CVE-2024-50427

CVE-2024-50427 SurveyJS: Drag & Drop WordPress Form Builder = 1.9.136 - Authenticated Subscriber+ Arbitrary File Upload Description: The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to arbitrary file...

RCE-CVE-2024-7954

RCE-CVE-2024-7954 Description The porteplume plugin, utilized by SPIP versions prior to 4.30-alpha2 , 4.2.13 , and 4.1.16 , is susceptible to a critical arbitrary code execution RCE vulnerability. This flaw allows a remote, unauthenticated attacker to execute arbitrary PHP code as the SPIP user b...

CVE-2026-63030-CVE-2026-60137

CVE-2026-63030 & CVE-2026-60137 — wp2shell WordPress Core Pre-Auth RCE — Route Confusion + SQL Injection chained to Remote Code Execution | ---|--- CVE| CVE-2026-63030 + CVE-2026-60137 Alias| wp2shell Vulnerability Type| REST API Route Confusion → SQL Injection → RCE Severity| Critical — CVSS 10....

n8n-cve-2026-21858

n8n-cve-2026-21858 CVE-2026-21858 + CVE-2025-68613 — n8n unauthenticated file read to RCE exploit...

exploit-CVE-2025-55182-poc

CVE-2025-55182 - React Server Components Prototype Chain Vulnerability This POC demonstrates CVE-2025-55182 using actual [email protected] vulnerable code. CVE-2025-55182 Emergency Fix Guide: Complete Analysis & Mitigation for Next.js/React RSC Vulnerability CVSS 10.0 This repository is fork...

covenant_rce

This repository does not have a README...

CVE-2022-41678

CVE-2022-41678: Dangerous MBeans Accessible via Jolokia API in Apache ActiveMQ By listing and inspecting the MBeans exposed by the Jolokia API at http://127.0.0.1:8161/api/jolokia the following attack vectors have been identified: Arbitrary File Write using Log4J resulting in Remote Code Executio...

papercut-toolkit

PaperCut CVE-2026-81578 + CVE-2026-82078 Defense Toolkit A defensive toolkit to check and understand exposure to the chained pre-auth remote code execution vulnerabilities in PaperCut: CVE-2026-81578 — Missing Authentication for Critical Function CWE-306. A remote unauthenticated request can...

gxdlmsdirector-cve

Multiple vulnerabilities in Gurux GXDLMS Director – remote code execution Gurux GXDLMS Director is an open-source Windows program for interacting with energy meters through the use of DLMS/COSEM protocol. The software has a remote update functionality for add-in DLLs as well as for files containi...

CVE-2024-12381

CVE-2024-12381 CVE-2024-12381 is a WebAssembly type canonicalization vulnerability in Chrome's V8 engine where CanonicalEquality::EqualValueType fails to account for nullability in indexed reference types. Combined with a JSPI-based V8 sandbox bypass CVE-2024-12692, this allows remote code...

CVE-2023-36745

CVE-2023-36745 Microsoft Exchange Server CVE-2023-36745 RCE PoC. Example: python3 exp.py -H exchange.webdxg.com -u webdxg.com\dddai -p 4IDF7LAU -s \192.168.237.131\Shares\ -c calc.exe Command will be passed to powershell -e...

CVE-2024-4577

CVE-2024-4577 - PHP-CGI Argument Injection RCE | | ---|---|--- CVE| Description| CVSSv3 CVE-2024-4577| PHP-CGI Argument Injection Vulnerability| 9.8 | | "CVE-2024-4577 is a critical argument injection vulnerability in PHP that can be exploited to achieve remote code execution RCE. According to...

CVE-2025-49113

CVE-2025-49113 Roundcube Exploit A Python exploit for CVE-2025-49113, targeting a vulnerability in Roundcube webmail that allows remote code execution through PHP object deserialization. Overview This exploit leverages a deserialization vulnerability in Roundcube's file upload functionality. It...

Satellian-CVE-2020-7980

Satellian-CVE-2020-7980 Satellian is a PoC script that shows RCE vulnerability over Intellian Satellite controller Intellian Aptus Web. The following script will try to list all the binaries in the system and afterwards will allow the tester to interact directly with the server usually as root. P...

VulnCheck KEV: CVE-2026-33309

Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 External Control of File Name, leading to the root architectural issue within LocalStorageService remaining unresolved. Because the underlying...

CVE-2012-1723

Web browser drive-by that exploits CVE-2012-1723 for remote code execution. A walk-through and technical details can be found at https://ethaniel.me/2017/02/09/practice-the-past-cve-2012-1723/...

CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution

CVE-2026-3844 – Breeze Cache WordPress Plugin Unauthenticated RCE -red?style=flat-square CVE-2026-3844 is a critical unauthenticated arbitrary file upload vulnerability in the Breeze Cache WordPress plugin versions ≤ 2.4.4. An attacker can post a comment containing a malicious tag pointing to a P...

CVE-2016-10033

WordPress 4.6 - Remote Code Execution RCE PoC Exploit CVE-2016-10033 It is modified version of Dawid Golunski's exploit 41962...

CVE-2026-11645

CVE-2026-11645 - V8 in Google Chrome prior to Remote Code Execution Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: HIGH CVSS: 8.8 Impact: Confidentiality, Integrity, Availability Published: 2026-06-09 Technical Summary Out...

cve-2024-50330-ivanti_epm_sqli_reproduction

CVE-2024-50330: Ivanti Endpoint Manager EPM SQL Injection to RCE Overview CVE-2024-50330 is a critical pre-authentication SQL injection vulnerability in Ivanti Endpoint Manager EPM that allows a remote unauthenticated attacker to achieve remote code execution on the target server. The vulnerabili...