CVE-2019-9978

CVE-2019-9978 - Social Warfare WordPress Plugin RCE system'cat /etc/passwd' ✅ Step 2 – Start a Python HTTP Server Use Python to serve your payload: python3 -m http.server 8000 This will make your payload.txt accessible at: http://:8000/payload.txt ✅ Step 3 – Run the Exploit python3 CVE-2019-9978....

MAL-2026-17880 Malicious code in seapy-ops (PyPI)

In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden...

CVE-2023-4220

CVE-2023-4220 PoC Chamilo LMS Unauthenticated Big Upload File RCE This repository contains a Proof of Concept PoC for CVE-2023-4220 , a Remote Code Execution RCE vulnerability affecting Chamilo LMS. This vulnerability allows unauthenticated attackers to exploit a large file upload feature, leadin...

CVE-2026-35517

CVE-2026-35517 - Pi-hole FTLDNS Remote Code Execution via Newline Injection TL;DR A Remote Code Execution vulnerability in Pi-hole's FTLDNS engine versions 6.0 through 6.5 allows an authenticated attacker to inject arbitrary dnsmasq configuration directives by embedding newline characters \n into...

unrealircd-backdoor-pentest-report

🛡️ UnrealIRCd Backdoor Penetration Test A controlled penetration testing project focused on identifying, exploiting, and remediating the UnrealIRCd 3.2.8.1 backdoor CVE-2010-2075 in an isolated training environment. Disclaimer: This project was conducted strictly for educational and authorized...

Exploit for Unchecked Return Value in Google Brotli

Detect · Prove reachability · Understand CVE-2026-111497 — the B...

CVE-2025-24893_Analysis

CVE-2025-24893 - XWiki SolrSearch SSTI to unauthenticated RCE A self-contained Docker lab that reproduces CVE-2025-24893, a Server-Side Template Injection in XWiki's SolrSearch RSS feed that leads to unauthenticated remote code execution. It runs the vulnerable version 15.10.10 and the patched...

CVE-2026-25253-research

CVE-2026-25253 Proof of Concept One-click RCE on OpenClaw via Cross-Site WebSocket Hijacking. DISCLAIMER: This code is provided for authorized security research and educational purposes only. Use of this code against systems without explicit written permission is illegal and unethical. The author...

CVE-2026-1560-Authenticated-Remote-Code-Execution-in-Lazy-Blocks-4.2.0

CVE-2026-1560 – Authenticated Remote Code Execution in Custom Block Builder – Lazy Blocks ≤ 4.2.0 Researcher : ZeYrOXxx Plugin : Custom Block Builder – Lazy Blocks Affected Versions : ≤ 4.2.0 Severity : High CVSS : 8.8 Vulnerability Type : Authenticated Remote Code Execution RCE Attack Vector :...

CVE-2024-10629

CVE-2024-10629 GPX Viewer = 2.2.8 - Authenticated Subscriber+ Arbitrary File Creation Description: The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxvfileupload function in all versions up to, and...

CVE-2026-56290

CVE-2026-56290 - Compagebuilderck Mass Exploit ⚠️ Disclaimer This tool is for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal Use this tool only on systems you own or have explicit permission to test The author is not responsible for an...

CVE-2026-44590

CVE-2026-44590 - sherlock-project/sherlock CI - RCE via pullrequesttarget Injection → Supply Chain Compromise Discovered & reported by: Astaruf Full writeup: https://nstsec.com/en/posts/sherlock-rce-pull-request-target-cve-2026-44590/ Upstream advisory: sherlock-project/sherlock GHSA advisory NVD...

CVE-2026-39902

Vulnerability Report: Authenticated RCE Data Input Researcher: K | Product: Cacti ≤ 1.2.30 01 Vulnerability Summary Field| Value ---|--- Product| Cacti — Complete RRDtool-based Graphing Solution Affected Versions| ≤ 1.2.30 Vulnerability Type| OS Command Injection CWE-78 Attack Vector| Network...

CVE-2026-57827

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE Overview CVE-2026-57827 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in RSFiles! comrsfiles, a widely...

CVE-2021-41773

CVE-2021-41773 Description This script exploits CVE-2021-41773 to print file or/and execute command. This script is available for: Nmap Python Ruby Requirements Python python3 python3 Standard Library Ruby Ruby Ruby Standard Library Install git clone...

CTT-Mailpit-RCE-v1.0---Temporal-Resonance-Mail-Server-Takeover

🎯 CTT-Mailpit-Exploit: Perfect 11/10 Score Zero-Click Worm Transform a basic SMTP header injection CVE-2026-23829 into a perfect-scoring, self-propagating RCE worm using Convergent Time Theory. 📊 Score Transformation: 6.1 → 11.0/10 ⭐ Metric Original CVE-2026-23829 CTT-Enhanced Improvement CVSS...

cve-2020-29007

CVEID : CVE-2020-29007 Name of the affected products and versions : Mediawiki Score all versions up to 0.3.0 Problem type : CWE-96: Improper Neutralization of Directives in Statically Saved Code ‘Static Code Injection’ Summary Score is a Mediawiki extension which generates musical notation based ...

rails-activestorage-vips-audit

rails-activestorage-vips-audit An Agent Skill that audits Ruby on Rails repositories for exposure to CVE-2026-66066 KindaRails2Shell — the Active Storage libvips variant-processing vulnerability that allows arbitrary file read and, in a Rails application, remote code execution. The skill is a...

CVE-2022-24715

Icinga Web 2 - Authenticated Remote Code Execution 2.8.6, 2.9.6, 2.10 Remote command execution Reverse shell Usage usage: exploit.py -h -u URL -U USER -P PASSWORD -i IP -p PORT Welcome. options: -h, --help show this help message and exit -u URL, --url URL Insert URL http://ipvictima -U USER, --us...

CVE-2026-37637

CVE-2026-37637 Proof of Concept for CVE-2026-37637 - Remote Code Execution in Alexantr filemanager v1.0 via unrestricted file upload in filemanager.php. Overview CVE-2026-37637 is a Remote Code Execution vulnerability affecting Alexantr filemanager v1.0. The vulnerability exists in the...