CVE-2020-5844

CVE-2020-5844 تنفيذ أوامر عن بعد بصلاحية مصادقة RCE في PandoraFMS 7.0-NG 742 يمكن للمهاجمين الذين لديهم صلاحية المسؤول رفع مستندات PHP ضارة. عن طريق فك ترميز موقع الملف base64 يمكن للمستخدمين الحصول على شل Shell كمستخدم apache. اكتشفه TheCyberGeek سكريبت بايثون للإثبات العملي PoC Usage: python3...

CVE-2026-10818

CVE-2026-10818 WPForms Pro = 1.10.1.1 - كتابة ملفات عشوائية دون مصادقة عبر ترتيب Init/Finalize في الرفع المجزأ CVE-2026-10818 WPForms Pro ≤ 1.10.1.1 — كتابة ملفات عشوائية دون مصادقة عبر الرفع المجزأ استغلال إثبات المفهوم Proof-of-Concept ترتيب Init/Finalize في الرفع المجزأ → كشف مسار قابل للتوقع ...

rxerium-templates

A curated collection of 144+ Nuclei templates focusing on zero-day and actively exploited vulnerabilities in the wild with a few miscellaneous templates. Templates use passive detection techniques version/date matching and are organized by year for easy navigation. ⚠️ Note: Date matching may be...

spybrowse

BrowseSpy تأكد من تغيير متغيرات ftp في جميع أنحاء الكود، تحتوي هذه المتغيرات على اسم المستخدم وكلمة المرور وعنوان IP لخادم FTP الذي يستقبل الملفات. سيقوم هذا الكود بما يلي: 1. نسخ نفسه إلى دليل %TMP% وتسمية نفسه ursakta.exe 2. إضافة إدخال تسجيل Registry entry لتنفيذ نفسه في كل مرة يقوم فيها...

CVE-2024-7399-POC

CVE-2024-7399 Exploit for CVE-2024-7399. More details can be found here: https://davidxbors.github.io/0xpages/posts/cve-2024-7399/. Usage: python3 CVE-2024-7399.py https://localhost:7002/ --check python3 CVE-2024-7399.py https://localhost:7002/ --execute python3 CVE-2024-7399.py...

PocList

PocList A collection of self-written vulnerability POCs and EXPs. After specifying the URL file, the POC script can perform multi-threaded batch scanning of targets for verification; the EXP script can exploit vulnerabilities, such as file reading, uploading webshells, command execution, etc...

CVE-2017-5638-PoC

CVE-2017-5638 Apache Struts 2 RCE Proof of Concept This repository contains a Proof of Concept PoC script demonstrating the Remote Code Execution RCE vulnerability identified as CVE-2017-5638 in Apache Struts 2. Vulnerability Details CVE ID: CVE-2017-5638 Affected Software: Apache Struts 2 versio...

CVE-2024-49653

📜 WordPress Portfolleo Plugin Exploit CVE-2024-49653 🚨 Vulnerability Details Title: WordPress Portfolleo plugin = 1.2 - Arbitrary File Upload vulnerability Description: Unrestricted Upload of File with Dangerous Type vulnerability in James Eggers Portfolleo portfolleo allows uploading a web shell...

CVE-2018-19422-SubrionCMS-RCE

CVE-2018-19422-SubrionCMS-RCE SubrionCMS 4.2.1 Authenticated Remote Code Execution /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these. Exploit Usage Commands: Windows/Linux: $ sudo python3...

CVE-2015-6967

CVE-2015-6967 Nibbleblog 4.0.3 - Arbitrary File Upload CVE-2015-6967 requirements python 3 requests usage usage: exploit.py -h --url URL --username USERNAME --password PASSWORD --payload PAYLOAD optional arguments: -h, --help show this help message and exit --url URL, -l URL --username USERNAME, ...

CVE-2021-22005

CVE-2021-22005 VMware vCenter Server Arbitrary File Upload Vulnerability Code By: Junsheng @Orange Network Security Lab Orange Network Security Lab https://0range.team/ 0x00 Risk Overview This tool is only for authorized security testing. Unauthorized illegal attacks on sites are prohibited. Read...

CVE-2019-2618

PoC POST /beawlsdeploymentinternal/DeploymentService HTTP/1.1 Host: 127.0.0.1:7001 User-Agent: Mozilla/5.0 X11; Ubuntu; Linux i686; rv:20.0 Gecko/20100101 Firefox/20.0 Accept: text/html, image/gif, image/jpeg, /; q=.2 Connection: keep-alive username: weblogic password: weblogic wlrequesttype:...

Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-50564

CVE-2023-50564 - Pluck CMS v4.7.18 Remote Code Execution RCE Exploit Description This script exploits a Remote Code Execution RCE vulnerability in Pluck CMS v4.7.18. The vulnerability allows a malicious user to upload a malicious PHP file to the server and execute it, gaining remote command...

cve-2025-0364

CVE-2025-0364: BigAntSoft BigAnt Server Account Registration Bypass to File Upload RCE The BigAntSoft BigAnt Server, which provides a Windows hosted on-premises chat server that focuses on business use cases, is vulnerable to unauthenticated remote code execution via account registration and PHP...

CVE-2025-25257-Exploit-Tool

CVE-2025-25257 Exploit Tool Credits Based on watchTowr Labs, 0xbigshaq, and pwner.gg analyses. Warnings For educational purposes only. Use on authorized systems. Modifies database/filesystem. Enhanced Python tool for detecting and exploiting CVE-2025-25257 Pre-Auth SQLi to RCE in Fortinet FortiWe...

WeblogicScan

WeblogicScan Outil de détection de vulnérabilités Weblogic en un clic, V1.5 Auteur du logiciel : TideRabbitMask Avertissement : Pia!ｏ ‵-′ノ”ノ﹏。 Cet outil est uniquement destiné aux tests de sécurité, veuillez ne pas l'utiliser à des fins illégales, soyez sage Fonctionnalités de la V 1.5 : Fournit...

cve-2026-32475-elementor-pro-lab

CVE-2026-32475 — Téléversement de fichier arbitraire non authentifié dans Elementor Pro Forms → RCE Laboratoire Docker A/B qui reproduit CVE-2026-32475 CVSS 9.x, Patchstack ; champ de téléversement de fichier des formulaires Elementor Pro, versions affectées ≤ 4.2.1, corrigé en 4.2.2 le 2026-08-1...

CVE-2026-75865

CVE-2026-75865 — WPLP Cookie Consent gdpr-cookie-consent ≤ 4.4.1 Preuve de concept et analyse technique pour CVE-2026-75865 , un téléversement de fichier arbitraire non authentifié conduisant à une exécution de code à distance dans le plugin WPLP Cookie Consent – Cookie Banner & Consent Managemen...

CVE-2021-22005

CVE-2021-22005-metasploit the metasploit scriptPOC/EXP about CVE-2021-22005 VMware vCenter Server contains an arbitrary file upload vulnerability preparation POC git clone https://github.com/TaroballzChen/CVE-2021-22005-metasploit cd CVE-2021-22005-metasploit mkdir -p...

CVE-2024-39943-Poc

CVE-2024-39943-Poc CVE-2024-39943 rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in...