CVE-2023-1389

Description CVE-2023–1389 is an Unauthenticated Command Injection vulnerability in the TP-Link Archer AX21 WiFi router. A calllback in the country parameter uses the popen function, which is run as root, allowing the attacker to inject arbitrary values through GET or POST requests to the admin...

CVE-2025-50505

CVE-2025-50505 Unauthorized API Leads to Arbitrary Command Execution and Privilege Escalation in Clash Verge Rev Description The vulnerability stems from an unauthenticated API endpoint exposed by the clash-verge-service component, which is installed with elevated privileges by default. This flaw...

CVE-2022-22954_VMware_PoC

CVE-2022-22954 PoC - VMware Workspace ONE Access Freemarker Server-Side Template Injection A vulnerability, which was classified as very critical, was found in Vmware Workspace ONE Access and Identity Manager. Affected component is Template Handler. Reference: https://vuldb.com/?id.196644 Usage:...

octohook

octohook Git Web Hook Tunnel for C2 Install apt-get update && apt-get upgrade -y apt-get install python3-pip git -y pip install --upgrade pip pip install virtualenv virtualenv -p python venv . venv/bin/activate git clone https://github.com/dsnezhkov/octohook pip install prompttoolkit PyGithub...

CVE-2020-0688

python3 CVE-2020-0688.py mail.chinabaiker.com [email protected] password command...

CVE-2020-14947

CVE-2020-14947 The official exploit for OCS Inventory NG v2.7 Remote Command Execution CVE-2020-14947...

CVE-2022-35914-poc

CVE-2022-35914 PoC References https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr Usage pip install -r requirements.txt ./CVE-2022-35914.py -h usage: CVE-2022-35914.py -h -u URL -c CMD -f HOOK --check --user-agent USERAGENT CVE-2022-35914 - GLPI - Command injection using ...

CVE-2023-51385_test

Verify CVE-2023-51385 First, add the following content to /.ssh/config host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Command injection exists in the .gitmodules file statement url = ssh://echo helloworld cve.txtfoo.example.com/bar After configuration, execute the...

overkill

Overkill Overkill is an exploit for a patched vulnerability affecting QNAP QTS. Due to the way QNAP discloses vulnerabilities, I'm unsure if this issue has a CVE or not. However, it was likely patched in November 2020 and April 2021. The n-day was "discovered" while doing diff analysis for...

Struts2-048

Struts2-048 CVE-2017-9791 Author: DragonEgg def Usage: print 'check:' print ' python file.py http://1.1.1.1/struts2-showcase/integration/saveGangster.action' print 'poc:' print ' python file.py http://1.1.1.1/struts2-showcase/integration/saveGangster.action command' Demo...

CVE-2023-38646-PoC

CVE-2023-38646 - Metabase Pre-auth RCE Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1,...

CVE-2024-3273

CVE-2024-3273 Proof of Concept PoC This repository contains a Proof of Concept PoC for CVE-2024-3273, a security vulnerability discovered in D-Link NAS devices. The vulnerability allows attackers to execute arbitrary commands on vulnerable devices. Description CVE-2024-3273 is a vulnerability in...

Nuclei-Template-CVE-2022-1388-BIG-IP-iControl-REST-Exposed

Nuclei Template CVE-2022-1388 BIG-IP iControl REST Exposed May 06, 2022 This only verifies the presence of the API by hitting the authentication endpoint This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP...

FollinaXploit

Follina Exploiter CLI Tool MSDT Vulnerability CVE-2022-30190 A Command Line based python tool for exploit Zero-Day vulnerability in MSDT Microsoft Support Diagnostic Tool also know as 'Follina' CVE-2022-30190. Info : New Microsoft Office zero-day used in attacks to execute PowerShell Made In...

CVE-2021-46704

OS Command Injection in GenieACS CVE-2021-46704 CVE-2021-46704 Nuclei template Reference : https://github.com/advisories/GHSA-2877-693q-pj33 https://nvd.nist.gov/vuln/detail/CVE-2021-46704 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-46704...

CnC-Botnet-in-Python

CnC-Botnet-in-Python C&C Botnet written in Python Description Simple botnet written in Python using fabric. The author is not responsible for the use of this code. Hosts It is possible to load hosts from a file hosts.txt included in the main directory of the project. The default format for this...

CVE-2022-46169

Cacti remoteagent.php Remote Command Execution Vulnerability CVE-2022-46169 Vulnerability Description Cacti is a server monitoring and management platform. A command injection vulnerability exists in versions 1.2.17 to 1.2.22. An attacker can bypass server-side validation via the X-Forwarded-For...

CVE-2020-14882

CVE-2020-14882 This script enables remote code execution RCE on Oracle WebLogic Server using an unauthenticated GET request. It exploits the vulnerability CVE-2020-14882. By executing arbitrary commands, an attacker can gain unauthorized access to the server. Exploit Details Exploit Title: Oracle...

CVE-2026-54420

CVE-2026-54420 LiteSpeed cPanel ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone cd Project use python follow below Create a virtual...

CVE-2026-105407

An OS Command Injection vulnerability (CWE-78) affects Tuleap Enterprise Edition versions 17.0 through 17.5 . This flaw could allow an attacker to execute arbitrary commands on the server. The vulnerability has a High base severity score of 8.8. Exploitation details and specific remediation steps...