threat-intel-cve-2024-3094

Threat Intelligence Report: CVE-2024-3094 – XZ Utils Backdoor This repository contains a threat intelligence report analyzing CVE-2024-3094 , a high-profile backdoor vulnerability discovered in the xz-utils compression tool in 2024. CVE-2024-3094 is a severe supply chain compromise where a...

CVE-2024-55555

Laravel Crypto Killer Mass Scanner CVE-2024-55555 This script performs a mass scan of Laravel-based applications vulnerable to CVE-2024-55555, an unauthenticated remote code execution RCE vulnerability in Invoice Ninja. It automates the process of detecting sites using weak or known APPKEY values...

CVE-2020-6364

CVE-2020-6364 Remote code execution in CA APM Team Center Wily Introscope. Original advisory A deserialization vulnerability in CA APM Team Center leads to unauthenticated remote code execution on the server. When authenticating to the server a cookie is returned that starts with the infamous rO0...

Project-CVE-2015-1635

CVE-2015-1635 CVE-2015-1635, MS15-034 Vulnerability Detection USAGE python MS15-034.py www.xxx.com:80 Test Program HTTP.sys Remote Code Execution Vulnerability CVE-2015-1635, MS15-034 A remote code execution vulnerability exists in the HTTP protocol stack HTTP.sys when HTTP.sys does not properly...

CVE-2025-0868

Penetration Testing Project Report: Exploiting CVE-2025-0868 DocsGPT RCE via JSON Eval 1. Introduction A critical Remote Code Execution RCE flaw CVE-2025-0868 was disclosed on February 20, 2025, in the open-source DocsGPT library, caused by unsafe use of eval when parsing JSON payloads. Key...

CVE-2026-1337-AI-Coding-Assistant-Prompt-Injection-to-Sandbox-Escape

CVE-2026-1337 – AI Coding Assistant Prompt Injection to RCE 📖 Overview A prompt injection vulnerability in an AI-powered code review bot allows an attacker to inject arbitrary shell commands by manipulating the bot’s “fix” suggestion. The sanitizer uses a simple blacklist that is bypassed using...

cve-2021-29442-Nacos-Derby-rce-exp

Introduction Nacos Derby command execution vulnerability exploitation script, by default uses User-Agent bypass to exploit the vulnerability Nacos is an open-source platform for service registration, discovery, and configuration management. In its early versions ≤2.4.0-BETA, Nacos integrates Apac...

Mass-scanner-for-CVE-2019-0708-RDP-RCE-Exploit

Mass-scanner-for-CVE-2019-0708-RDP-RCE-Exploit This script is written to improve this PoC script https://github.com/zerosum0x0/CVE-2019-0708 rdesktop binary was taking too long to timeout so i want it to timeout quicker Multiple ip scan was not possible now you can scan a given ip list Example Ru...

CVE-2026-41472-POC

CyberPanel XSS to RCE CVE-2026-41472 One-click Remote Code Execution in CyberPanel v2.4.3 via unauthenticated API endpoints. Overview This exploit chains multiple vulnerabilities in CyberPanel's AI Scanner feature: 1. Unauthenticated Database Injection /api/ai-scanner/callback accepts arbitrary...

CVE-2025-49223-BillboardJS-PoC

💥 CVE-2025-49223 - Prototype Pollution in Billboard.js billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties. This repository...

CVE-2019-11043

CVE-2019-11043 php-fpm+Nginx RCE 0x01 install phuip-fpizdam-Mac go get github.com/neex/phuip-fpizdam go install github.com/neex/phuip-fpizdam ale@Pentest /go go get github.com/neex/phuip-fpizdam ale@Pentest /go go install github.com/neex/phuip-fpizdam ale@Pentest /go ls bin src ale@Pentest /go cd...

EXPLOIT-CVE-2021-44228

CVE-2021-44228 — Log4Shell PoC Lab DISCLAIMER This lab was created exclusively for educational and security research purposes. All traffic occurs within an isolated Docker network. Do not use this material on real systems or without explicit authorization. Misuse may be a crime. Use responsibly...

Peyara-FileUpload

Exploit Title: Peyara Remote Mouse v1.0.1 Unauthenticated Arbitrary File Upload Date: 2025-01-06 Exploit Author: tmrswrr Software Link: https://peyara-remote-mouse.vercel.app/ Platform: Windows Version: v1.0.1 Tested on: Windows 10 USAGE : python3 combinedscript.py Create Malicious LNK File...

PoC_CVE-2016-2098_Rails42

A PoC of CVE-2016-2098 rails 4.2.5.1 view has a vulnerable code app/views/poc/render1.html.erb following command will cause remote code execution $ curl ':3000/poc/render1?template\inline='...

CVE-2021-45232-RCE

Apache APISIX Dashboard RCE usage: -h -u URL -p PORT -c CMD optional arguments: -h, --help show this help message and exit -u URL, --url URL target url e.g: http://127.0.0.1:9000 -p PORT, --port PORT apisix management port default: 9080 -c CMD, --cmd CMD command default: ifconfig reference...

CVE-2014-7205

Bassmaster NodeJS Plugin RCE PoC bassmaster-rce.py: A Python script to exploit CVE-2014-7205. nodeshell.py: A Python module to generate a reverse shell for NodeJS !!Only use against servers on which you have permission to test Summary CVE-2014-7205 is a Remote Code Execution vulnerability in...

CVE-2023-37941

Exploitation of Pickle RCE within Superset's Default Cache Information Author Dinis Cruz Project Superset Description Apache's superset presents different options for caching, all of which based on Flask-Caching. A built-in cache is provided which serializes values for later retreival. This...

CVE-2022-41678

CVE-2022-41678: Dangerous MBeans Accessible via Jolokia API in Apache ActiveMQ By listing and inspecting the MBeans exposed by the Jolokia API at http://127.0.0.1:8161/api/jolokia the following attack vectors have been identified: Arbitrary File Write using Log4J resulting in Remote Code Executio...

react2shell-scanner

React2Shell Scanner – with PoC CVE-2025-55182 – React Server Components RCE PoC Educational exploit client for the Hidden Investigations React2Shell lab. This repository contains a single-host proof-of-concept PoC exploit tool for the React2Shell vulnerability CVE-2025-55182 targeting misconfigur...

CVE-2024-37054-PoC

Description Proof of concept for CVE-2024-37054, a critical deserialization vulnerability in MLflow versions 0.9.0 to 2.14.1. When a malicious pyfunc model is loaded via mlflow.pyfunc.loadmodel, the pickled payload executes arbitrary code. Files exploit.py — full exploit: register, train, upload,...