CVE-2022-22963

CVE-2022-22963 CVE-2022-22963 PoC Slight modified for English translation and detection of https://github.com/chaosec2021/Spring-cloud-function-SpEL-RCE/blob/main/SpelRCEPOC.py . By default whoami is executed on the target and a file vulnerable.txt is created with the URLs that are vulnerable. Mo...

PoC-CVE-2025-3914-Aeropage-WordPress-File-Upload

CVE-2025-3914 - Arbitrary File Upload in Aeropage Sync for Airtable WordPress Description The Aeropage Sync for Airtable WordPress plugin ≤ v3.2.0 is vulnerable to authenticated arbitrary file uploads due to insufficient file type validation in the aeropagemediadownloader function. Attack Vector ...

CVE-2025-24813-Apache-Tomcat-Partial-PUT-Deserialization-RCE-

CVE-2025-24813 - Apache Tomcat Partial PUT + Deserialization RCE 📋 Overview CVE-2025-24813 is a high‑severity vulnerability in Apache Tomcat that allows unauthenticated remote code execution when three conditions are met: 1. The default servlet has write access enabled readonly=false. 2. Partial...

CVE-2025-7775

CVE-2025-7775 Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway VPN virtual server, ICA Proxy, CVPN, RDP Proxy or AAA virtual server OR NetScaler ADC and NetScaler Gateway 13.1,...

react2shell-CVE-2025-55182-full-rce-script

Next.js React2Shell CVE-2025-55182 Exploit Tool A proof-of-concept tool for demonstrating the critical React2Shell vulnerability CVE-2025-55182 / CVE-2025-66478 on authorized, local testing environments only. ⚠️ CRITICAL WARNING: ACTIVE EXPLOITATION This vulnerability CVSS 10.0 is being actively...

CVE-2025-23061

CVE-2025-23061 - Mongoose Command Injection A proof of concept for the Command Injection vulnerability in Mongoose = 7.0.0 = 8.0.0 8.9.5 CVE-2024-53900 & CVE-2025-23061 Timeline November 7, 2024: Dat Phung identified a critical vulnerability in Mongoose and submitted a security report to Snyk...

CVE-2021-26121

CS-Cart templates.manage Server Side Template Injection Remote Code Execution Vulnerability Found by: Steven Seeley of 360 Vulcan Team Version: = 4.12.x latest Date: 2021-01-08 12:49 CVE: CVE-2021-26121 Disclosure Timeline 2021-01-26 – Sent to CSCart dev team 2021-01-27 – Notification of reciept...

UltraRealy_with_CVE-2019-1040

UltraRelay Updated by Lazaar Sami for the exploit CVE-2019-1040 UltraRelay is a tool for LLMNR poisoning and relaying NTLM credentials. It is based on Responder and impack. I have updated the original version https://github.com/5alt/ultrarelay for the exploit CVE-2019-1040. Dirk-jan Mollema has...

CVE-2025-54794-Hijacking-Claude-AI-with-a-Prompt-Injection-The-Jailbreak-That-Talked-Back

🧠 CVE-2025-54794: Hijacking Claude AI with a Prompt Injection – The Jailbreak That Talked Back By Aditya Bhatt | Offensive Security Specialist | Red Team Operator | VAPT Addict ⚔️ Introduction: When Your AI Can Be Hacked With Words In an era where language models have become the co-pilots of our...

CVE-2024-48990

CVE-2024-48990 introdution This vulnerability takes advantage of the way in which needrestart manages the environment variable, to be more precise, PYTHONPATH can be hijacked by modifying the PYTHONPATH variable to a directory that contains a malicious library, thus executing and gaining access, ...

CVE-2026-12940-Langflow-Unauth-RCE

CVE-2026-12940 — Langflow OSS ≤ 1.10.1 Unauthenticated RCE MCP stdio env-var injection Unauthenticated remote code execution in Langflow OSS through 1.10.1. The environment-variable blocklist that guards MCP stdio server configuration DANGEROUSENVVARS omits SHELLOPTS, BASHOPTS and PS4. Because th...

patriot

Patriot Small research project for detecting various kinds of in-memory stealth techniques. Download the latest release here. The current version supports the following detections: Suspicious CONTEXT structures pointing to VirtualProtect functions. Targets research by Austin Hudson Foliage and Ek...

PHP-CGI-Argument-Injection-Exploit

🎬 This YouTube video 1️⃣ Target Check Determine the Metasploitable IP from Kali: ip a For example: Kali: 192.168.56.101 Metasploitable2: 192.168.56.102 Let's check the port and service: nmap -p 80 192.168.56.102 You can also check in the browser: http://192.168.56.102/ 2️⃣ Start Metasploit...

CVE-2026-3288

CVE-2026-3288: ingress-nginx Configuration Injection via rewrite-target Annotation Keywords: CVE-2026-3288, ingress-nginx vulnerability, Kubernetes security, nginx configuration injection, rewrite-target annotation, RCE, Secret disclosure, CWE-20, CAPEC-176, ingress-nginx CVE 2026, Kubernetes...

CVE-2021-40531

CVE-2021-40531 This proof-of-concept in action. Sketch is a popular UI/UX design app for macOS. This post covers a vulnerability in Sketch that I discovered back in July, CVE-2021-40531. In its simplest form, it is a macOS quarantine bypass, but in context it can be used for remote code execution...

ShimMe

ShimMe Tools from the DEFCON 32 talk "SHIM me what you got - Manipulating Shim and Office for Code Injection" Office Injector - Invokes an RPC method in OfficeClickToRun service that will inject a DLL into a suspended process running as NT AUTHORITY\SYSTEM launched by the task scheduler service,...

CVE-2021-46362

CVE-2021-46362: FreeMarker Server-Side Template Injection in Magnolia CMS A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows unauthenticated attackers to execute arbitrary code via a crafted payload entered into...

ActiveMQ-cve-2026-42588-scanner-gui

ActiveMQ-cve-2026-42588-scanner-gui 【One-click VPS Exploitation Recommended for users with a VPS】 1. Enter the VPS public IP and listening port e.g., 9999 2. Enter the command to execute e.g., touch /tmp/cvepwned 3. Click Generate VPS Command → Click Copy Command 4. SSH into the VPS, paste the...

CVE-2021-41773_CVE-2021-42013

Apache HTTP Server 2.4.49, 2.4.50 - Path Traversal & RCE Exploit Author: Lucas Souza https://ls4ss.github.io/ Vendor Homepage: https://apache.org/ Version: 2.4.49, 2.4.50 Tested on: 2.4.49, 2.4.50 CVE : CVE-2021-41773, CVE-2021-42013 Credits: Ash Daulton and the cPanel Security Team Usage ./PoC.s...

fire-wall-server

🛡️ Spring4Shell Firewall Mitigation Python Script This project simulates a firewall using Python's built-in http.server module to detect and block malicious requests exploiting the Spring4Shell CVE-2022-22965 vulnerability. 🔍 About Spring4Shell is a critical Remote Code Execution RCE vulnerability...