CVE-2025-54123-Poc

CVE-2025-54123 Exploit Hoverfly Authenticated Middleware Command Injection RCE | CVSS 9.8 CRITICAL Vulnerability Hoverfly -u -p -c --shell SHELL -t, --target - Hoverfly API endpoint required -u, --username - Admin username required -p, --password - Admin password required -c, --command -...

CVE-2020-0796-RCE-POC

CVE-2020-0796 Remote Code Execution POC c 2020 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes Remote Code Execution POC for CVE-2020-0796 / "SMBGhost" Expected outcome: Reverse shell with system access. Intended only for educational and testing in corporate environments. ZecOps...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-migration A skill for AI coding agents that finds...

FreeBSD : Node.js -- multiple vulnerabilities (33a752ba-4cbe-46d8-abda-587011d90575)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 33a752ba-4cbe-46d8-abda-587011d90575 advisory. Node.js reports: dns.resolve truncates names containing NUL char CVE-2026-105482 - high TLS...

Amazon Linux 2023 : brotli, brotli-devel, libbrotli (ALAS2023-2026-3334)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3334 advisory. A vulnerability in the Node.js Brotli decoder can result in an out-of-bounds memory write when processing crafted Brotli input. Successful exploitation may lead to memory corruption and remote code...

CVE-2025-10230

CVE-2025-10230: Samba Critical RCE CVSS 10.0 Vulnerability Summary CVE-2025-10230 is a critical remote code execution RCE vulnerability that remained hidden in the Samba codebase for 13 years. The flaw resides in the handling of WINS Windows Internet Name Service registration packets. When...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-probe A focused, open-source scanning probe for C...

Mitigate-CVE-2023-46747

Ansible Playbook to Mitigate CVE-2023-46747 K000137353: BIG-IP Configuration utility unauthenticated remote code execution vulnerability CVE-2023-46747 Here is the link https://my.f5.com/manage/s/article/K000137353 How to use it 1. Git clone my repo...

CVE-2020-11984

Quick start docker build --no-cache -t cve-2020-11984 . docker run --rm -it -p 8080:80 --name cve-2020-11984 cve-2020-11984 pipenv run python3 exploit.py -u localhost:8080/ -c "echo 111/tmp/abc" Reference https://github.com/RubenBar/MLW-upcrans/...

php-oom-longjmp

php2shell - php-oom-longjmp Someone on the internet can talk to your PHP site the same way a browser does, with no password. On last-affected PHP they can send a crafted file-upload request that makes the engine run out of memory while it is still reading the request, before your application...

php-stale-global-uaf

php2shell/php2dos - php-stale-global-uaf Someone on the internet can talk to your PHP site the same way a browser does, with no password. On last-affected PHP 8.5 they can force one request to die with a fatal error, then send a second request to the same worker. PHP 8.5 keeps a backtrace from th...

Webmin-1.580---file-show.cgi-Manual-Remote-Command-Execution-Non-Metasploit-

Markdown Webmin 1.580 RCE Execution Guide Quick reference for executing authenticated Remote Code Execution RCE on Webmin 1.580 via the /file/show.cgi component. 1. Attack Machine Listener Run this command on your local machine to catch the incoming connection before executing the payload: rlwrap...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

patchferry-check Free, read-only scripts that check a server...

CVE-2026-109619

CVE-2026-109618 / CVE-2026-109619 PHP2Shell RCE ★ CVE-2026-109618 / CVE-2026-109619 PHP session.uploadprogress Pre-Auth RCE PoC ★ Overview PHP2Shell CVE-2026-109618 / CVE-2026-109619 is an unauthenticated Remote Code Execution flaw in PHP under Apache modphp. A crafted multipart/form-data request...

Exploit for CVE-2026-111497

CVE‑2026‑111497 – Node.js Brotli Decoder...

CVE-2024-10586-Poc

Vulnerability Information Description The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbtpullimage function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated...

Security Bulletin: Two Critical PHP Vulnerabilities

Summary API Connect is vulnerable to critical PHP Vulnerabilities affecting v12 on prem and v10 LTS Vulnerability Details CVEID:CVE-2026-109618 DESCRIPTION: PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-check A single-file, read-only Bash script that che...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell CVE-2026-109618, CVE-2026-109619: indicators and l...

PHP-CGI-INTERNAL-RCE

PHP-CGI-INTERNAL-RCE This PoC demonstrates how an attacker can chain Orange Tsai's CVE-2024-4577 with DNS rebinding to achieve remote code execution on internal network infrastructure directly through the victim’s web browser. By bypassing Same-Origin Policy SOP and exploiting vulnerable PHP-CGI...