CVE-2026-25961-SumatraPDF-3.5.0---3.5.2-RCE

SumatraPDF Insecure Update PoC CVE-2026-25961 – Remote Code Execution via Malicious Update Server Author: Mohammed Idrees Banyamer Date: February 2026 CVE: CVE-2026-25961 GHSA: GHSA-xpm2-rr5m-x96q CVSS v3.1: 7.5 High AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected versions: SumatraPDF 3.5.0 – 3.5.2...

CVE-2026-27574-OneUptime-RCE

CVE-2026-27574-OneUptime-RCE Overview Proof-of-Concept exploit for CVE-2026-27574 – a critical code injection vulnerability CWE-94 in OneUptime BOpen Registration B -- CRegister New Accou...

CVE-2026-27180-MajorDoMo-unauthenticated-RCE

MajorDoMo RCE CVE-2026-27180 Unauthenticated Remote Code Execution via Update URL Poisoning in MajorDoMo CWE-494 – Download of Code Without Integrity Check Impact : Full server compromise via webshell placed in web root Authentication Required : None Patch : PR 1177 📜 Description This repository...

CVE-2026-26335-Calero-VeraSMART-RCE

👤 Author Mohammed Idrees Banyamer Security Researcher GitHub: https://github.com/mbanyamer Instagram: https://instagram.com/banyamersecurity CVE-2026-26335 - Calero VeraSMART ViewState RCE Exploit 📌 Description CVE‑2026‑26335 is a critical unauthenticated remote code execution vulnerability in...

CVE-2026-3395-MaxSite-CMS-Unauthenticated-RCE

CVE‑2026‑3395 — MaxSite CMS Unauthenticated Remote Code Execution Overview Unauthenticated Remote Code Execution RCE vulnerability in MaxSite CMS ≤ 109.1. The flaw arises from weak authorization checks in the MarkItUp editor plugin’s AJAX endpoints, combined with unsafe execution of user‑supplied...

-CVE-2026-26215-manga-image-translator-RCE

CVE-2026-26215 - manga-image-translator Pickle Deserialization RCE 👤 Author Mohammed Idrees Banyamer Instagram: @banyamersecurity GitHub: @mbanyamer Proof-of-Concept exploit for CVE-2026-26215 - Unauthenticated Remote Code Execution via unsafe Pickle deserialization in manga-image-translator ≤...

CVE-2021-44228

CVE-2021-44228Apache Log4j Remote Code Execution） all log4j-core versions =2.0-beta9 and =2.14.1 The version of 1.x have other vulnerabilities, we recommend that you update the latest version. Security Advisories / Bulletins linked to Log4Shell CVE-2021-44228 Usage: download this project, compile...

CVE-2021-42013

CVE-2021-42013 Description This script exploits CVE-2021-42013 to print file or/and execute command. This script is available for: Nmap Python Ruby Requirements Python python3 python3 Standard Library Ruby Ruby Ruby Standard Library Install git clone...

CVE-2021-41773-exercise

CVE-2021-41773-exercise A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by...

CVE-2021-41773

CVE-2021-41773 Description This script exploits CVE-2021-41773 to print file or/and execute command. This script is available for: Nmap Python Ruby Requirements Python python3 python3 Standard Library Ruby Ruby Ruby Standard Library Install git clone...

CVE-2021-45897

CVE-2021-45897 PoC for CVE-2021-45897 aka SCRMBT-180 - RCE via Email-Templates Authenticated only in SuiteCRM = 8.0.0. Defaults to False --help Show this message and exit. https://github.com/manuelz120/CVE-2021-45897 Example usage: .venv ➜ CVE-2021-45897 git:main ✗ ./exploit.py -u user -p --paylo...

PoC-CVE-2026-1357

PoC CVE-2026-1357: WPvivid Backup & Migration The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. This is due to improper error handling in the RSA decryption process...

exploit-CVE-2026-23744

exploit-CVE-2026-23744 MCPJam Inspector is a local-first development platform for MCP servers. In versions 1.4.2 and earlier, a RCE flaw lets attackers send crafted HTTP request that installs an MCP server and runs code remotely, because the service listens on 0.0.0.0 instead of 127.0.0.1 by...

redis-CVE-2025-49844

CVE-2025-49844 RediShell - Lab Environment A practical lab environment for testing and understanding the critical CVE-2025-49844 RediShell vulnerability in Redis. ⚠️ WARNING This is for educational purposes only! Only use on systems you own or have explicit permission to test Never expose to the...

CVE-2025-55616

CVE-2025-55616 Author: Rana M.Sinan Adil Vulnerability Found in Zsh leading RCE through History Expression Key Points To Run this exploit: just change the ip address and the "p system" in exploit , because i also tried this in my second laptop, and to change it run this following command in gdb...

telnet-CVE-2026-24061

https://github.com/SafeBreach-Labs/CVE-2026-24061/blob/main/telnetrce.py you need to understand the code 2. Building working code without input, directly variable = '' The code must be compatible with every device, so you cannot use commands like os.system'command' 3. Adding a GUI via...

CVE-2026-25548

CVE-2026-25548 — Remote Code Execution in InvoicePlane 1.7.0 Vulnerability: Remote Code Execution via Local File Inclusion + Log Poisoning Product: InvoicePlane Affected Version: 1.7.0 and likely prior versions Severity: Critical CVSS 3.1 Score: 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CW...

CVE-2026-39987

CVE-2026-39987 — Marimo Python Notebook Pre-Authenticated Remote Code Execution TL;DR A pre-authenticated remote code execution vulnerability in Marimo , an open-source Python notebook for data science and AI/ML. The terminal WebSocket endpoint /terminal/ws completely skips authentication...

CVE-2026-39842

CVE-2026-39842: OpenRemote Expression Injection RCE in Rules Engine TL;DR Critical remote code execution vulnerability in OpenRemote's Rules Engine allows authenticated users with write:rules role to execute arbitrary code on the server with root privileges. CVSS Score : 10.0 Critical CVSS Vector...

CVE-2026-34197

CVE-2026-34197 — Apache ActiveMQ Classic RCE via Jolokia API TL;DR A remote code execution vulnerability in Apache ActiveMQ Classic that allows an attacker to execute arbitrary code by invoking the addNetworkConnectorString MBean operation through the Jolokia API /api/jolokia/. The attacker embed...