to audit the security of systems. Only use this script on your own systems or on systems you have written permission to exploit...

CVE-2022-24112

Apache APISIX 2.12.x Remote Code Execution RCE Exploit This Python script is a Proof-of-Concept PoC for a remote code execution RCE vulnerability in Apache APISIX versions 2.12.0 and 2.12.1. The vulnerability lies in the misuse of the filterfunc Lua field within the admin API, allowing an attacke...

CVE-2026-4813

CVE-2026-4813 CVSS-B 9.4 CRITICAL Authenticated RCE via XSLT injection in Lutece Core Explanations and more on my website /xsl:styleshee...

CVE-2024-3094

Security Review & Threat Model: CVE-2024-3094 xz-utils / OpenSSH This repository contains the results of analyzing the critical vulnerability CVE-2024-3094 backdoor in the liblzma library of the xz-utils package, leading to RCE via the OpenSSH process. As part of the project, an isolated test...

CVE-2025-48384

CVE-2025-48384: Breaking git with a carriage return and cloning RCE Reproduction from https://dgl.cx/2025/07/git-clone-submodule-cve-2025-48384. All credits to David Leadbeater. This is a basic reproduction attempt of the vulnerability. To trigger, do git clone --recursive...

CVE-2025-31324_PoC_SAP

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...

CVE-2023-4220

CVE-2023-4220 RCE Chamilo 1.11.24 | https://starlabs.sg/advisories/23/23-4220/ | | Chamilo LMS /tmp/rce.php EOF curl -F 'bigUploadFile=@/tmp/rce.php' "$HOST/$URLUPLD" CMD=$echo $CMD|base64 -w0| python3 -c "import urllib.parse,sys; printurllib.parse.quoteplussys.stdin.read" curl...

CVE-2025-64155-hunter

CVE-2025-64155 Scanner A Python scanner for detecting the command injection vulnerability CVE-2025-64155 in Phoenix Monitor service. Description CVE-2025-64155 is a command injection vulnerability in Phoenix Monitor service that allows remote code execution through the clusterurl parameter in the...

cve-2025-66398

CVE-2025-66398 — Signal K Server RCE PoC 📜 Description CVE-2025-66398 is a Signal K Server issue where an unauthenticated attacker can poison the server’s restore state via /skServer/validateBackup, then hijack config via /skServer/restore to inject a backdoor admin account and optionally achieve...

CVE-2023-22527

CVE-2023-22527 - RCE Remote Code Execution Vulnerability In Confluence Data Center and Confluence Server PoC Detect nuclei -v -t /path/to/template.yam; -u http://ip:port/ Exploit python3 CVE-2023-22527.py -u ip:port -lh listen-host -lp listen-port...

CVE-2024-5932

PoC for CVE-2024-5932 Credit goes to: https://github.com/EQSTLab/CVE-2024-5932 https://www.rcesecurity.com/2024/08/wordpress-givewp-pop-to-rce-cve-2024-5932/ This PoC is provided for educational purposes only. I do not take any responsibility for the improper use of this code, especially in...

connectwise-automate-AiTM-rce

ConnectWise Automate Adversary-in-the-Middle Remote Code Execution Table of Contents Background Timeline Thoughts and Learnings Responsible Disclosure PoC Code Report Provided to ConnectWise Summary Vulnerable Configuration Impact Technical Details 1. HTTP Transport 2. Insufficient Protocol...

CVE-2025-13486

Mass Exploit CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepareform ⚠️ Vulnerability Details The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via th...

xmlrpc-common-deserialization

xmlrpc-common deserialization vulnerability This note is a technical note to detail the root cause and the associated exploit. You can find the initial disclosure here. The associated CVE is CVE-2019-17570. Description xmlrpc-common forms a shared code base between xmlrpc-client and xmlrpc-server...

CVE-2025-5781

FreePBX CVE-2025-57819 Exploit Description This script exploits a vulnerability in FreePBX versions prior to 16.0.26.0 CVE-2025-57819, allowing remote attackers to execute arbitrary PHP code via a SQL injection flaw in the AJAX API endpoint. The exploit creates both a webshell and an auto-trigger...