CVE-2023-41425

https://sploitus.com/exploit?id=3A833277-4844-5F02-AFEF-5EA6BA8AC1AC Wonder CMS RCE | | Description : XSS to RCE, Wonder CMS 3.2.0 evil/evil.php EOF zip -r evil.zip evil/ JS payload that will install the new theme cat xssrce.js var xhr=new XMLHttpRequest; xhr.open"GET",...

CVE-2025-55182-exploit

CVE-2025-55182 Exploit This repository contains a simple exploit for CVE-2025-55182 , a critical remote code execution vulnerability in React Server Components. Vulnerability Overview CVE-2025-55182 is an unauthenticated remote code execution vulnerability in React Server Components CVSS 10.0. Th...

ace-vim-neovim

ace-vim-neovim Vim/Neovim Arbitrary Code Execution via Modelines CVE-2019-12735 Usage 1. listen nc -vlp 9999 2. ace vim pocshell.txt And then, your localhost will get shell...

CVE-2025-55182

📌 CVE-2025-55182 — React2Shell Critical Unauthenticated Remote Code Execution RCE in React Server Components 📖 Overview CVE-2025-55182, informally dubbed React2Shell, is a critical remote code execution RCE vulnerability disclosed on December 3, 2025 in React Server Components RSC and related...

CVE-2025-69457

CVE-2025-69457 – Responsive Tourism Website 3.1 Remote Code Execution RCE Unauthenticated WriteUp CVE-2025-69457 – ExploitDB 50049...

CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

CVE-2020-14882

CVE-2020–14882 Weblogic Unauthorized bypass RCE bypass patch with CVE-2020–14882 private static final String IllegalUrl = new String";", "%252E%252E", "%2E%2E", "..", "%3C", "%3E", ""; list %252E%252E %2E%2E .. %3E %3C ; lower "%252E%252E%252F".lower '%252e%252e%252f' %252E%252E%252F to...

CVE-2025-55182-poc

CVE-2025-55182 - React Server Components Prototype Chain Vulnerability This POC demonstrates CVE-2025-55182 using actual [email protected] vulnerable code. Quick Start Install dependencies npm install Start vulnerable server port 3002 npm start Run RCE exploit npm run exploit Expected Output...

CVE-2018-19276

CVE-2018-19276 OpenMRS Insecure Object Deserialization RCE From https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607 Insecure object deserialization allows Arbitrary Code Execution without needing to log in. IP restrictions on Webservices module do not prevent thi...

CVE-2021-43936

CVE-2021-43936 CVE-2021-43936 is a critical vulnerability CVSS3 10.0 leading to Remote Code Execution RCE in WebHMI Firmware. This vulnerability works on versions 4.0 and the newest ones. Tested only on 4.0.7475. Vulnerability is used by script in the following steps: 1. Logs into the application...

MAL-009

MAL-009: Insecure Chaining of Flags T and TT in Zip for Linux In Zip for Linux, the “-TT” flag can be used to run arbitrary system commands. Due to the dangerous nature of this flag, it must always be used at the same time as the “-T” flag. By using a flag chaining attack, attackers that should...

react-cve-2025-55182

fix-react2shell A CLI tool to detect and fix the critical CVE-2025-55182 React2Shell vulnerability in React Server Components and Next.js applications. The Vulnerability CVE-2025-55182 is a critical CVSS 10.0 unauthenticated remote code execution vulnerability affecting: React Server DOM packages...

CVE-2021-3129

CVE-2021-3129 CVE-2021-3129-Laravel Debug mode remote code execution vulnerability Affected versions and conditions Laravel = 8.4.2 Ignition 2.5.2 Environment setup docker pull vulhub/laravel:8.4.2 exp usage Download and execute in the same directory as exploit.py: git clone...

CVE-2020-5902

Readme F5 BIG-IP arbitrary file read + remote command execution RCE +-------------------------------------------------------------+ + DES: by zhzyker as https://github.com/zhzyker/exphub + + CVE-2020-5902 F5 BIG-IP Read File + RCE + +-------------------------------------------------------------+ ...

monstra_cms-3.0.4--getshell

monstracms-3.0.4--getshell monstracms-3.0.4-upload getshell CVE-2018-17418 Code analysis: In line 150 of monstra\plugins\box\filesmanager\filesmanager.admin.php, there is a forbiddentypes variable used as a blacklist restriction. Continue to follow this variable. In the line 150 of...

New Serious PHP Vulnerabilities Released and Patched

PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations...

CVE-2025-53770-SharePoint-Deserialization-RCE-PoC

CVE-2025-53770-SharePoint-Deserialization-RCE-PoC A critical vulnerability in Microsoft SharePoint Server allows unauthenticated remote code execution via deserialization of untrusted data. Microsoft is aware of active exploitation; apply CVE mitigations immediately. Severity: Critical. commands...

CVE-2018-7600

Drupal 7 CVE-2018-7600 / SA-CORE-2018-002 Install required libraries with: pip install requests pip install bs4 $ python3 drupa7-CVE-2018-7600.py -h ============================================================================= | DRUPAL 7 = 7.57 REMOTE CODE EXECUTION CVE-2018-7600 | | by pimps |...

n8n-RCE-CVE-2025-68613

n8n CVE-2025-68613 Overview This repository contains an educational security research project focused on CVE-2025-68613 , a vulnerability affecting specific versions of n8n related to unsafe workflow expression evaluation. The project was tested only in a controlled local lab environment. About...

CVE-2025-61882-CVE-2025-61884

CVE-2025-61882 & CVE-2025-61884 EDIT: Oracle just disclosed a new vulnerability CVE-2025-61884, the detection script for that vuln can be found in this repo or originally here:https://gist.github.com/rxerium/6c70bc6b72fc0d1365c85937d35d9550. As quoted from Oracle's security advisory: This Securit...