CVE-2020-8163

CVE-2020-8163 CVE-2020-8163 - Remote code execution of user-provided local names in Rails Remote code execution of user-provided local names in Rails 5.0.1 There was a vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the locals argument of a render cal...

CVE-2025-13486

CVE-2025-13486 exploit ACF Extended WordPress Plugin — Remote Code Execution & Privilege Escalation Exploit for the CVE-2025-13486 discovered by Marcin Dudek dudekmar ⚠️ Disclaimer This repository is provided for research and defensive security purposes only. The author assumes no responsibility...

CVE-2017-8464-EXP

CVE-2017-8464-EXP Support x86 and x64 Just for test Lnk file from: https://github.com/rapid7/metasploit-framework/pull/8767 Thanks to ykoster Small change,replace the dll file,fix the bug of crashing explorer.exe.ykoster has fixed this bug POC: x86: x64: If you can determine the USB drive,one LNK...

cisco-rv-rce-poc

CVE-2023-20048 — Cisco RV Series PoC & Exploit ⚠ WARNING: For authorized testing only. Do not use against systems you do not own or have written permission to test. This is a Proof of Concept for authorized testing only. What this is Small repository with: CiscoPoc.py — harmless PoC to check for...

CVE-2025-13486

🔴 CVE-2025-13486 - Advanced Custom Fields Extended ACFE WordPress Plugin Exploit 📋 Overview Proof-of-concept exploit for CVE-2025-13486 , a critical vulnerability in the Advanced Custom Fields: Extended ACFE WordPress plugin that allows Remote Code Execution leading to Privilege Escalation. 🎯...

CVE-2025-61882-Oracle-BI-Publisher-RCE

Affected Software: Oracle BI Publisher versions 12.2.1.4.0, 12.2.1.3.0. Vulnerability Type: Remote code execution via insecure deserialization in the BI Publisher integration component. Description: The BI Publisher integration component deserializes untrusted data without validation, allowing...

Chrome-V8-RCE-CVE-2021-38003

Chrome-V8-RCE-CVE-2021-38003 CVE-2021-38003 exploits extracted from https://twitter.com/WhichbufferArda/status/1609604183535284224...

CVE-2024-50379

Manual exploitation is troublesome, so I whipped up an exp.. Usage: shell.jsp is the shell file, ggsl.jsp is the name/path saved to the target server. ./CVE-2024-50379 -u http://192.168.2.245:8080 -f shell.jsp -p ggsl.jsp Disclaimer This tool is only intended for legally authorized enterprise...

CVE-2022-46169

Here is the transformed explanation document: CVE‑2022‑46169 – Explanation & Project Overview Cacti Unauthenticated Remote Code Execution What is this project? This project is a cybersecurity assignment demonstrating CVE‑2022‑46169 : a critical vulnerability in the open-source network monitoring...

Argus

Argus This repo contains the code for our USENIX Security '23 paper "ARGUS: A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions". Argus is a comprehensive security analysis tool specifically designed for GitHub Actions. Built with an aim to enhance the security of CI/CD...

CVE-2023-36884-MS-Office-HTML-RCE

CVE-2023-36884: MS Office HTML RCE with crafted documents On July 11, 2023, Microsoft released a patch aimed at addressing multiple actively exploited Remote Code Execution RCE vulnerabilities. This action also shed light on a phishing campaign orchestrated by a threat actor known as Storm-0978,...

papercut-toolkit

PaperCut CVE-2026-81578 + CVE-2026-82078 Defense Toolkit A defensive toolkit to check and understand exposure to the chained pre-auth remote code execution vulnerabilities in PaperCut: CVE-2026-81578 — Missing Authentication for Critical Function CWE-306. A remote unauthenticated request can...

CVE-2025-55182-analysis

I. Vulnerability Overview In the past couple of days, there has been widespread discussion about a deserialization RCE vulnerability in React. The official CVSS score is a full 10.0, on par with Log4j. Rumors quickly spread claiming it is the "Log4j of modern frontend," causing panic among...

CVE-2025-24367-PoC-Cacti

Cacti CVE-2025-24367 Authenticated RCE PoC This repository contains a proof‑of‑concept exploit for CVE‑2025‑24367 , an authenticated remote code execution vulnerability in Cacti. The issue abuses insufficient input sanitization in graph template handling. By injecting malicious content into the...

CVE-2017-1000353

CVE-2017-1000353 POC How to reproduce the Jenkins CVE-2017-1000353？ Clone this repository, use the pre-built payload jenkinspoc.ser with flowing command: python exploit.py http://your-ip:8080 jenkinspoc.ser Then the touch /tmp/success would be executed. Java Version Requirements Important : The...

CVE-2026-57517

Control Web Panel ≤ 0.9.8.1224 — Blind SQL Injection to Remote Code Execution Port 2083 → userRes POST → INTO DUMPFILE → Port 2031 Webshell → cwpsvc 🔴 Vulnerability Overview CVE-2026-57517 is a critical pre-authentication blind SQL injection in Control Web Panel CWP versions ≤ 0.9.8.1224. The...

CVE-2023-46604

CVE-2023-46604 This repository contains an exploit script and a Proof of Concept PoC XML file for the CVE-2023-46604 vulnerability affecting Apache ActiveMQ. The vulnerability allows for remote code execution due to unsafe deserialization practices within the OpenWire protocol. Description...

CVE-2021-26855

CVE-2021-26855-PoC PoC exploit code for CVE-2021-26855. Original code was developed by https://github.com/GreyOrder. The original repo was deleted shortly after additional features user enumeration etc. were added. Please post a pull request, if you have the latest version. CVE-2021-26855 ssrf...

CVE-2022-22980

SpEL RCE Exploit - CVE-2022-22980 Exploit for remote code execution RCE on Spring Data via SpEL injection Spring Expression Language. Descriptions Vulnerability The box exposes an endpoint /search that accepts a trackingid parameter vulnerable to SpEL injection. This injection allows the executio...

CVE-2025-15556-Notepad-WinGUp-Updater-RCE

Affected Software: Notepad++ versions prior to 8.8.9 using the WinGUp updater. Vulnerability Type: Update integrity verification bypass leading to arbitrary code execution. Description: The WinGUp updater fails to properly verify the integrity of update metadata, allowing an attacker who can...