CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC

CVE-2018-16763 — Fuel CMS 1.4.1 Remote Code Execution PoC Unauthenticated RCE vulnerability in Fuel CMS 1.4.1. The filter parameter in the /fuel/pages/select/ endpoint is passed unsanitized to a eval call in the PHP backend, allowing arbitrary code execution via a crafted payload. Unlike blind...

CVE-2022-36432

CVE-2022-36432 Cross-site Scripting XSS in Preview functionality in Amasty Blog Pro for Magento 2 Description The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by...

eval-stdin

Util PHP eval-stdin.php CVE-2017-9841 vulnerability is RCE vulnerability in outdated eval-stdin.php. This exploit is just automation for mentioned vulnerability and is still in development. Scripted in Ruby 3.0.4 within 2 hours, tested on Kali linux, Arch Linux, Ubuntu minimal and Termux. How to...

sk-cve-2026-26030-lab

CVE-2026-26030 — Semantic Kernel filter eval RCE lab A self-contained lab reproducing CVE-2026-26030 : prompt-injectable remote code execution via the in-memory vector store search filter in Microsoft Semantic Kernel Python, Ethical lab only. Isolated in dedicated virtualenvs; payloads are harmle...

CVE-2026-48962

Summary An eval injection vulnerability in File::GlobMapper::getFiles allows any attacker who can control the output fileglob argument passed to IO::Compress::Gzip::gzip, IO::Compress::Zip::zip, or any sibling function to execute arbitrary Perl code in the context of the running process. No...

atlas-tj-actions-poc

CVE-2025-54416: tj-actions/branch-names Command Injection PoC This repository demonstrates CVE-2025-54416 , a critical command injection vulnerability in tj-actions/branch-names affecting over 5,000 public repositories. Vulnerability The tj-actions/branch-names GitHub Action versions...

CVE-2026-27384

CVE-2026-27384 CVE-2026-27384 — W3 Total Cache mfunc/eval RCE Scanner Plugin: W3 Total Cache Plugin Slug: w3-total-cache CVE ID: CVE-2026-27384 CVSS Score: 9.8 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Vulnerability Type: Unauthenticated Arbitrary Code Execution Code...

buyer-eval-skill

Buyer Eval An AI analyst for buying B2B software. Give it the vendors you're considering. Buyer Eval investigates what they claim, checks the evidence, finds the gaps and contradictions, and gives you the questions to ask before you buy. You get a Decision Brief you can forward to everyone else...

CVE-2025-54322-exploit

CVE-2025-54322: XSpeeder SXZOS Pre-Auth RCE Exploit A professional Proof-of-Concept PoC exploit for CVE-2025-54322 , a critical pre-authentication remote code execution vulnerability in XSpeeder SXZOS firmware. This vulnerability was discovered and disclosed by the autonomous AI agent from pwn.ai...

CVE-2017-9841-PHPUnit-Remote-Code-Execution-PoC

CVE-2017-9841 — PHPUnit Remote Code Execution RCE PoC ⚠️ DISCLAIMER: This tool is intended solely for educational purposes and authorized security testing. Unauthorized use against systems you do not own or have explicit permission to test is illegal. The author assumes no liability for any misuse...

CVE-2025-2945-pgadmin-rce

CVE-2025-2945 — pgAdmin 4 Query Tool Authenticated RCE Proof of concept for CVE-2025-2945, a critical remote code execution vulnerability in pgAdmin 4. Affected versions: 8.10 through 9.1 Fixed in: 9.2 released April 4, 2025 CVSS v3.1: 9.9 Critical Overview The pgAdmin 4 Query Tool exposes an...

safer-eval-cve-CVE-2019-10760

safer-eval-cve-CVE-2019-10760 The following proof-of-concept POC exploit addressing safer-eval version 1.3.1 and below is the first publicly known payload to attack this version range. Contributing Please consult CONTRIBUTING for guidelines on contributing to this project...

safe-expr-eval

safe-expr-eval Fast and lightweight expression evaluator for JavaScript and TypeScript. A modern expression parser with a familiar API, zero dependencies, and full TypeScript support. Features Fast expression parsing and evaluation Lightweight and dependency-free Full TypeScript support Simple an...

Eaton-UPS-Companion-Exploit

Overview The Eaton UPS Companion software checks for an update every single week over an insecure HTTP connection and evals the content of whatever is at the update URL. This allows an attacker to craft a JavaScript function which uses the low-level OS operations that already exist in the backend...

CVE-2025-54322

CVE-2025-54322 - XSpeeder SXZOS Pre-Auth RCE Scanner A multi-threaded vulnerability scanner for CVE-2025-54322, an unauthenticated remote code execution vulnerability in XSpeeder SXZOS firmware affecting 70,000+ hosts globally. 📋 Table of Contents About the Vulnerability Features Installation Usa...

CVE-2025-50881

CVE-2025-50881: Remote Code Execution in API Use it Flow via moniteur.php Identifier: CVE-2025-50881 Affected Product: API Use it Flow Version 8.2.0 Rev 15851, Version 9.2.0 Rev 18093 Editor: https://www.tenorsolutions.com formerly https://api-sas.fr/ Affected Components: flow/admin/moniteur.php...

Mailcow-CVE-2022-31138

Mailcow CVE-2022-31138 RCE and Domain Admin privilege escalation for Mailcow. POC for CVE-2022-31245 can be modified to work with this vulnerability. Reported and fixed: 2022-06 Code Injection, RCE Type: Code Injection CWE-94, RCE, Domain Takeover Affected versions: least 2019 - 2022-06a A flaw...

CVE-2023-43364-Exploit-CVE

CVE-2023-43364-Exploit-CVE This is a python script to exploit Searchor 2.4.0 - the eval function was implemented insecurely and can be exploited for RCE. This machine relies on busybox being installed, as I wrote this for the Busqueda machine on HackTheBox. Just replace the payload with another...

phpunit-brute

phpunit-brute Tool to try multiple paths for PHPunit RCE CVE-2017-9841 and it will log found paths to found.txt in the dir. It uses the following list of paths https://raw.githubusercontent.com/random-robbie/bruteforce-lists/master/phpunit.txt if you have a path that is not on there please submit...

mpDNS

mpDNS aka multi-purpose DNS Server Simple, configurable DNS Server with multiple useful features Python 3 names.db - holds all custom records see examples Simple wildcards like .example.com Catch unicode dns requests Custom actions aka macro: shellexec::dig google.com +short - Execute shell comma...