CVE-2026-23001-Hugging-Face-Transformers-Model-Deserialization-Arbitrary-Code-via-Pickle-

CVE-2026-23001 – Hugging Face Transformers Model Deserialization RCE Overview Hugging Face models saved with torch.save use Python’s pickle serialization, which is inherently unsafe. If a user downloads a seemingly legitimate model from a repository, loading it can trigger arbitrary code executio...

CVE-2025-55182-React2Shell

React2Shell React2Shell is a proof-of-concept PoC exploit demonstrating a CRITICAL remote code execution RCE vulnerability in modern web frameworks using React Server Components RSC. This PoC targets CVE-2025-55182 , a CVSS 10.0 vulnerability that allows unauthenticated remote attackers to execut...

psexec_noinstall

psexecnoinstall The repository contains psexec, which will help to exploit the forgotten pipe Have a non-genius administrator connect using PsExec to the host: We discovered this when we saw the RemComCommunication bundle. This one is standard for PsExec Using psexecnoinstall, it is possible to...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start Download the Repo = run npm i Afer Installing all dependency just run the application node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4 Broken Session Management ✅5 We...

PipeViewer

A GUI tool for viewing Windows Named Pipes and searching for insecure permissions. The tool was published as part of a research about Docker named pipes: "Breaking Docker Named Pipes SYSTEMatically: Docker Desktop Privilege Escalation – Part 1" "Breaking Docker Named Pipes SYSTEMatically: Docker...

CVE-2026-25769

🚨 CVE-2026-25769 - Wazuh Insecure Deserialization RCE Critical Worker ➜ Master Remote Code Execution in Wazuh Cluster Mode Unsafe deserialization in Wazuh cluster communications allows a compromised worker node to achieve root RCE on the master node. 📌 Overview CVE ID: CVE-2026-25769 Product: Waz...

firepwner

CVE-2015-6357: FirePWNER Exploit for Cisco FireSIGHT Management Center SSL Validation Vulnerability Introduction On its own the Cisco FireSIGHT Management Center Certificate Validation Vulnerability3 is a medium severity vulnerability with a CVSS of 5.1. However, this vulnerability is an example ...

CVE-2022-38577-Processmaker

This repository has be archived and moved to: https://github.com/sornram9254/CVE-BBP-VDP ProcessMaker - User Profile Privilege Escalation CVE-2022-38577 ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to...

CVE-2025-66956

CVE-2025-66956 Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL. CVSS Vectors CVSS 3.1: 9.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS 4.0: 10.0,...

CVE-2025-65900

CVE-2025-65900: Kalmia CMS v0.2.0 - is vulnerable to Incorrect Access Control Vulnerability Overview CVE ID: CVE-2025-65900 Product: DifuseHQ Kalmia CMS Affected Version: 0.2.0 Vulnerability Type: Incorrect Access Control Privileges Required: Low Read-only user account Impact This vulnerability...

gosign-desktop-exploit-poc

Multiple Vulnerabilities in GoSign Desktop leads to Remote Code Execution Name: TLS Verification Bypass and Insecure Update in GoSign Desktop CVEs: CVE-2025-34324, CVE-2025-34327 System Affected: GoSign Desktop = 2.4.0 Fix: FoSign Desktop 2.4.1 partially fixed Vendor: Tinexta InfoCert S.p.A...

LlamaStack-RCE-Deterministic-Supply-Chain-Exploitation-Hardening-Framework-CVE-2024-50050-

= doi.org/10.5281/zenodo.18278567 = orcid.org/0009-0007-7728-256X 💀 LlamaStack-RCE: CVE-2024-50050 Supply Chain Exploitation Framework UNRESTRICTED CLASSIFIED MATERIAL - FOR AUTHORIZED RED TEAMING ONLY 1. Executive Summary Deterministic Analysis LlamaStack-RCE is a high-fidelity simulation and...

safety

!NOTE Come and join us at SafetyCLI. We are hiring for various roles. Table of Contents Table of Contents Introduction Key Features Getting Started GitHub Action Command Line Interface 1. Installation 2. Log In or Register 3. Running Your First Scan Basic Commands Service-Level Agreement SLA...

sjet

sJET by siberas siberas JMX Exploitation Toolkit sJET allows an easy exploitation of insecure configured JMX services. Additional background information can be found here and here. Prerequisites Jython 2.7 Usage SJET implements a CLI interface using argparse: jython sjet.py targetHost targetPort...

CVE-2024-56278

CVE-2024-56278 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name WP Ultimate Exporter Vulnerable version ⚠️ Since the 'WP Ultimate Exporter' plugin is an addon for the 'WP Ultimate CSV Importer' plugin, both plugins need to be installed. 1. Create a new post using the code...

CVE-2021-45008

CVE-2021-45008 Privilege Escalation from user to admin Affected product and version: Plesk Obsidian 18.0.37 Severity: Critical Impact: Gain high privilege from user to admin and access critical information Description: insecure permissions vulnerability that allows unprivilege user to get admin...

CVE-2026-2898-FunAdmin-Deserialization

CVE-2026-2898 - FunAdmin Insecure Deserialization Summary FunAdmin Disclaimer For educational and authorized testing only...

malicious-pdf

Malicious PDF Generator ☠️ Generate 67 malicious PDF test files for testing phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh Used for penetration testing, bug bount...

WebGoat

WebGoat: A deliberately insecure Web Application Introduction WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. This program is a demonstration of common server-side application flaws. The exercises are intended to be used b...

ktor-cve-2023-45612-poc

Ktor XXE Vulnerability Proof-of-Concept CVE-2023-45612 Summary Impact: Arbitrary files access via a crafted XML DTD with an XXE reference. Root cause: Unsafe XML document parser. This repo contains a vulnerable Ktor 2.3.4 app configured to allow external entities so the XXE effect is visible...