CVE-2025-81110-PoC

CVE-2025-81110-PoC Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. This repository contains a professional-grade exploit for a critical vulnerability in Gogs versions prior to 0.13.0. The exploit leverages a logical flaw where the Gogs API fails to...

CVE-2025-4427-CVE-2025-4428

CVE-2025-4428 & CVE-2025-4427 CVE-2025-4428 is a post-auth remote code execution vulnerability in EPMM's DeviceFeatureUsageReportQueryRequestValidator. It arises from the unsafe handling of user-supplied input within error messages processed via Spring’s AbstractMessageSource, which allows...

CVE-2023-1177-MLFlow

CVE-2023-1177 MLFlow Path Traversal About MLflow MLflow is an open-source platform for managing the end-to-end machine learning lifecycle. Primary Functions: MLflow tackles four primary functions: Tracking experiments to record and compare parameters and results MLflow Tracking. Packaging ML code...

cve-2021-42013

Apache 2.4.50 - Path Traversal or Remote Code Execution CVE-2021-42013.py is a python script that will help in finding Path Traversal or Remote Code Execution vulnerability in Apache 2.4.50. Vulnerable instance of Docker is provided to get your hands dirty on CVE-2021-42013 If CGI-BIN is enabled...

CVE-2026-4631-cockpit-RCE

CVE-2026-4631 — Cockpit Mass Exploit Tool Unauthenticated Remote Code Execution via SSH Command-Line Argument Injection Cockpit versions 327 – 359 | CVSS 9.8 Critical | CWE-78 Tool mass exploitation untuk CVE-2026-4631 pada Cockpit web service cockpit-ws, port 9090. Mendukung mode vulnerability...

CVE-2026-46817

🚨 CVE-2026-46817 - Critical Remote Code Execution Oracle E-Business Suite – Oracle Payments File Transmission Critical unauthenticated remote vulnerability affecting Oracle Payments File Transmission that may allow complete compromise of the application over HTTP. 📌 Overview CVE-2026-46817 is a...

CVE-2026-38751-OpenSTAManager-Arbitrary-File-Upload-PoC

CVE-2026-38751 – OpenSTAManager Arbitrary File Upload PoC This repository contains a proof-of-concept PoC exploit for CVE-2026-38751, affecting OpenSTAManager ≤ 2.10. The vulnerability allows an authenticated attacker to upload a malicious module via the module update functionality, leading to...

csv-plus_vulnerability

csv-plusvulnerability 👻 2-Click Arbitrary Code Execution Vulnerability. CVE-2022-21241 ⚠ This PoC was created to alert users and investigate vulnerabilities in their own CSV+, and is prohibited to be used for attacks. Vulnerability The following versions are vulnerable. CSV+ click me 👻...

Moniker-Link-CVE-2024-21413

🛡️ Moniker Link CVE-2024-21413 Room: Moniker Link CVE-2024-21413 — TryHackMe Status: ✅ Completed Date: 30 May 2025 🎯 Objective Understand and exploit CVE-2024-21413, a vulnerability in Microsoft Outlook that bypasses Protected View using Moniker Links to leak NTLM credentials. Learn how to perform...

CVE-2019-0708-EXPloit-3389

CVE-2019-0708-EXPloit-3389 Remote Desktop RDP Service Remote Code Execution Vulnerability CVE-2019-0708...

CVE-2026-109619

CVE-2026-109618 / CVE-2026-109619 PHP2Shell RCE ★ CVE-2026-109618 / CVE-2026-109619 PHP session.uploadprogress Pre-Auth RCE PoC ★ Overview PHP2Shell CVE-2026-109618 / CVE-2026-109619 is an unauthenticated Remote Code Execution flaw in PHP under Apache modphp. A crafted multipart/form-data request...

CVE-2020-5903

CVE-2020-5902 RCE /tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=delete+cli+alias+private+list /tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=create+cli+alias+private+list+command+bash...

Form-Tools-3.1.1-RCE

Form-Tools-3.1.1-RCE CVE-2024-22722 RCE via SSTI Automation with Python. Server Side Template Injection SSTI vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application. This script automates the creation of ...

React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web

React2Shell CVE-2025-55182: The Deserialization Bug That Broke the Web ⚡ React2Shell, CVE-2025-55182, RCE Vulnerability: A critical breakdown of the unsafe deserialization flaw in React Server Components that enables unauthenticated remote code execution across default React/Next.js setups. ⏩ TL;...

CVE-2024-12252

CVE-2024-12252 SEO LAT Auto Post = 2.2.1 - Missing Authorization to File Overwrite/Upload Remote Code Execution Description The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remoteupdate AJAX action in all versions up to, and...

CVE-2025-46811

SUSE Manager Exploit Toolkit CVE-CVE-2025-46811 Scanner & Exploiter 🚀 Features Multi-threaded vulnerability scanning Interactive root shell via WebSocket Single command execution mode Colored debug output Batch processing of targets 📦 Installation git clone...

CVE-2025-55349

CVE-2025-55349 — pm2 Arbitrary Code Execution via postinstall Discoverer : Golden Ticket Labs Vendor : Unitech pm2 Date Assigned : August 20, 2025 MITRE Description An issue in the lib/API/Modules/NPM.js component of Unitech PM2 v5.4.2 allows arbitrary code execution by installing packages with...

CVE-2023-38831-WinRAR-Vulnerability-Analysis

CVE-2023-38831-WinRAR-Vulnerability-Analysis This project is a cybersecurity research and analysis project focused on CVE-2023-38831, a critical WinRAR vulnerability that allows attackers to execute malicious code through specially crafted archive files. The project was conducted in a controlled...

CVE-2025-60752

CVE-2025-60752 PoC of CVE-2025-60752 Affected product: Tinyc Http Server The full writeup article is available at https://zer0matt.blogspot.com/2026/05/cve-2025-60752-tinyc-http-server-stack.html Description A stack buffer overflow occurs when Tinyc receives a crafted input. The overflow occurs...

CVE-2025-14174-Chrome-Zero-Day

Affected Software: Google Chrome prior to version 121.0.6167.85. Vulnerability Type: Use‑after‑free in the V8 JavaScript engine. Description: A use‑after‑free bug in V8’s garbage collection allows crafted JavaScript to corrupt memory, leading to arbitrary code execution within the browser context...