Magento-eCommerce-RCE-CVE-2015-1397

Magento Shoplift Exploit SUPEE-5344 - CVE-2015-1397 Overview This script exploits the CVE-2015-1397 vulnerability in Magento, commonly referred to as the Magento Shoplift exploit. It allows an attacker to create a new admin user in the Magento database by injecting SQL payloads. Originally writte...

CVE-2021-41773

CVE-2021-41773 Apache HTTP Server 2.4.49, 2.4.50 - Path Traversal & RCE...

CVE-2024-29272

CVE-2024-29272 This is a Proof-of-Concept for CVE-2024-29272, an unauthenticated arbritrary file upload vulnerability that leads to remote code execution on versions of VvvebJS -l -p in another terminal: nc -lvnp...

CVE-2023-33246

CVE-2023-33246 Apache RocketMQ Remote Code Execution CVE-2023-33246 Exploit Usage: java -jar CVE-2023-33246.jar -ip "127.0.0.1" -cmd "open -a calculator" Disclaimer: This detection tool is intended only for security testing by security testers of major security companies. Do not use it to invade ...

CVE-2022-29078

CVE-2022-29078 | EJS SSTI → RCE White Hat School 4th Class 32 - Sangbeom Woo @taka3636 Summary EJS tags, such as Hello . Internally, EJS compiles the template string into a JavaScript function and then executes it to generate the final HTML. In other words, it is a code generator that "converts...

CVE-2023-4220

Proof of concept exploit for CVE-2023-4220 Affected product : Chamilo = 1.11.24 This CVE abuses an unauthenticated file upload vulnerability in Chamilo 1.11.24 and lower. An attacker has the ability to upload PHP files with no restrictions, leading to RCE. How to use python3 exploit.py -u URL -c...

CVE-2025-26633

CVE-2025-26633 - MSC EvilTwin PoC Proof of Concept PoC for CVE-2025-26633 vulnerability exploiting Microsoft Management Console MMC About This PoC simulates the CVE-2025-26633 vulnerability, discovered by Trend Micro, which exploits the loading of malicious .msc files for remote command execution...

CVE-2025-58180

CVE-2025-58180 RCE in OctoPrint via Unsanitized Filename in File Upload In OctoPrint version =1.11.2, an attacker with file upload access e.g., valid API key or session can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote...

cve-2025-55182-poc

CVE-2025-55182 React2Shell - Academic Proof of Concept ⚠️ DISCLAIMER: EDUCATIONAL USE ONLY This repository contains functional exploit code for a critical vulnerability CVSS 10.0. It is intended strictly for academic research, security analysis, and educational purposes. Do not use this code...

CVE-2019-19609-POC-Python

The script will try to reset the password to the one declared in the "updatedpass" variable, if it succeeds - it will give a JWT token from Strapi and use it to execute commands. Executing bind commands won't work unless sending a reverse shell payload, with bash or python or whatever. You can...

Malicious code in tonemaptts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 19491cfac57ebbc5106857c286eb420bb2c84f246781670579fc4311cb7d1cad The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the...

Malicious code in pyrechoasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 abd16e8f67cf00b05cd9b944eaae2569a33cd419f50b3df499f203ea838fc447 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the...

Malicious code in driftwavets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e69baa6a16626f26b6f71e04ce89a53a693a06c6545446a9addbecfd6c95d92f The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the...

Malicious code in novalithtts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4d136563fb3f5bd0febb4dc01f0af8d3ce9638271f1416f814d126fb49239840 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the...

Malicious code in voltswannts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5fa306d5f7de491546822f6b026c35cc395d7d379258b7a8382b50468ce708b2 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the...

Malicious code in glassbeakasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 de05a7ca1743ea6c3ceba4abc7f5452783d567b39f20007aeb57071a6d4019ed The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the...

Malicious code in emberlytts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c53182f7339fc139b58f28bdd6588e55eb25c1c6d07089f6fc57b87f8339f547 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the...

CVE-2024-24401

Vulnerability Report CVE Disovered by: Jarod Jaslow MAWK DESIGNED TO BE RUN ON KALI LINUX Notes Nagios has patched version 2024R1.0.1 in all recent downloads. To determine if a target is vulnerable, ensure they are using an older download of 2024R1.0.1. The updated script checks to make sure that...

CVE-2023-41425

CVE-2023-41425 Description Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. Working The attached exploit "exploit.py" performs the following actions: 1. It takes 3...

Point-to-Point-Protocol-Daemon-RCE-Vulnerability-CVE-2020-8597-

Point-to-Point-Protocol-Daemon-RCE-Vulnerability-CVE-2020-8597- Sri Lanka Institute of Information Technology Assignment 1 M. P. D. M. Dias IT19165530 MLBWDY2S113.1 Point to Point Protocol Daemon RCE Vulnerability CVE-2020-8597 Systems and Network Programming– IE2012 Content 1. Introduction 2...