CVE-2026-95182

A vulnerability in DeepSeek Harness (dsh) , specifically in commit c291e796 , involves an untrusted search path (CWE-426). This flaw allows an attacker to achieve arbitrary code execution by supplying and opening crafted executable files that replace legitimate content. The impact is rated as CRI...

PT-2026-115920

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

PT-2026-115908

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

PT-2026-115896

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

PT-2026-115900

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a craft...

PT-2026-115912

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a craft...

PT-2026-115924

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a craft...

CVE-2026-88755

The software Z.ai ZCode v3.11.2.6792 is vulnerable to arbitrary code execution because it automatically establishes connections with MCP servers defined within a repository's workspace configuration. An attacker could potentially exploit this by tricking a user into opening a crafted repository ....

CVE-2025-7766

CVE-2025-7766 PoC Exploit PoC for exploiting XML External Entity vulnerability in CVE-2025-7766. Demonstrates file read /etc/passwd and out-of-band HTTP callbacks. Author : Byte Reaper CVE : CVE-2025-7766 Vulnerability : Remote Code Execution via XML External Entity XXE PoC for exploiting XXE in...

CVE-2024-4577

CVE-2024-4577 PHP CGI Remote Code Execution Exploit Author: Byte Reaper CVE: CVE-2024-4577 Category: Web Exploitation Target Versions: PHP CGI 8.1, 8.2, 8.3 Target OS: Windows License : MIT Overview This repository contains a proof-of-concept exploit for the CVE-2024-4577 vulnerability in PHP CGI...

SSCMS-PluginShell

Install Visual Studio 2. Import this project 3. Modify the IPAddress.Parse value in the Startup.cs file using Microsoft.Extensions.DependencyInjection; using SSCMS.Advertisement.Abstractions; using SSCMS.Advertisement.Core; using SSCMS.Plugins; using System.Diagnostics; using System; using...

CVE-2021-28480_HoneyPoC3

ExchangeRCE-CVE-2021-28480 THIS IS NOT A REAL EXPLOIT IT IS A HONEYPOC https://blog.zsec.uk/cve-2020-1350-honeypoc/ PoC for exploiting RCE in Exchange CVEs: CVE-2021-28480, CVE-2021-28481, CVE-2021-28482 and CVE-2021-28483. Usage Achieves RCE on Exchange Servers To run, from a Linux host: chmod +...

CVE-2021-22893_HoneyPoC2

CVE-2021-22893 THIS IS NOT A REAL EXPLOIT IT IS A HONEYPOC https://blog.zsec.uk/cve-2020-1350-honeypoc/ Proof-of-Concept PoC script to exploit Pulse Secure CVE-2021-22893. DO NOT RUN THIS. Usage Achieves RCE on Pulse Secure VPNs chmod +x exploit.sh ./exploit.sh 10.0.0.1 ./exploit.sh -l ./exploit....

React2P4IM0Nshell

React2P4IM0Nshell 💥Extension Tool for Advanced RCE/Source Leak/Dos CVE-2025-55182/83/84 Auditing and Exploitation for Next.js and React Server Components RSC environments directly from your browser, with built-in linux terminal in the extension to receive any reverse shell ❌ ⚡ CMDCENTER: The Core...

PSForgot2kEyXCHANGE

PSForgot2kEyXCHANGE PoC for Forgot2kEyXCHANGE CVE-2020-0688 written in PowerShell Usage This PoC requires a valid Username and Password. This PoC uses ysoserial.net to create the new ViewState which contains the command you specified on the -Command param. If you don't already have this installed...

CVE-2020-10238

Made by HK CVE-2020-10238: Incorrect Access Control in comtemplates- RCE CVE-2020-10239: Incorrect Access Control in comfields SQL field- RCE Link https://developer.joomla.org/security-centre/804-20200303-core-incorrect-access-control-in-com-templates.html...

0-click-RCE-Exploit-for-CVE-2024-50526

CVE-2024-50526 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1859403137435459727 This repository contains a proof-of-concept exploit for CVE-2024-50526, an unauthenticated arbitrary file upload vulnerability in the Multi Purpose Mail Form WordPress plugin,...

CVE-2025-8971

CVE-2025-8971 SQL Injection Author: Byte Reaper Description : This exploit for CVE-2025-8971, a SQL injection vulnerability in itsourcecode Online Tour and Travel Management System 1.0. The vulnerability exists in /admin/operations/travellers.php and can be exploited remotely via the val-username...

CVE-2018-19422-SubrionCMS-RCE

CVE-2018-19422-SubrionCMS-RCE SubrionCMS 4.2.1 Authenticated Remote Code Execution /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these. Exploit Usage Commands: Windows/Linux: $ sudo python3...

L4J-Vuln-Patch

NOTICE This tool is no longer necessary mojang has released its own patch which should cover everyone who is affected https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition WARNING THIS EXPLOIT EFFECTS BOTH CLIENTS AND SERVERS There is currently a exploit...