CVE-2026-55040

CVE-2026-55040 Exploit code for CVE-2026-55040, it can create auth header for any validate account. Details at: https://blog.viettelcybersecurity.com/sharepoint-cve-2026-55040/...

POC-CVE-2025-55182

CVE-2025-55182 - React RSC RCE PoC for the deserialization vulnerability in the Flight protocol of React Server Components. What is it? Next.js 14+ and React 19 use a proprietary protocol "Flight" to communicate between client and server. The problem: the server loads any module without...

Erlang-OTP-SSH-CVE-2025-32433

✅ Result The server responded to an SSH message ID 80 0x50 — which is reserved for post-auth. This proves the server accepts invalid messages during the pre-auth phase, indicating vulnerable behavior as defined in CVE-2025-32433. 📖 Research Summary I built this lab after studying Erlang/OTP and t...

CIMCown

CIMCown CVE-2026-20200 Argument Injection in Cisco IMC with RCE Christoph Peil @ NSIDE ATTACK LOGIC 2026 CVE: CVE-2026-20200 CVSS v3.1 CISCO: 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 NSIDE: 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Advisory: NSIDE-SA-2026-003 Blogpost:...

Commvault-CVE-2025-34028

CVE-2025-34028 Commvault Remote Code Execution CVE-2025-34028 NSE How to run in Nmap: nmap -p443 --script CVE-2025-34028 --script-args='https-ports=443'...

CVE-2019-9766

CVE-2019-9766 Exploiting the buffer overflow vulnerability in Free MP3 CD Ripper version 2.6, by constructing a specially crafted MP3 file, when the attacker uses the player to play the audio file, the audio file bait exploits the buffer overflow vulnerability to execute arbitrary code...

Blackash-CVE-2025-61757

🚨 CVE-2025-61757 — Pre-Auth RCE Alert 🚨 🧩 Summary ID: CVE-2025-61757 Product: Oracle Identity Manager Oracle Fusion Middleware Component: REST WebServices Affected Versions: 12.2.1.4.0 & 14.1.2.1.0 Severity: 🔴 Critical — 9.8 CVSS 3.1 Published: Oct 21, 2025 Type: Missing Authentication for Critic...

PoC---CVE-2023-26482-RCE-LAB-Nextcloud

Next cloud Proof of Concept & Analysis Security Notice This repository reproduces a publicly disclosed and patched vulnerability in a controlled Docker lab environment for educational and research purposes. The environment is intentionally vulnerable and must only be deployed in isolated test...

drupalgeddon2-CVE-2018-7600

Drupal - Drupalgeddon2 CVE 2018-7600 $ python3 drupalgeddon.py -h + drupalgeddon2 CVE-2018-7600 exploit by Rafael Caria usage: drupalgeddon.py -h --url URL --command COMMAND --function FUNCTION --test --proxy PROXY ! This script exploits CVE-2018-7600 a Drupal property injection in the Forms API...

CVE-2025-57819

CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE Unauthenticated stacked SQL injection in the FreePBX Endpoint Manager module admin/ajax.php, brand parameter, CVE-2025-57819, affecting FreePBX framework --vhost --root --cmd How it works 1. Confirm the SQL injectio...

CVE-2026-64638-PoC-Exploit

CVE‑2026‑64638 – WordPress XSS2Shell Security Suite ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer Misuse Act...

CVE-2021-21972

CVE-2021-21972 checker VMware vCenter Server CVE-2021-21972 Remote Code Execution Vulnerability This script looks the existence of CVE-2021-21972 based on the following PATH "/ui/vropspluginui/rest/services/uploadova" trough a POST request and looking in response body 500 the words...

CVE-2025-1974

CVE-2025-1974 — IngressNightmare ingress-nginx Introduction This document presents a study of the vulnerability CVE-2025-1974 affecting the ingress-nginx component validating admission controller for Kubernetes. CVE-2025-1974 is a critical vulnerability CVSS 3.1 9.8, an unauthenticated Remote Cod...

CVE-2022-22947-Rce_POC

CVE-2022-22947-RcePOC Batch URL detection of Spring Cloud Gateway CVE-2022-22947 Usage py Spring-Cloud-Gateway.py UrlsPath After execution, a gateway.log file is generated, where '+', '-', '' indicate 'vulnerable', 'not vulnerable', and 'request error' respectively...

CVE-2021-22893

CVE-2021-22893 Proof-of-Concept PoC script to exploit Pulse Secure CVE-2021-22893. Usage Achieves RCE on Pulse Secure VPNs chmod +x exploit.sh ./exploit.sh 10.0.0.1 ./exploit.sh -l ./exploit.sh -l IPList.txt...

CVE-2017-12617

CVE-2017-12617 CVE-2017-12617 critical Remote Code Execution RCE vulnerability discovered in Apache Tomcat affect systems with HTTP PUTs enabled via setting the "read-only" initialization parameter of the Default servlet to "false" are affected. Tomcat versions before 9.0.1 Beta, 8.5.23, 8.0.47 a...

CVE-2026-42533-POC

CVE-2026-42533 Pre-auth heap buffer overflow and heap information leak in nginx, caused by missing save/restore of PCRE capture state across the two passes of the script engine. A regex map variable evaluated between two capture references overwrites r-captures, so the LEN pass and the VALUE pass...

Peyara-FileUpload

Exploit Title: Peyara Remote Mouse v1.0.1 Unauthenticated Arbitrary File Upload Date: 2025-01-06 Exploit Author: tmrswrr Software Link: https://peyara-remote-mouse.vercel.app/ Platform: Windows Version: v1.0.1 Tested on: Windows 10 USAGE : python3 combinedscript.py Create Malicious LNK File...

CVE-2023-50564

CVE-2023-50564 📌 Description This exploit allows an authenticated admin in Pluck CMS v4.7.18 to upload a malicious ZIP module containing a PHP shell, resulting in remote code execution RCE. ⚙️ Features Authenticates to the target using a valid username and password Automatically creates a ZIP...

CVE-2025-59528-PoC

CVE-2025-59528 PoC Proof of Concept for researching CVE-2025-59528 in an isolated laboratory environment. !WARNING DISCLAIMER This project is intended strictly for educational purposes, security research, and testing systems that you own or have explicit authorization to test. Do not use this PoC...