CVE-2024-25293

MJML Local Code Execution PoC A Proof-Of-Concept for CVE-2024-25293 vulnerability. mjml-app v3.0.4 & 3.1.0-beta was discovered to contain a remote code execution RCE In this repository there is an example vulnerable application and proof-of-concept POC exploit of it. As a PoC there is a python fi...

CVE-2026-94545-nextjs-og-poc

CVE-2026-94545 - Next.js next/og ImageResponse SVG Injection GHSA-vcvr-r3jv-pc5j Security-research material for reproducing and validating CVE-2026-94545 , the Next.js ImageResponse SVG-serialization injection upstream: Satori GHSA-wx4j-mvgx-mqwp, in an isolated, loopback-only lab. Affected:...

CVE-2019-3396

CVE-2019-3396 Confluence Widget Connector path traversal CVE-2019-3396 RCE POC POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: x.x.x.x Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 X11; Linux x8664; rv:60.0 Gecko/20100101 Firefox/60.0 Content-Type:...

CVE-2023-38646

CVE-2023-38646 - Metabase Pre-Auth RCE ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author securezeron Step Guides 1. Set Up the Listener on your attacker machine: nc -nlvp 4444 2. Then, run this command: python3...

WIn-CVE-2021-31166

WIn-CVE-2021-31166 This Repo is inspired on 0vercl0k for a proof of concept for CVE-2021-31166 "HTTP Protocol Stack Remote Code Execution Vulnerability", a use-after-free dereference in http.sys patched by Microsoft in May 2021. Build Infraestructure git clone...

WebLogic-Shiro-shell

Java Deserialization Technology Sharing This sharing covers the following points: 1. Java Serialization and Deserialization Basics 2. Why do vulnerabilities occur during deserialization? 3. Java Reflection 4. ysoserial CommonsCollections2, CommonsCollections5 5. Java ClassLoader: Several methods...

ApacheStruts-CVE-2018-11776

Apache Struts CVE-2018-11776 Python PoC This is based on https://github.com/hook-s3c/CVE-2018-11776-Python-PoC. The container build and instructions did not work as described in the README so this fork was created. The POC exploit used is from Rapid7. Shoutout: hook-s3c github.com/hook-s3c,...

CVE-2024-27348

CVE-2024-27348 🪶 CVE-2024-27348 Proof of concept Exploit RCE in Apache HugeGraph Server Unauthenticated users can execute OS commands via Groovy injection in Apache HugeGraph Server. Usage 🛠 Exploit multiple targets ☣️ python3 CVE-2024-27348.py -f targets.txt -c "command to execute" Exploit single...

CVE-2019-11043-Docker

A docker image with a vulnerable version of PHP-FPM CVE-2019-11043 and nginx. Run docker run --rm -p8080:80 akamajoris/cve-2019-11043 You should be able to access the web application at http://your-ip:8080/. Exploitation Build a binary from https://github.com/neex/phuip-fpizdam, then...

CVE-2023-36664

CVE-2023-36664 : Ghostscript remote code execution Proof of concept for the CVE-2023-36664. Usage To insert a payload into a .eps file : python3 poc.py -f "filename" --payload "command" python3 poc.py -f file.eps --payload firefox To insert a reverse shell payload into a .eps file : python3 poc.p...

text4shell

text4shell A demonstration of CVE-2022-42889 text4shell remote code execution vulnerability. Details in Don't Panic!: CVE-2022-42889 Text4shell vulnerability in Apache Commons Text...

cve-2019-2725

cve-2019-2725 References: Tenable - https://www.tenable.com/blog/oracle-weblogic-affected-by-unauthenticated-remote-code-execution-vulnerability-cve-2019-2725 Exploit Database - https://www.exploit-db.com/exploits/46780 PaloAlto -...

CVE-2019-12949

CVE-2019-12949 From Cross Site Scripting Vulnerability to Remote Code Execution in pfSense 2.4.4-p2 and 2.4.4-p3 Information Description: In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trich the authenticated administrator into clicking on a button on a phishing page, an attacker can uplo...

CVE-2019-19781

Remote Code Execution Exploit CVE-2019-19781- Citrix Application Delivery Controller & Gateway Remote Code Execution Exploit for Citrix Application Delivery Controller and Citrix Gateway CVE-2019-19781 Usage : bash CVE-2019-19781.sh IPOFVULNURABLEHOST COMMANDTOEXECUTE e.g : bash CVE-2019-19781.sh...

CVE-2021-30632

CVE-2021-30632 Chrome V8 RCE Exploit for Windows Tested Version : Chrome 91, 92, 93.0.4577.63 Demo reference Chrome in-the-wild bug analysis: CVE-2021-30632 https://securitylab.github.com/research/inthewildchromecve202130632/ JS POC sample...

CVE-2021-40222

CVE-2021-40222 Application : Rittal CMC PU III Web management Devices : CMC PU III 7030.000 Software Revision : V3.11.002 Hardware Revision : V3.00 Attack type : Remote Code Execution Solution : Update to Software Revision V3.17.10 or later Summary : Web application fails to sanitize user input o...

CVE-2019-0708

CVE-2019-0708 CVE-2019-0708 python3 check 0708 A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is...

hermes-the-messenger

Hermes the messenger A PoC for achieving persistence via push notifications on Windows For more technical details and background read our blogpost here: https://www.persistent-security.net/post/beacon-on-demand-abusing-push-notifications-for-persistence Usage Before anything else you need to setu...

CVE-2024-4879

CVE-2024-4879 Exploit & PoC - Nuclei Template CVE-2024-4879 - Jelly Template Injection Vulnerability in ServiceNow ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticate...

CVE-2018-5767-AC9

Research and Author David Baker Article: Sometimes Exploits Need Patches Too! Working Through a Change of Address External link CVE-2018-5767-AC9 An implementation of a proof-of-concept for CVE-2018-5767 https://vulners.com/cve/CVE-2018-5767 The following is an actualization of CVE-2018-5767, a...