CVE-2026-102422

shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...

CVE-2026-39987-PoC

CVE-2026-39987 PoC Summary Marimo = 0.20.4 is affected by a pre-authentication RCE vulnerability in the /terminal/ws WebSocket endpoint. The endpoint checks the application mode and terminal support, but does not validate authentication before accepting the WebSocket connection. It then creates a...

CVE-2025-52691-APT-PoC

CVE-2025-52691 PoC: Carga Arbitraria de Archivos en SmarterMail RCE Mejorado con APT Este es un exploit de prueba de concepto PoC mejorado para CVE-2025-52691 , una vulnerabilidad crítica en el software de servidor de correo SmarterTools SmarterMail que permite la carga arbitraria de archivos sin...

CVE-2025-7847-POC

CVE-2025-7847 Plugin de WordPress – Carga Arbitraria de Archivos por Suscriptor Autenticado – POC Plugin de WordPress AI Engine 2.9.3 - 2.9.4 Prueba de Concepto Tenga en cuenta que esta vulnerabilidad solo puede explotarse si la opción “Public API” está habilitada, que está deshabilitada por...

CVE-2026-0073

🤖 CVE-2026-0073 - Wireless ADB Authentication Bypass 📌 Overview CVE-2026-0073 is a critical authentication bypass vulnerability in Android’s Wireless ADB adbd daemon. An attacker on the same network can bypass the mutual TLS authentication and connect to the device without user approval or previo...

CVE-2026-64638

CVE-2026-64638 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments...

CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token

shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...

CVE-2026-102422

The shell-quote library is vulnerable to command injection due to how the quote() function handles { comment } tokens. When a comment token is emitted as #, it comments out the rest of the shell line, potentially neutralizing the opening quote of subsequent string tokens. If a later string contai...

CVE-2026-102422

shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...

Demonstration-of-CVE-2023-38831-via-Reverse-Shell-Execution

CVE-2023-38831 Demostración de Reverse Shell Este repositorio contiene un resumen en PDF y capturas de pantalla de una demostración en laboratorio de CVE-2023-38831. La vulnerabilidad permite a los atacantes incrustar y ejecutar cargas maliciosas en archivos comprimidos. En este caso, la carga út...

Heartexploit

Heartexploit Aquí está mi nuevo y primer exploit, este exploit ataca a la vulnerabilidad de HeartBleed CVE-2014-0160, espero que os guste. Este exploit solo funciona en linux ya que parte esta echa en idiomas no compatibles con windows. El único comando que hay que poner para iniciar esta...

POC-CVE-2026-19679

CVE-2026-19679 — insufficient sanitization of uploaded filenames input validation Status: CONFIRMED on a 6.7.2-14.el9 lab 2026-08-20. POST /rest/auditFile with tailoringOriginalFilename = "poc;touch$IFSpoc19679;me.xml" returned HTTP 200 and registered AuditFile 1000002 — the shell-metachar filena...

globalprotect-ca-cert-ipc

c2us.exe - Launches a command as the running user in the desktop session of the logged on user. In thise case, launches cmd.exe as SYSTEM in the desktop session of the unprivileged user. c2us.c - Source code for c2us.exe. epinject.exe - Entry point injector, used to spawn a new process and inject...

CVE-2018-11510

A couple exploits for CVE-2018-11510 by Kyle Lovett @SquirrelBuddha and myself Matthew Fulton/@haqur. Leverages an unauthneticated command injection to get a root shell back. The metasploit module has a separate payload included in the repo. Will see if I can get them included via a pull request...

bassmaster-rce

bassmaster-rce Exploiting CVE-2014-7205 by injecting arbitrary JavaScript resulting in Remote Code Execution. I stumbled across this Post by LuuPhu written in viatnamese. Since I have written some code in NodeJS but never came across exploiting it, I figured why not today? The Python PoC includes...

larac2shell

LaraC2 Shell – Intérprete interactivo de Live Response de MDE Intérprete interactivo multiplataforma para Live Response de Microsoft Defender para punto de conexión. Característica| Detalle ---|--- Plataforma| PowerShell Core 7.0+ Windows, Linux, macOS Modos de API| Interno portal, casi en tiempo...

CVE-2025-55319-PoC

Reference: CVE-2025-55319 Proof-of-concept VS Code .vsix extension for the HTB "Checkpoint" challenge. Once installed, the extension auto-activates and spawns a hidden PowerShell reverse shell back to the attacker. ⚠️ Authorized use only. This is a CTF/lab artifact. Only deploy it against machines...

ForgottenButNotGone

Forgotten but Not Gone This repository contains proof-of-concept scripts for the vulnerabilities presented at the talk "Forgotten but Not Gone: Unauthenticated RCEs and LPEs in Legacy Linux Services" from Black Hat USA 2026 and DEF CON 34. CVE-2026-28372 Local privilege escalation in TelnetD:...

CVE-2025-46811

SUSE Manager Exploit Toolkit CVE-CVE-2025-46811 Scanner & Exploiter 🚀 Features Multi-threaded vulnerability scanning Interactive root shell via WebSocket Single command execution mode Colored debug output Batch processing of targets 📦 Installation git clone...

CVE-2018-3191-Rce-Exploit

CVE-2018-3191-Rce-Exploit Autor: Break Paso 1: java -jar GenPayload.java output SJpayload.bin, la dirección es la dirección del servidor RMI Paso 2:java -jar RMISERVER.jar httpaddress, el servidor RMI escucha en el puerto 1099 y carga las clases Reverse remotas en el servidor web Paso 3:coloca do...