CVE-2022-0540-RCE

Atlassian Jira Seraph Authentication Bypass RCE（CVE-2022-0540） English • 中文 Exploit Details As seen in author's blog, atlassian provided a long list of affected plugins the vast majority of which were false positives, and the author listed several actual affected plugins According to the prompted...

skf-flask

OLD and archived Security Knowledge Framework Please note that this is the archived version of SKF, we are busy building a brand new Security Knowledge Framework. For more updates please visit this github repo: https://github.com/Security-Knowledge-Framework/Platform...

CVE-2021-39115

CVE-2021-39115 Template Injection in Email Templates leads to code execution on Jira Service Management Server I Building I have provided a guide for deployment + debug here, you can refer to it. II Analysis The Description of this CVE already clearly states that the bug lies in the Email Templat...

log4j-test

Simple Example showing CVE-2021-44228 in action Explanation To reproduce this issue, I am removing the transitive dependency for logging from SpringBoot. Instead, I am bringing in spring-boot-starter-log4j2 spring-boot-starter-log4j2 brings in log4j-core which has the remote code exploit RCE...

CVE-2024-53677-S2-067

🚨🚨 CVE-2024-53677-S2-067🚨🚨 Security Advisory: CVE-2024-53677 – Critical Apache Struts Remote Code Execution Vulnerability Advisory Date: December 14, 2024 CVE ID: CVE-2024-53677 CVSS Score: 9.5 Critical Overview A critical vulnerability, CVE-2024-53677, has been identified in the popular Apache...

CVE-2023-51385---OpenSSH-ProxyCommand-Injection-PoC

🔐 CVE-2023-51385 - OpenSSH ProxyCommand Injection PoC This repository contains a proof-of-concept for CVE-2023-51385, a command injection vulnerability in OpenSSH's ProxyCommand option. An attacker with control over SSH configuration or untrusted ProxyCommand strings can potentially achieve...

CVE-2019-0232

CVE-2019-0232 Apache Tomcat Remote Code Execution on Windows - CGI-BIN Apache Tomcat Remote Code Execution on Windows cgi-bin Usage: Usage: python CVE-2019-0232.py url cmd Test Environment: jdk8 apache-tomcat-8.5.39...

CVE-2020-2551

CVE-2020-2551 Weblogic IIOP Deserialization Test Environment Weblogic10.3.6+jdk1.6 Packaged jar file Extraction code: a6ob Exploit Download the jar package, then use marshalsec to start a malicious RMI service, compile a local exp.java package payload; import java.io.IOException; public class exp...

CVE-2023-30253-Exploit

CVE-2023-30253 Exploit Dolibarr vulnerable to remote code execution via uppercase manipulation Affected version 17.0.1 Usage: pip3 install -r requirements.txt python3 CVE-2023-30253.py...

CVE-2023-27350

CVE-2023-27350 POC for CVE-2023-27350 affecting PaperCut MF/NG Affected Versions 'PaperCut MF or NG version 8.0 or later excluding patched versions on all OS platforms.' Summary This POC uses an authentication bypass vulnerability chained with abuse of builtin scripting functionality to execute...

Exploit_CVE-2025-47812

WingFTPServer7.4.3-UnauthenticatedRCE...

CVE-2025-55182-PoC

CVE-2025-55182 - PoC & Stand 📌 Quick Start 1. Deploy Vulnerable Stand cd Stand docker compose up --build The vulnerable app runs at: http://localhost:3011 2. Run the Safe PoC Scanner bash cd PoC/src poetry install poetry run python scanner.py http://localhost:3011 ✅ Expected PoC Output text...

CVE-2025-24813-Apache-Tomcat-RCE-PoC

CVE-2025-24813 Apache Tomcat RCE PoC Description This is a Proof of Concept PoC for CVE-2025-24813, a Remote Code Execution RCE vulnerability in Apache Tomcat. The vulnerability arises from unsafe deserialization of crafted session files uploaded via HTTP PUT requests, allowing attackers to execu...

Blackash-CVE-2025-32023

CVE-2025-32023 - Redis Remote Code Execution RCE 🚨 🧠 Overview: A critical RCE vulnerability affecting Redis 7.2.4, where attackers can load malicious modules using the MODULE LOAD command. 🕳️ Vulnerability Type: Remote Code Execution RCE 💥 Impact: An unauthenticated attacker can execute arbitrary...

cve-2025-55182-react2shell-analysis

CVE-2025-55182 React2Shell — Security Analysis Overview This project is a technical analysis of CVE-2025-55182, a critical Remote Code Execution RCE vulnerability disclosed in December 2025. The vulnerability affects React Server Components and allows attackers to execute arbitrary code via...

CVE-2026-65660-Poc

MS SharePoint CVE-2026-65660 - Malicious Register Directive Code Injection Exploit Description This repository provides a production-ready exploit for CVE-2026-65660 Improper Control of Generation of Code, CWE-94 in Microsoft SharePoint Server. The vulnerability stems from unescaped quote injecti...

Apache-Dubbo-CVE-2023-23638-exp

For a more comprehensive Dubbo vulnerability scanning tool, see my other project: https://github.com/YYHYlh/Dubbo-Scan Apache-Dubbo-CVE-2023-23638-exp An engineering practice for exploiting Apache Dubbo CVE-2023-23638, covering the entire process from service discovery to exploitation and echo in...

exphub

Notice In the end, I still felt that having separate scripts for each vulnerability was very inconvenient, so I integrated all poc and exp scripts into one, enabling one-click scanning + exploitation. Since I've been working on integration recently, Exphub has not been updated for a long time. Th...

CVE-2022-46649

CVE-2022-46649 PoC exploit for CVE-2022-46649, a command injection vulnerability in the /cgi-bin/iplogging.cgi endpoint. The vulnerability allows authenticated attackers to execute arbitrary OS commands via crafted tcpdumpParams. Overview Vulnerability: OS Command Injection Endpoint:...

activemq-cve-2023-46604

Active MQ CVE-2023-46604 exploit This repository is a guide with examples on how to exploit the CVE-2023-46604 The exploit takes advantage of the usage of reflection for instantiating Exception classes through a malicious command that instead of being a valid command, it sends as the exception...