cve-disclosures

CVE Disclosures — Aman Bahiniya Three CVEs assigned by MITRE in December 2024. The records were reserved but never published, so nothing is indexed yet. This repo publishes the advisories so the CVEs become searchable and credited. CVE| Product| Type ---|---|--- CVE-2024-57551| Online Food Orderi...

CVE-2025-55182-realistic-poc

CVE-2025-55182: React Server Components RCE A minimal proof of concept demonstrating the critical Remote Code Execution vulnerability in [email protected]. What is CVE-2025-55182? A pre-authentication RCE vulnerability in React Server Components that allows attackers to execute arbitrary cod...

dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network...

coreweave-demo-2026-05

CoreWeave Demo — Verified Vulnerability Journey May 2026 TL;DR for execs : see DEMO-WALKTHROUGH.md — 8-min top-to-bottom read of the full demo with sample verifier outputs, no execution required. This repository demonstrates an end-to-end verified vulnerability journey for two real-world, publicl...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

CVE-2025-10230

CVE-2025-10230: Samba Critical RCE CVSS 10.0 Vulnerability Summary CVE-2025-10230 is a critical remote code execution RCE vulnerability that remained hidden in the Samba codebase for 13 years. The flaw resides in the handling of WINS Windows Internet Name Service registration packets. When...

FlaskCache_CVE-2021-33026_POC

Pickle Serialization Remote Code Execution - Redis Poisoning PoC Exploit Check redis server up and running redis-cli -h 127.0.0.1 -p 6379 ping redis-cli keys redis-cli get Keyid Start listening netcat at port 10001 : nc -nvlp 10001 Setting environments for Flask Chache python -m venv venvflaskcac...

Havoc-C2-SSRF-to-RCE

Havoc-C2-SSRF-to-RCE This is a modified version of the CVE-2024-41570 SSRF PoC from @chebuya chained with the auth RCE exploit from @hyperreality. This exploit executes code remotely to a target due to multiple vulnerabilities in Havoc C2 Framework...

CVE-2025-55182

RSC Detector - React Server Components Vulnerability Scanner A Python-based security scanner for detecting and exploiting React Server Components RSC vulnerabilities in Next.js applications. This tool performs passive detection, active fingerprinting, and RCE exploitation testing. ⚠️ WARNING : Thi...

CVE-2025-2945

CVE-2025-2945 - pgAdmin4 Authenticated RCE Exploit Author: G0D150NE Version: 2.0.0 CVE: CVE-2025-2945 Severity: Critical CVSS 9.9 📌 Description Exploit for pgAdmin4 Remote Code Execution RCE vulnerability affecting versions 8.10 to 9.1. The vulnerability exists in the /sqleditor/querytool/downloa...

CVE-2026-9198

CVE-2026-9198 Vulnerability cause: IBM Langflow OSS is an open-source software specifically used for building and deploying Agent automation workflows. IBM Langflow OSS from 1.0.0 to 1.10.0 has automatic login enabled by default autologin is true. In this mode, accessing the /api/v1/autologin...

CVE-2024-9264

CVE-2024-9264 Grafana Post-Auth DuckDB SQL Injection RCE, File Read Proof of Concept PoC This PoC demonstrates the exploitation of CVE-2024-9264 using an authenticated user to perform a DuckDB SQL query and read an arbitrary file on the filesystem or execute arbitrary code remotely. Arbitrary cod...

Triage-CVE-2017-0144

Triage: CVE-2017-0144 EternalBlue / SMBv1 — associated with WannaCry spread For this lab, the goal was to triage another well-known real-world vulnerability, this time EternalBlue, the SMBv1 flaw that was famously exploited by the WannaCry ransomware outbreak. Step 1: Open the CVE in NVD I went t...

FTC-Skystone-Dark-Angels-Romania-2020

NOTICE This repository contains the public FTC SDK for the SKYSTONE 2019-2020 competition season. Formerly this software project was hosted here. Teams who are competing in the SKYSTONE Challenge should use this new SKYSTONE repository instead of the older and no longer updated ftcapp repository...

Triage-CVE-2021-26855-ProxyLogon---Microsoft-Exchange-

Triage: CVE-2021-26855 ProxyLogon - Microsoft Exchange For this lab, the goal was to practice triaging a well-known real-world vulnerability the way a security team might: reading the CVE details, understanding the CVSS score, and reasoning through how risky it actually is depending on the...

CVE-2025-5781

FreePBX CVE-2025-57819 Exploit Description This script exploits a vulnerability in FreePBX versions prior to 16.0.26.0 CVE-2025-57819, allowing remote attackers to execute arbitrary PHP code via a SQL injection flaw in the AJAX API endpoint. The exploit creates both a webshell and an auto-trigger...

CVE-2025-59528

CVE-2025-59528: Flowise CustomMCP Remote Code Execution PoC A Go proof of concept for CVE-2025-59528 targeting Flowise versions Example go run main.go http://target.com h3D9jD7Xzi0V2KSrld9ff4P3rm6cuNXg1uA-wFsUYc "touch /tmp/pwned"...

CVE-2021-22893

CVE-2021-22893 Pulse Connect Secure RCE Vulnerability CVE-2021-22893 Shodan : https://www.shodan.io/search?query=http.component%3A%22pulse+secure%22...

PoC-CVE-2022-30190

POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina Info : New Microsoft Office zero-day used in attacks to execute PowerShell Summary On the 29th of May 2022, the NaoSec team, an independent Cyber Security Research Team, discovered a malicious Office document shared on Virustotal. This...