poc_CVE-2018-1002105

CVE-2018-1002105 PoC PoC autenticado Demostración Uso PoC no autenticado Demostración Uso PoC autenticado Exploit de prueba de concepto para CVE-2018-1002105. El exploit actual requiere privilegios create y get en pods y pods/exec. Se ha añadido soporte para portforward y attach, que requieren...

ipyida

= IPyIDA IPyIDA is a python-only solution to add an IPython console to IDA Pro. Use to open a window with an embedded Qt console. You can then benefit from IPython's autocompletion, online help, monospaced font input field, graphs, and so on. You can also connect to the kernel outside of IDA usin...

Jatayu

JATAYU Stealthy Stand Alone PHP Web Shell FEATURES Http Header Based Authentication. 100% Undetectable. Exec Function Changer. Nothing Fancy USAGE...

whoc

whoc A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform! WhoC at Defcon 29 Cloud Village Azurescape - whoc-powered research, the first cross-account container takeover i...

nmap

nmap This library aims at providing idiomatic nmap bindings for go developers, in order to make it easier to write security audit tools using golang. What is nmap Nmap Network Mapper is a free and open-source network scanner created by Gordon Lyon. Nmap is used to discover hosts and services on a...

PHP_imap_open_exploit

PHPimapopenexploit Bypassing disabled exec functions in PHP via imapopen Debian & Ubuntu Original report by CRLF: https://bugs.php.net/bug.php?id=76428...

CVE-2026-62201-OpenClaw-SSRF

CVE-2026-62201 — OpenClaw Sandbox Exec-Server Network Policy Bypass SSRF Severity: High · CVSS: 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · CWE-918 Server-Side Request Forgery Vulnerability at a Glance...

PoC-CVE-2026-33017

CVE-2026-33017: Unauthenticated RCE in Langflow = 1.8.2 Description A critical code injection vulnerability exists in Langflow that allows an unauthenticated remote attacker to execute arbitrary Python code on the server. The vulnerability resides in the POST /api/v1/buildpublictmp/flowid/flow...

CVE-2026-33017-Langflow-RCE-PoC

CVE-2026-33017-Langflow-RCE-PoC The vulnerability in Langflow 1.8.1 and earlier allows a remote, unauthenticated attacker to achieve arbitrary command execution on the host. Description The POST /api/v1/buildpublictmp/flowid/flow endpoint permits anyone to build public flows without authenticatio...

CVE-2026-0770-PoC

CVE-2026-0770 - Langflow Remote Code Execution Summary Langflow contains a critical remote code execution vulnerability in the validatecode function located in src/lfx/src/lfx/custom/validate.py. The function uses exec to execute user-supplied Python code without sandboxing, allowing arbitrary...

CVE-2026-33017

CVE-2026-33017 — Langflow Unauthenticated RCE HoGent CyberSecurity II — Network Pentesting & Exploitation NPE Academic year 2025–2026 Overview This repository contains a complete lab environment and exploitation demonstration of CVE-2026-33017 , a critical unauthenticated Remote Code Execution RC...

CVE-2025-3248

CVE-2025-3248 Langflow is a low-code platform primarily used for building and deploying AI agents and workflows. It simplifies the development process by providing a visual interface for creating complex AI applications, including chatbots, RAG Retrieval-Augmented Generation systems, and more...

CVE-2026-97359

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

cve-2026-33067

CVE-2026-33017 — Langflow Unauthenticated RCE Nuclei Template Nuclei template that detects CVE-2026-33017 — an unauthenticated remote-code-execution vulnerability in Langflow ≤ 1.8.2 reachable through the public flow-build endpoint: root@kitploit: POST /api/v1/buildpublictmp/flowid/flow The...

CVE-2025-3248-POC

Langflow RCE Exploit - CVE-2025-3248 ⚠️ Disclaimer This code is strictly intended for educational and research purposes only. Unauthorized use on systems without explicit permission may constitute a violation of the law. The author is not responsible for any misuse or malicious activity involving...

procrustes

Procrustes 一个 Bash 脚本，用于在拥有盲命令执行权限且除 DNS 外所有出站连接均被阻止的服务器上，通过 DNS 自动实现数据窃取。该脚本目前支持 sh、bash 和 powershell，并兼容 exec 类型的命令执行（例如 java.lang.Runtime.exec）。 非分段模式： 分段模式： 在运行过程中，脚本将用户希望在目标服务器上执行的命令作为输入，并根据目标 shell 类型对其进行转换，使其输出能够通过 DNS...

CVE-2025-27636-Apache-Camel-PoC

Apache Camel CVE-2025–27636 & CVE-2025-29891 PoC CVE-2025–27636 and CVE-2025-29891 are vulnerabilities in Apache Camel that affect versions: 4.10.0-4.10.1, 4.8.0-4.8.4, 3.10.0-3.22.3. Exploitation of these vulnerabilities can enable attackers to execute internal Camel methods. The following is a...

kubebox

= Kubebox small^⎈❏^ Antonin Stefanutti https://github.com/astefanutti@astefanutti // Meta :description: Terminal and Web console for Kubernetes // Settings :idprefix: :idseparator: - :experimental: // Aliases ifdef::env-github :note-caption: ℹ️ :icon-check: ✔️ :icon-edit: ✏️ endif::...

kubebox

= Kubebox small^⎈❏^ Antonin Stefanutti https://github.com/astefanutti@astefanutti // Meta :description: Terminal y consola web para Kubernetes // Settings :idprefix: :idseparator: - :experimental: // Aliases ifdef::env-github :note-caption: ℹ️ :icon-check: ✔️ :icon-edit: ✏️ endif::...

langflow-CVE-2026-33017-poc

CVE-2026-33017 — Langflow Unauthenticated RCE PoC For educational and authorized testing purposes only. Summary Langflow = 1.8.1 exposes a public flow build endpoint that accepts attacker-controlled flow data containing arbitrary code. This code is passed to prepareglobalscope in validate.py, whi...