Log4Shell-Payloads

🚨 Log4Shell Payloads Collection A curated list of Log4Shell / Log4J exploitation payloads targeting: CVE-2021-45046 CVE-2022-42889 🔗 By @nav1n0x 🔥 One-Liner Payloads ✅ Oneliner 1 cat vulnerable-hosts.txt | sed 's/https?:////' | xargs -I echo...

CVE-2019-7216

CVE-2019-7216 In filechucker.cgi version 5.09 and filechuckerprefs.cgi version 4.99e-free-e02 there is a filter bypass, upon upload, that can lead to remote code execution providing that the user uploads a malicious file. The bypass occurs when filechucker attempts to filter out the file extensio...

CVE-2020-23839

CVE-2020-23839 | GetSimple CMS v3.3.16 - Reflected XSS to RCE Exploit Author: Bobby Cooke boku Vulnerability Statistics OWASP Top Ten 2017: A7:2017-Cross-Site Scripting XSS CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - Type 1: Reflected XSS CVSS Base...

POC-CVE-2025-24813-Apache-Tomcat-Remote-Code-Execution

⚠️🚀 CVE-2025-24813 — Apache Tomcat RCE Exploitation Suite ⚡ Version: 1.0 🛡️ CVE ID: CVE-2025-24813 Apache Tomcat RCE 🧬 Payloads: ysoserial / Java 🌐 Mode: Interactive + Stealth 🔬 Usage: Ethical, Investigative, Educational 🌌 Overview This tool has been designed as a futuristic exploitation suite...

CVE-2022-28672

CVE-2022-28672 Discord Server This bug was Use after Free caused by improper handling of javascript object memory references. Blog Foxit PDF Reader - UaF - RCE - JIT Spraying Advisory CVE-2022-28672 Demo...

CVE-2020-11890

Made by HK CVE-2020-11890: Improper input validations in the usergroup table class could lead to a broken ACL configuration to RCE Link https://developer.joomla.org/security-centre/810-20200402-core-missing-checks-for-the-root-usergroup-in-usergroup-table.html PoC Affected version: Joomla core...

CVE-2022-24112

CVE-2022-24112 Apache APISIX batch-requests RCECVE-2022-24112 Place the target in url.txt python3 ApacheAPISIXRCECVE-2022-24112.py Cmd:...

CVE-2026-63077

Unauthenticated Remote Code Execution in JetBrains TeamCity CVE-2026-63077 Overview This is a proof-of-concept exploit script for CVE-2026-63077. Organizations can use this script to validate their detection and remediation posture. For a full technical analysis of CVE-2026-63077, please read our...

CVE-2020-35682

CVE-2020-35682 SD-91948: CVE-2020-35682: Authentication Bypass Vulnerability during SAML login in ServiceDesk Plus. As described by ManageEngine. If the target ServiceDesk Plus 11134 installation has SAML login enabled and you have credentials to a low privilege user then you can escalate to...

CVE-2024-0012_CVE-2024-9474_PoC

🚀 CVE-2024-0012 & CVE-2024-9474 Palo Alto PAN-OS Exploit 🔐 🛡️ Description This Proof-of-Concept PoC script targeting vulnerabilities in Palo Alto PAN-OS, specifically CVE-2024-0012 and CVE-2024-9474 by automating the exploitation process, including autentication bypass, payload creation, chunked...

CVE-2025-64155

CVE-2025-64155: Fortinet FortiSIEM Argument Injection to Remote Code Execution Proof of concept exploit for Fortinet FortiSIEM which abuses an argument injection to write a file to gain code execution as root Blog Post Deep-dive analysis here: Horizon3.ai - CVE-2025-64155: Three Years of Remotely...

PDFkit-CMD-Injection

PDFkit-CMD-Injection CVE-2022-25765 pdfkit 0.8.6 command injection. The package pdfkit is vulnerable to Command Injection where the URL is not properly sanitized. Note: This issue was patched in 0.8.7.2, but the patch was discovered to be ineffective. The updated patch version is 0.8.7.2 PoC Star...

CVE-2025-24893-PoC

Disclaimer: The vulnerabilities and reproduction steps described in this document are intended solely for cybersecurity research and educational purposes. No one shall use the information provided in this document for illegal purposes or unauthorized system testing. The author assumes no...

CVE-2024-23897

CVE-2024-23897 CVE-2024-23897 jenkins-cli We have seen Jenkins File Leak / RCE CVE-2024-23897 exploited in the wild and managed to reproduce it. If your Jenkins allows anonymous users or user registration, immediately update it to the latest version. java -jar jenkins-cli.jar -s...

CVE-2025-24367-Cacti-PoC

CVE-2025-24367 - Cacti Authenticated Graph Template RCE Usage & Safety Important — Read this first: This repository and exploit.py are provided for educational and research purposes only. Do not use this code against systems, networks, or services for which you do not have explicit, written...

xwiki-15.10.8-reverse-shell-cve-2025-24893

CVE-2025-24893 Reverse Shell Exploit for XWiki Disclaimer: This script is intended for educational purposes and authorized security testing only. Do not use on systems you do not own or have explicit permission to test. Misuse can be illegal and dangerous. Description This Python script exploits...

CVE-2024-1651-PoC

CVE-2024-1651 This CVE was discovered by Carlos Bello from the Fluid Attack Offensive Team. The finding discusses Insecure Object Deserialization to obtain RCE Remote Code Execution. Here, I have created a faster and easier-to-use PoC Proof of Concept. Therefore, if anyone wants to reproduce the...

Struts2Vuln

Vulnerable Struts2 application Requirements 1. Maven https://maven.apache.org 2. Struts = 2.5.10 CVE-2017-5638 - Apache Struts 2 Multipart form RCE Requirements 1. Locate a URL that issues a multipart form POST Getting Started 1. The application / server can be started with the following maven...

CVE-2025-55182

React2Shell: CVE-2025-55182 Walkthrough Author: Kavienan J Vulnerability discovered by: lachlan2k, who responsibly disclosed it to the React team. For updates on this vulnerability, visit: react2shell.com Table of Contents 1. Introduction 2. Background 3. Understanding ReactFlightReplyServer.js 4...

ConfluentPwn

ConfluentPwn Confluence pre-auth ONGL injection remote code execution scanner CVE-2022-26134. Usage The below GIF shows a demo usage of the tool: Here is the help output of the tool: $ ./cfscan -h +-------------------------------+ | C O N F L U E N T P W N | +-------------------------------+ +...