CVE-2026-93104

A flaw was found in the Linux kernel RDMA/rvt component. The rvtallocdevice function incorrectly returns a pointer to memory that has already been deallocated after a port allocation failure. This allows callers to dereference the freed memory, leading to a use-after-free vulnerability. This issu...

CVE-2026-93094

A flaw was found in the ath12k Wi-Fi driver of the Linux kernel. This vulnerability occurs during the rollback of an Access Point AP virtual device vdev creation. If a peer creation step fails, the system can improperly free memory while still holding references to it, leading to a use-after-free...

CVE-2026-93079

A flaw was found in the Linux kernel's CXL Compute Express Link feature handling. The cxlctlgetfeature function does not properly validate the size of the output buffer against a user-controlled count value. This oversight allows a local attacker to provide a count larger than the allocated buffe...

PoC-CVE-2026-1357

PoC CVE-2026-1357: WPvivid Backup & Migration The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. This is due to improper error handling in the RSA decryption process...

CVE-2026-93060

A flaw was found in the Linux kernel's Adreno GPU driver. This use-after-free vulnerability occurs in the a6xxgpuinit function. Specifically, the a6xxdestroy function frees the a6xxgpu memory, but adrenogpu continues to point to the freed memory. An attacker could potentially exploit this to caus...

CVE-2019-9978-Social-Warfare-WordPress-RCE

🚀 CVE-2019-9978 – Social Warfare WordPress Plugin RCE ⚠️ DISCLAIMER: This repository is for educational and authorized security testing only. Use only on systems you own or have explicit written permission to test. Unauthorized access is illegal. 📋 Overview Property| Value ---|--- CVE ID|...

CVE-2026-98490

A flaw was found in the Linux kernel's Open vSwitch subsystem. When connection tracking helpers process unconfirmed connections, subsequent memory reallocations for extensions can leave a dangling pointer in the connection expectations list. An attacker can exploit this issue by sending specially...

Exploit-CVE-2025-24801

CVE-2025-24801 This exploit uses CVE-2025-24801 to get Remote Code Execution RCE via Local File Inclusion LFI at GLPI 10.0.17. Proof of Concept PoC of this CVE with explaination to this vulnerability in GLPI. Observation Some applications expose the /glpi/ endpoint e.g.,...

CVE-2021-41773-Apache-RCE

CVE-2021-41773-Apache-RCE A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected b...

cgi-bin-shellshock

How to use Clone the repository or just copy-paste the one you prefer sudo git clone https://github.com/Gurguii/shellshock.sh Run the script Bash bash shellshock.sh -u -h -p Python python3 shellshock.py -u -lh -lp Note: default LPORT is 4444, URL required. If just URL given, it will RCE, else it...

CVE-2026-42945

RIFT — Remote Injection & Fault Trigger Author: Michael Sanji Winaya Prawiradibrata AI Co-Author: Varanus — sahabatku Heap buffer overflow exploit framework targeting NGINX's ngxhttprewritemodule. Satu tool untuk reconnaissance + exploitation. Zero external dependencies. Isi Repo File| Deskripsi...

cve-2010-4221-lab

CVE-2010-4221 — ProFTPD TELNET IAC Stack Overflow: From Patch to RCE A fully reproducible lab and a hand-written, raw-socket exploit for CVE-2010-4221 — the pre-authentication stack buffer overflow in ProFTPD's prnetiotelnetgets — built as a learning exercise in vulnerability research and exploit...

CVE-2024-4309-Analysis

🛡️ CVE-2024-4309 Xiaomi HyperOS System Updater — OTA Signature Verification Bypass & RCE ⚠️ EDUCATIONAL PURPOSES ONLY — Use on real systems is prohibited. 📋 Project Overview / Project Overview Prepared as part of the BGT-Pentest-LAB cybersecurity final project. Xiaomi HyperOS System Updater...

-CVE-2024-45352

🚨 CVE-2024-45352 – Xiaomi Smarthome Remote Code Execution RCE 📌 Summary A critical vulnerability CVE-2024-45352 was discovered in the Xiaomi Smarthome application, allowing unauthenticated remote code execution RCE via improper input handling in the internal API parser. This vulnerability can be...

CVE-2023-49070

CVE-2023-49070 Pre-auth RCE in Apache Ofbiz!! Usagse Install Open JDK 11 First! sudo apt install openjdk-11-jdk Check POC Video: https://youtu.be/gDzYb6YvBSQ...

CVE-2019-19609

CVE-2019-19609 Strapi Remote Code Execution Usage python3 exploit.py rhost jwt url lhost Exploit POC https://bittherapy.net/post/strapi-framework-remote-code-execution/...

CVE-2023-39593

MariaDB 10.5 Authenticated Code execution-sysexec This guide provides detailed instructions to exploit a User-Defined Function UDF vulnerability in MariaDB on a remote server. These steps include downloading and executing malicious code on a vulnerable database system. Warning: This document is f...

CVE-2022-35411

rpc.py 0.6.0 - Remote Code Execution RCE Exploit fixed by: Liquidsky...

CVE-2022-25813

CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz By inserting malicious content in a message’s “Subject” field, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and obtain RCE Remote...

opmonster

OpMonster CVE-2020-8636 — authenticated remote code execution exploit for Opmon About • Install • Usage • License About OpMonster is a proof-of-concept exploit for CVE-2020-8636 , a remote code execution vulnerability in the Opmon monitoring platform. It abuses the nettools.php endpoint, which le...