CVE-2024-27348

CVE-2024-27348 🪶 CVE-2024-27348 Proof of concept Exploit RCE in Apache HugeGraph Server Unauthenticated users can execute OS commands via Groovy injection in Apache HugeGraph Server. Usage 🛠 Exploit multiple targets ☣️ python3 CVE-2024-27348.py -f targets.txt -c "command to execute" Exploit single...

CVE-2024-10629

CVE-2024-10629 GPX Viewer = 2.2.8 - Authenticated Subscriber+ Arbitrary File Creation Description: The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxvfileupload function in all versions up to, and...

Magento-eCommerce-RCE-CVE-2015-1397

Magento Shoplift Exploit SUPEE-5344 - CVE-2015-1397 Overview This script exploits the CVE-2015-1397 vulnerability in Magento, commonly referred to as the Magento Shoplift exploit. It allows an attacker to create a new admin user in the Magento database by injecting SQL payloads. Originally writte...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method RCE https://nvd.nist.gov/vuln/detail/CVE-2016-2098 Use git clone...

CVE-2023-43208-MIRTHCONNECT

CVE-2023-43208 NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679. FIRST: I AM NOT RESPONSIBLE FOR WHAT YOU DO WITH IT. SECOND: apt-get install parallel curl...

ICT287_CVE-2022-30190_Exploit

ICT287CVE-2022-30190Exploit Project on CVE-2022-30190 exploitation and mitigation strategies 📌 About This repository contains my final project for ICT287, where I explore the CVE-2022-30190 "Follina" vulnerability. The project covers: Detailed analysis of the exploit Step-by-step execution proces...

CVE-2025-1974

🚨 Log Injection Test via Ingress-NGINX Admission Controller 🧠 Overview This script tests for annotation injection vulnerabilities in Kubernetes clusters using the NGINX Ingress Controller. It is meant for detection purposes only in relation to CVE-2025-1974, which allows malicious annotations to...

CVE-2022-27925-PoC

CVE-2022-27925-PoC Zimbra RCE simple poc...

CVE-2023-27524-POC

CVE-2023-27524: Apache Superset Auth Bypass Script to check if an Apache Superset server is vulnerable to CVE-2023-27524 and if it is vulnerable then, forge a session cookie with the userid = 1 which is usually the admin user allowing for authentication bypass and gaining access to the dashboard...

CVE-2024-22514-Remote-Code-Execution

CVE-2024-22514: Remote Code Execution in Agent DVR Information Description iSpyConnect.com Agent DVR 5.1.6.0 contains a vulnerability which allows the file triggered by alert commands to be redirected. The modification can allow the commands function to trigger any file on the system under the...

CVE-2019-0192

CVE-2019-0192 - Apache Solr RCE 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5 This is an early PoC of the Apache Solr RCE From https://issues.apache.org/jira/browse/SOLR-13301: ConfigAPI allows to configure Solr's JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker coul...

CVE-2023-50164Analysis-

CVE-2023-50164: Apache Struts Vulnerable Application A critical security vulnerability, identified as CVE-2023-50164 CVE: 9.8 was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution RCE...

session_reaper_lab

CVE-2025-54236 - SessionReaper Lab Docker environment for practical demonstration of CVE-2025-54236 SessionReaper: PHP Object Deserialization leading to RCE in Magento Open Source 2.4.7. Exclusive use in controlled environment. Do not run against systems without explicit authorization. About the...

CVE-2024-54262

CVE-2024-54262 Import Export For WooCommerce = 1.5 - Authenticated Subscriber+ Arbitrary File Upload Description The Import Export For WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.5. This makes...

CVE-2022-29303

CVE-2022-29303-Exploit Exploit for CVE-2022-29303 Usage Check against single host / \ \ / / || \ | \ // \ / | \ V /| |/ / / / / // /, /| \ | \ | / || ///| /|//|/// Coded By Valentin Lobstein "With great power comes great responsibility" usage: CVE-2022-29303.py -h -u URL -c COMMAND Example :...

PoC-and-yara-rules-of-CVE-2025-59528-Flowise-has-Remote-Code-Execution-vulnerability

PoC-and-yara-rules-of-CVE-2025-59528-Flowise-has-Remote-Code-Execution-vulnerability LEGAL DISCLAIMER AND TERMS OF USE The Proof of Concept PoC code and technical information provided in this document are intended solely for educational purposes, academic research, and authorized security testing...

CVE-2022-26134

CVE-2022-26134 Confluence Server and Data Center - CVE-2022-26134 - Critical severity unauthenticated remote code execution vulnerability Summary| CVE-2022-26134 - Critical severity unauthenticated remote code execution vulnerability in Confluence Server and Data Center ---|--- Affected Products|...

CVE-2024-25600-Bricks-Builder-WordPress

CVE-2024-25600 Exploit Tool 🚀 Description 📝 This tool 🛠️ is designed to exploit the CVE-2024-25600 vulnerability 🕳️ found in the Bricks Builder plugin for WordPress. The vulnerability allows for unauthenticated remote code execution on affected websites 💻. The tool automates the exploitation...

CVE-2017-5638-ApacheStruts2.3.5

CVE-2017-5638-ApacheStruts2.3.5 A exploit for CVE-2017-5638. This exploit works on versions 2.3.5-2.3.31 and 2.5 – 2.5.10 Requirements optparse, requests Usage This exploit can be used like this: $ python3 CVE-2017-5638ApacheStruts.py -u http://10.129.187.188:8080/Monitoring/example/Welcome.actio...

Chamilo-LMS-CVE-2023-4220-Exploit

Chamilo LMS CVE-2023-4220 Exploit Overview This script exploits a Remote Code Execution RCE vulnerability in Chamilo LMS versions ≤ v1.11.24. The vulnerability CVE-2023-4220 exists due to unrestricted file upload functionality in the bigUpload.php feature of Chamilo LMS, which allows attackers to...