CVE-2017-5638-POC

CVE-2017-5638-POC Vulnerable server setup and proof of concept of CVE-2017-5638 remote code execution vulnerability in an Apache component Server The vulnerable server runs in a docker container, the image can be created using the Dockerfile, running this in the same folder of it: docker build...

CVE-2019-7238

CVE-2019-7238 Nexus Repository Manager 3 Remote Code Execution without authentication 3.15.0 found by Rico Tencent Security Yunding Lab and @voidfyoo Detailed analysis english: https://chybeta.github.io/2019/02/18/Nexus-Repository-Manager-3-RCE-%E5%88%86%E6%9E%90-%E3%80%90CVE-2019-7238%E3%80%91/...

WordPress-RCE-CVE-2019-8942

WordPress Crop Image RCE — CVE-2019-8942 / CVE-2019-8943 Python3 implementation of the authenticated WordPress crop-image exploitation chain. The repository is organized around two independent workflows: a manual OSCP-style script and a fully automated script with an integrated reverse-shell...

CVE-2025-67887

CVE-2025-67887 1C-Bitrix = 25.100.500 Translate Module Remote Code Execution Vulnerability...

Spring4shell

Spring4shell Spring4shell...

CVE-2025-55182

RSC Detector - React Server Components Vulnerability Scanner A Python-based security scanner for detecting and exploiting React Server Components RSC vulnerabilities in Next.js applications. This tool performs passive detection, active fingerprinting, and RCE exploitation testing. ⚠️ WARNING : Thi...

watchTowr-vs-FortiWeb-CVE-2025-25257

watchTowr-vs-FortiWeb-CVE-2025-25257 Detection Artifact Generator for FortiWeb CVE-2025-25257 See our blog post for technical details https://github.com/user-attachments/assets/e59f2b3b-2b9b-469f-b4a8-2b7df2ede194 Detection in Action python watchTowr-vs-FortiWeb-CVE-2025-25257.py --target...

CVE-2025-61304

CVE-2025-61304 "OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address" In the background the ping extension is using the command prompt of Windows to perform the ping. The input field for the Test Target Host is also 1024 chars long. After th...

CVE-2025-25257

CVE-2025-25257 FortiWeb CVE-2025-25257 exploit https://pwner.gg/blog/2025-07-10-fortiweb-fabric-rce exp.py: working/full exploit. signed.py: just a PoC of file read/write. initial version of the exploit...

wp2shell-Exploit-Waf-Bypass

| \ / / / / / | | /| / / \ / // / / / / / | |/ |/ / // // / / / / / / / |/|/////// ///// WordPress Pre-Auth RCE — CVE-2026-63030 + CVE-2026-60137 by Venexy M4xSec Unauthenticated Remote Code Execution on WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, 7.0.0–7.0.1. Patched in 6.8.6, 6.9.5, 7.0.2. Quick...

CVE-2025-60787-MotionEye-RCE

CVE-2025-60787: Motioneye Remote Code Execution RCE Professional Proof-of-Concept PoC for CVE-2025-60787, a critical Remote Code Execution RCE vulnerability in MotionEye versions ≤ 0.43.1b4. Technical Overview The vulnerability arises from a client-side validation bypass in the configUiValid...

CVE-2025-6058

🚨 CVE-2025-6058 — WordPress WPBookit ≤ 1.0.4 Unauthenticated File Upload Exploit Unauthenticated Arbitrary File Upload Exploit targeting WordPress WPBookit Plugin ≤ 1.0.4 Exploit allows remote shell upload and full command execution. Author: 0xgh057r3c0n 📌 About The Vulnerability CVE-2025-6058 is...

CVE-2018-7600-Drupalgeddon2-RCE

CVE-2018-7600 Drupalgeddon2 — Red Team Project ITSOLERA Cybersecurity Department | Offensive Security Internship 2026 Overview This project researches, replicates, and documents CVE-2018-7600 Drupalgeddon2 — a Critical CVSS 9.8 unauthenticated Remote Code Execution vulnerability in Drupal CMS,...

Laravel-CVE-2018-15133

Laravel-CVE-2018-15133 This Python script will allow you to create lists of sites and exploit them quickly. Prerequisites: python curl Usage: $ python cve.py Execute the script $ "Which site do you want to attack =" http:victime.com/ Add the site to the list $ chmod +x nikmok.txt gives 777...

Weblogic_Unauthorized-bypass-RCE

CVE-2020–14882 Weblogic Unauthorized bypass RCE CVE-2020-14882 Oracle Weblogic Unauthorized bypass RCE test script it works on Python3 Requests POST /console/images/%252E%252E%252Fconsole.portal HTTP/1.1 Host: User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Geck...

HG532d-RCE-Exploit

HG532d RCE Exploit Overview A Remote Code Execution RCE exploit based on CVE-2017-17215 vulnerability. Modded from original PoC code from exploit-db.com to work on Huawei HG532d Home Gateway Routers. Description This RCE exploit is based on CVE-2017-17215 which exploits vulnerabilities in the UPn...

CVE-2026-7537

MDJM Event Management = 1.7.8.3 - Authenticated Administrator+ Arbitrary File Upload via 'mdjmemailuploadfile' Parameter The WordPress MDJM Event Management plugin version 1.7.8.3 and prior contains an arbitrary file upload vulnerability that allows authenticated administrators to upload maliciou...

CVE-2026-64638

CVE-2026-64638 Reflected XSS on Login Screen Leading to PHP Code Execution — WordPress Core Software: WordPress Core ≤ 7.0.2 all versions prior to 7.0.3 CVSS: 8.9 High CWE: CWE-79 — Improper Neutralization of Input During Web Page Generation Authentication Required: None Pre-Auth User Interaction...

CVE-2023-41425-wonderCMS_RCE

CVE-2023-41425-wonderCMSRCE Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. For educational purposes only Requires knowledge of loginURL, admin access or the...

CVE-2026-64638

🛡️ CVE-2026-64638 - XSS2Shell WordPress Pre-Authentication Reflected XSS with potential escalation to PHP Code Execution 📌 Overview CVE-2026-64638 is a high-severity pre-authentication reflected Cross-Site Scripting XSS vulnerability affecting the WordPress login screen. Under specific conditions,...