CVE-2019-14439

CVE-2019-14439 Jackson-databind RCE...

metasploitable2-vsftpd-writeup

Metasploitable2 — vsftpd 2.3.4 Backdoor Exploitation A hands-on lab demonstrating discovery and exploitation of a known backdoor vulnerability in vsftpd 2.3.4, using an isolated Kali Linux ↔ Metasploitable2 environment. Objective Practice the core penetration testing workflow — reconnaissance,...

sophucked

sophucked CVE-2020-25223 RCE PoC, gets reverse shell. Pre-auth. Implemented this quickly as it was needed to unify some threat magnets. Example Use: python sophucked.py https://x.x.x.x:4443 x.x.x.x 80 + starting handler on port 80 + Sending callback to x.x.x.x:80 + connection from x.x.x.x + pop t...

CVE-2023-42793

CVE-2023-42793 For educational purposes only PoC for CVE-2023-42793 Usage CVE-2023-42793admin.sh: chmod +x CVE-2023-42793admin.sh ./CVE-2023-42793admin.sh ip/domainname port Proof of working: Usage CVE-2023-42793rce.sh: chmod +x CVE-2023-42793rce.sh ./CVE-2023-42793rce.sh ip/domainname port comma...

CVE-2026-60004-PoC

CVE-2026-60004: Gitea Diffpatch API Remote Code Execution !WARNING This repository is intended exclusively for authorized security research and controlled laboratory testing. Do not run the proof of concept against systems you do not own or have explicit permission to assess. Overview...

CVE-2019-16113

CVE-2019-16113 This is a python implementaiton PoC for the Bludit Directory Traversal Image File Upload Vulnerability CVE-2019-16113 Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg or .png file name, and then this PHP code...

CVE-2026-42945-NGINX-Rift-Toolkit

CVE-2026-42945 Nginx Rift Vulnerability Toolkit Comprehensive toolkit for scanning, patching, and testing CVE-2026-42945 - a critical RCE vulnerability in nginx Table of Contents Overview CVE Details Features Toolkit Components Requirements Installation Usage Workflow Examples Security...

Nextjs_Exploit_Tool

Next.js RSC RCE Exploit Tool CVE-2025-55182 Project Introduction CVE-2025-55182 is a high-severity vulnerability in Next.js's Server Component RSC processing chain. An attacker can craft special multipart/form-data requests and forged RSC response chunks to induce the server to execute arbitrary...

CVE-2025-66478-Exploit-PoC

CVE-2025-66478 Exploit PoC This repository contains proof-of-concept PoC code for reproducing and researching the Next.js CVE-2025-66478 vulnerability. It includes a vulnerable Next.js application and a Node.js exploit script for testing the vulnerability. English · 中文 What is CVE-2025-66478? Thi...

CVE-2026-28695-craft-rce-bypass

CVE-2026-28695 patch bypass — Craft CMS ≤ 5.9.8 authenticated RCE element-search CVSS 3.x : 8.8 HIGH approx — verify CWE : CWE-502 Unsafe Object Instantiation + CWE-1336 SSTI origin Base : CVE-2026-28695 SSTI via create + Symfony Process Fix : advisory fix e31e508 restricts create to BaseObject —...

rails-PoC-CVE-2016-2098

A Proof of Concept of vulnerability: CVE-2016-2098 University project created by @alejandro-marting where we can check the vulnerability 2096 Using: rails 4.2.5.1 view has a vulnerable code app/views/poc/render1.html.erb !...

CVE-2024-6387

转载原文 CVE-2024-6387 - PoC 📜 Description Note: This script is a quick prototype PoC, expect some errors and bugs may occur. Tested on: Kali Linux, ParrotSec, Ubuntu 22.04 Remote Unauthenticated Code Execution Vulnerability in OpenSSH server A signal handler race condition was found in OpenSSH's...

CVE-2019-0708-Msf--

CVE-2019-0708 Unauthenticated CVE-2019-0708 "BlueKeep" Scanner PoC by @JaGoTu and @zerosum0x0. Technical details: https://zerosum0x0.blogspot.com/2019/05/avoiding-dos-how-bluekeep-scanners-work.html Metasploit Module The Metasploit module has been pulled to rapid7:master. msf5 use...

CVE-2024-37054

CVE-2024-37054 — MLflow Pickle Deserialization RCE Proof-of-concept exploit for a critical pickle deserialization vulnerability in MLflow Tracking Server, enabling authenticated remote code execution. ⚠️ For educational and authorized security testing only. Do not use against systems you do not ow...

CVE-2022-22965

CVE-2022-22965 2022.04.02 16:44 Optimized POC, no longer a one-time validation Warning: This program will destroy log information integrity, please back up server data! Use only if you have server penetration test authorization! pocsuite -r CVE-2022-22965POCEXP.py -u url As shown below, the progr...

CVE-2024-10728

CVE-2024-10728 PostX var ultpoptionpanel =...

CVE-2021-22205

CVE-2021-22205 Description - POC for CVE-2021-22205: Gitlab CE/EE RCE 未授权远程代码执行漏洞 POC && EXP - create by antx at 2021-10-29. Detail - An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file...

LayarKacaSiber-CVE-2021-41773

CVE-2021-41773 - Apache HTTP Server 2.4.49 How to Run the CVE-2021-41773-Path Traversal Lab 1. Install and run Docker on your PC/Laptop 2. Clone this GitHub repo 3. Go to the Path Traversal folder 4. Run the following commands docker build -t cve-2021-41773-path-traversal . and docker run --rm -d...

BIG-IP-F5-TMUI-RCE-Vulnerability

BIG-IP-F5-TMUI-RCE-Vulnerability CVE-2020-5902 BIG IP F5 TMUI RCE Vulnerability RCE PoC/ Test Script...

CVE-2026-87902

CVE-2026-87902 - WordPress Core Unauthenticated LFI → RCE Validation Lab Security-research material for reproducing and validating CVE-2026-87902 GHSA-7hp8-65ch-5whp in an isolated, loopback-only Docker lab: an unauthenticated local file inclusion in WordPress core page-template resolution,...