CVE-2019-11043-Docker

A docker image with a vulnerable version of PHP-FPM CVE-2019-11043 and nginx. Run docker run --rm -p8080:80 akamajoris/cve-2019-11043 You should be able to access the web application at http://your-ip:8080/. Exploitation Build a binary from https://github.com/neex/phuip-fpizdam, then...

watchTowr-vs-Splunk-CVE-2026-20253

CVE-2026-20253 Splunk Pre-Auth RCE Splunk Pre-Auth RCE 1day Detection Artifact Generator Tool Detection in Action Detection Artifact Generator attempts to access the /v1/postgres/recovery/backup endpoint of PostgreSQL Sidecar Service to verify if it is accessible or not: 400 response - probably...

CVE-2021-30632

CVE-2021-30632 Chrome V8 RCE Exploit for Windows Tested Version : Chrome 91, 92, 93.0.4577.63 Demo reference Chrome in-the-wild bug analysis: CVE-2021-30632 https://securitylab.github.com/research/inthewildchromecve202130632/ JS POC sample...

wp2shell-poc2

wp2shell-poc Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion CVE-2026-63030. The exploit needs no credentials and no configuration beyond a reachable target. It reaches the injection through a single...

CVE-2023-4596

CVE-2023-4596 PoC Script for CVE-2023-4596, unauthenticated Remote Command Execution through arbitrary file uploads. Video of PoC being used Nuclei Template News article WordFence NVD Nist Summary A critical vulnerability has been discovered in the WordPress plugin Forminator, which enables an...

CVE-2026-48907

🚨 CVE-2026-48907 - JCE Joomla Content Editor Unauthenticated Remote Code Execution ⚠️ Critical Unauthenticated RCE in JCE Joomla Content Editor A critical access control vulnerability allowing unauthenticated attackers to compromise vulnerable Joomla installations running JCE. 📖 Overview...

CVE-2022-24706-CouchDB-Exploit

Apache CouchDB 3.2.1 - Remote Code Execution RCE CVE-2022-24706 Date: 2022-01-21 Exploit Author: Konstantin Burov, @sadshade Software Link: https://couchdb.apache.org/ Version: 3.2.1 and below Tested on: Kali 2021.2 Based on 1F98D's Erlang Cookie - Remote Code Execution Shodan: port:4369 "name...

CVE-2020-11108-PoC

CVE-2020-11108-PoC Two PoCs are in this repo. cve-2020-11108-rce.py will give you a shell as the www-data user. root-cve-2020-11108-rce.py will give you a shell and escalate privileges to root. Note: This is destructive as we must overwrite teleporter.php. For a full explanation/writeup please se...

hermes-the-messenger

Hermes the messenger A PoC for achieving persistence via push notifications on Windows For more technical details and background read our blogpost here: https://www.persistent-security.net/post/beacon-on-demand-abusing-push-notifications-for-persistence Usage Before anything else you need to setu...

CVE-2024-4879

CVE-2024-4879 Exploit & PoC - Nuclei Template CVE-2024-4879 - Jelly Template Injection Vulnerability in ServiceNow ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticate...

CVE-2025-68613

CVE-2025-68613 n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution RCE vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by...

CVE-2025-81110-PoC

CVE-2025-81110-PoC Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. This repository contains a professional-grade exploit for a critical vulnerability in Gogs versions prior to 0.13.0. The exploit leverages a logical flaw where the Gogs API fails to...

CVE-2019-0708

CVE-2019-0708 CVE-2019-0708 python3 check 0708 A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is...

CVE-2021-34371.jar

CVE-2021-34371.jar CVE-2021-34371.jar from https://github.com/vulhub/vulhub/tree/master/neo4j/CVE-2021-34371/rhinogadget USE EXP...

cve-2021-21985_exp

cve-2021-21985 exploit 0x01 Vulnerability Point Analysis available at: https://attackerkb.com/topics/X85GKjaVER/cve-2021-21985?referrer=homerapid7-analysis 0x02 exploit Reconstruct the beans object to achieve RCE. Bean list: localizedMessageBundle vsanWorkerThreadFactory vsanThreadPoolImpl...

st2-048

St2-048 Remote Code Execution Vulnerability Apache Struts 2 possible RCE in the Struts Showcase app in the Struts 1 plugin example in the Struts 2.3.x series http://struts.apache.org/docs/s2-048.html https://cwiki.apache.org/confluence/display/WW/S2-048 Use-Age: python St2-048.py set url :...

CVE-2020-25042-PoC

CVE-2020-25042-PoC Proof-of-concept for CVE-2020-25042, an authenticated arbitrary file upload issue in Mara CMS 7.5 that can lead to remote code execution. The script logs in with a valid Mara CMS admin/manager account, uploads a PHP payload through codebase/handler.php, and executes commands...

CVE-2016-6366

CVE-2016-6366 Public repository for improvements to the EXTRABACON exploit, a remote code execution for Cisco ASA written by the Equation Group NSA and leaked by the Shadow Brokers. There is improved shellcode, a LINA offset finder script, a Metasploit module, and extrabacon-2.0. We are adding...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE Vulnerability I: Vulnerability Description ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. CVE-2021-40539 Zoho ManageEngine...

CVE-2026-47668

CVE-2026-47668 — DbGate Remote Code Execution Unauthenticated RCE in DbGate JSON Script Runner dbgate-serve ≤ 7.1.8. Assessment tool: CVE-2026-47668.py — authorized testing only. | ---|--- CVE| CVE-2026-47668 Severity| Critical Product| DbGate / dbgate-serve Affected| ≤ 7.1.8 Fixed| ≥ 7.1.9 CVSS...