CVE-2023-34468

CVE-2023-34468 — PoC de RCE mediante H2 RUNSCRIPT en ExecuteSQL de Apache NiFi PoC corto en Python para abusar de un procesador ExecuteSQL editable de Apache NiFi con una carga útil RUNSCRIPT de H2 para desencadenar la ejecución remota de comandos a través de una reverse shell de Bash. Solo para...

DocViewerExploitApp

DocViewerExploit 应用 - CVE-2021-40724 这是利用 Document Viewer 的源码，由 MobileHackingLab 提供。 关于存在漏洞的应用 这是一个针对 MobileHackingLab DocumentViewer Android 应用动态代码加载 RCE 挑战 的漏洞利用应用。 该挑战模拟了 Adobe Acrobat Reader Android 应用中发现的 CVE-2021-40724 漏洞。 该应用从库文件动态加载代码，但由于应用处理传入 URI 的方式（使用 getLastPathSegment）存在 LFI 漏洞。...

cve-2024-1708-connectwise_rce_reproduction

CVE-2024-1708 / CVE-2024-1709 — Bypass de autenticación y ejecución remota de código en ConnectWise ScreenConnect Puntuación CVSS: 8.4 CVE-2024-1708 – 10.0 CVE-2024-1709 CWE: CWE-22 Salto de ruta, CWE-288 Bypass de autenticación mediante una ruta alternativa Software afectado: ConnectWise...

WP2Shell-CVE-2026-63030-POC

WP2Shell 检测与验证 PoC CVE 覆盖范围： CVE-2026-63030 和 CVE-2026-60137 预期用途： 仅限授权的安全测试、防御性验证和一次性本地主机实验室 WP2Shell 是一个 WordPress 核心漏洞链，结合了预认证 REST API 批处理路由混淆漏洞（CVE-2026-63030 ）和一个 WPQuery authornotin SQL 注入原语（CVE-2026-60137 ）。该仓库提供了一个 Python 概念验证扫描器和安全验证器，使防御者能够指纹识别受影响的 WordPress...

CVE-2026-18808 Unauthenticated Remote Code Execution via Code Injection in Klemsan's KIO

Improper Control of Generation of Code 'Code Injection' vulnerability in Klemsan Electrical Electronics Inc. KIO Klemsan Internet Objects allows Code Injection. This issue affects KIO Klemsan Internet Objects: before v1.9...

CVE-2026-18808

Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects) prior to v1.9 is affected by an Improper Control of Generation of Code (Code Injection) vulnerability, enabling unauthenticated remote code execution over the network. The vulnerability carries a CVSS 3.1 score of 9.8 (CRITICAL) w...

CVE-2026-84218 Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...

CVE-2022-24355

CVE-2022-24355 Tplink wr841 v10 rce exploit without authorisation ⚠️ Disclaimer The code in this repository is provided as-is for educational and defensive security research purposes only. Use it only on systems you own or have explicit permission to test. The author is not responsible for any...

EUVD-2026-69129

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...

CVE-2026-84131

A flaw was found in the Graphics component of Firefox. An invalid pointer could allow a local attacker to escalate privileges. This could lead to unauthorized access to sensitive system resources or execution of arbitrary code with elevated permissions...

CVE-2026-84125

A flaw was found in Firefox. A use-after-free vulnerability in the DOM: Core & HTML component could allow a remote attacker to execute arbitrary code...

CVE-2026-84147

This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by uploading arbitrary files to a web accessible directory on the targeted system...

CVE-2026-84120

A flaw was found in the Audio/Video component of Firefox and Firefox ESR. This use-after-free vulnerability could allow a remote attacker to achieve arbitrary code execution. A use-after-free occurs when a program attempts to use memory that has been deallocated, which can lead to memory corrupti...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API 时间盲SQL注入 → RCE 概念验证 描述 pocwptot.py 是一个概念验证（PoC），用于利用 WordPress REST API 批量端点上的时间盲SQL注入漏洞，并通过链式升级实现远程代码执行（RCE）。 被测试的漏洞： CVE-2026-63030 CVE-2026-60137 重要警告 仅将此工具用于您拥有或拥有明确书面许可进行测试的系统。滥用可能导致非法和破坏性后果。 作者：GhostGTR666 github.com/gagaltotal PoC 版本：1.0.0 要求 Python 3.8+（推荐）...

cve-2026-0770-langflow_rce_reproduction

CVE-2026-0770: Langflow execglobals Remote Code Execution CVSS 9.8 Critical | ZDI-CAN-27325 | CWE-829: Inclusion of Functionality from Untrusted Control Sphere Overview CVE-2026-0770 is a critical unauthenticated remote code execution vulnerability in Langflow, a low-code application framework fo...

CVE-2021-43936

CVE-2021-43936 CVE-2021-43936 es una vulnerabilidad crítica CVSS3 10.0 que conduce a la Ejecución Remota de Código RCE en el firmware de WebHMI. Esta vulnerabilidad afecta a las versiones 4.0 y las más recientes. Probada solo en 4.0.7475. El script utiliza la vulnerabilidad en los siguientes paso...

Confluence_CVE-2021-26084

ConfluenceCVE-2021-26084 Confluence服务器远程代码执行：CVE-2021-26084 概念验证 Confluence可能的利用端点 root@kitploit: https:///login https:///pages/templates2/viewpagetemplate.action https:///template/custom/content-editor https:///templates/editor-preload-container https:///pages/createpage-entervariables.action...

PoC-CVE-2019-1003030

Jenkins 2.63 脚本安全沙箱绕过 PoC 该项目自动化了创建并向 Jenkins 2.63 所使用的 SecureGroovyScript 验证端点投递 Groovy 载荷的过程。 该工具支持交互模式和一次性执行模式。由于漏洞利用不会返回输出，你需要自行进行一些验证（例如调用你的 AP）来确认其是否生效。 该工具支持： 交互式命令模式 单条命令执行 GET 和 POST 请求 可选的 Jenkins CSRF crumb 支持 免责声明 本项目仅 用于安全研究、CTF、实验环境以及授权的渗透测试。禁止 在未获明确许可的情况下对任何系统使用。 root@kitploit:...

CVE-2026-38526-KrayinCRM-RCE

CVE-2026-38526 - Krayin CRM RCE xpl0ited by infrar3d This is a Remote Code Execution RCE proof-of-concept specifically designed for Krayin CRM v2.2.x, an open-source customer relationship management system. The script automates the exploitation of a file upload vulnerability in the CRM's...

CVE-2024-24919

Check Point 安全网关 RCE 漏洞利用工具 CVE-2024-24919 概述 此仓库包含一个用于利用 Check Point 安全网关中 CVE-2024-24919 漏洞的工具。该工具是一个多目标扫描器，可以识别易受攻击的设备，同时也是一个单目标利用工具，可以完全控制受影响设备。 CVE-2024-24919 是一个高危信息泄露漏洞，允许攻击者远程读取 Check Point 安全网关上的任意文件。此漏洞可被利用来窃取敏感信息，例如密码和配置文件。 免责声明：...