CVE-2021-41773-Analysis

CVE-2021-41773-Analysis Technical analysis and reproduction lab for the Apache HTTP Server 2.4.49 Path Traversal and RCE vulnerability...

CVE-2019-11447-POC

sadnews CuteNews 2.1.2 - CVE-2019-11447 Proof-Of-Concept POC by CRFSlick, discovered by AkkuS An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal...

CVE-2026-75865

CVE-2026-75865 — WPLP Cookie Consent gdpr-cookie-consent ≤ 4.4.1 Proof-of-concept and technical write-up for CVE-2026-75865 , an unauthenticated arbitrary file upload leading to remote code execution in the WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent...

PDFkit-CMD-Injection

PDFkit-CMD-Injection CVE-2022-25765 Detail Description The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized. PoC Start a HTTP server 1- python3 -m http.server 80 Start a netcat listener 2- nc -lnvp 'Target Port' Make a request 3-...

CVE-2026-78745

CVE-2026-78745 — Remote Code Execution via Android Debug Bridge ADB CVE-2026-78745 affects HiDPT / Weyon HiDPTAndroid devices using the Hi3751V350 and Hi3751V352EDMO platforms. The vulnerability allows a remote attacker to execute arbitrary code through the Android Debug Bridge adbd daemon...

CVE-2020-12124

Anatomy of an IoT Exploit, from Hands-On to RCE originally at https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce by David E. Baker, published on June 1, 2023 Foreword This study concerns the firmware of the Wavlink Wireless-AC1200 Gigabit router as of...

CVE-2023-37941

Exploitation of Pickle RCE within Superset's Default Cache Information Author Dinis Cruz Project Superset Description Apache's superset presents different options for caching, all of which based on Flask-Caching. A built-in cache is provided which serializes values for later retreival. This...

CVE-2022-31814

Download CVE-2022-31814 This script exploits a vulnerability in pfSense to upload a shell, execute a command, and then delete the shell. Requirements Python 3.x requests library Installation 1. Clone the repository or download the script. 2. Install the required Python libraries: pip install...

CVE-2026-73034-PoC

CVE-2026-73034 — DB-GPT v0.8.1 Unauthenticated Path Traversal → Arbitrary File Write CVSS 9.8 Critical · CWE-22 · GHSA/Issue 3104 Summary POST /api/v1/python/file/upload in DB-GPT v0.8.1 takes the user-id HTTP header and uses it raw as a path component : uploaddir = os.path.joinbasedir,...

CVE-2024-5932

PoC for CVE-2024-5932 Credit goes to: https://github.com/EQSTLab/CVE-2024-5932 https://www.rcesecurity.com/2024/08/wordpress-givewp-pop-to-rce-cve-2024-5932/ This PoC is provided for educational purposes only. I do not take any responsibility for the improper use of this code, especially in...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-lab !buildhttps://github.com/bsalunke/php2shell...

cve-2026-19900-PoC

CVE-2026-19900 LB-LINK X-PRO Authentication Bypass and RCE via null user CVE-2026-19900 Hardcored Credential and Authentication Bypass RCE via null user. Bypass via Header: Cookie:user=null Usage Build and run the script with a target host: go build cve-2026-19900-PoC.go ./cve-2026-19900-PoC -t...

secure-by-default-rce-demo

Node.js RCE Mitigation: DevOps as the Last Line of Defense This project demonstrates a critical Remote Code Execution RCE vulnerability in a Next.js application specifically via Server Actions and how infrastructure hardening effectively neutralizes the attack even when the code vulnerability...

CVE-2026-5027

This post is a research article published by EQSTLab. Thanks toYahia Hamza, who reported and analyzed this vulnerability. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Arbitrary File Write PoC ★ Description CVE-2026-5027 : Langflow Arbitrary File Write Vulnerability description: A path...

CVE-2025-24813-PoC

CVE-2025-24813-PoC Apache Tomcat Remote Code Execution Vulnerability Batch Detection Script CVE-2025-24813 Disclaimer: The vulnerability and its reproduction steps described in this document are for cybersecurity research and educational purposes only. No one shall use the information provided in...

CVE-2026-96185

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network...

ghe-push-option-rce-scanner

CVE-2026-3854 — GitHub Enterprise Server RCE via Push Option Injection Overview Improper neutralization of push option values in GHE. Attacker with push access achieves RCE on the instance. Field| Value ---|--- CVE| CVE-2026-3854 Severity| CRITICAL Product| GitHub Enterprise Server CISA KEV|...

CVE-2026-105014

Improper neutralization of special elements used in a command 'command injection' in Azure Pipelines allows an unauthorized attacker to execute code over a network...

Xibo-CMS-Zip-Slip-RCE-Exploit-CVE-2023-33177

Xibo CMS Zip Slip RCE Exploit CVE-2023-33177 This exploit demonstrates a path traversal vulnerability in Xibo CMS CVE-2023-33177 that allows remote code execution through malicious layout imports. Vulnerability Details CVE/Advisory: CVE-2023-33177 Affected Versions: Xibo CMS 1.8.0 - 2.3.16 Xibo C...

CVE-2012-2982

This PoC exploit for CVE-2012-2982 was written as an exercise for the "Intro to PoC scripting" Room on TryHackMe. The room can be found here: https://tryhackme.com/room/intropocscripting I was originally going to use Python to follow along, but decided to practice my Rust skills instead. I also s...