SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution

SEOWON INTECH SLC-130 and SLR-120S devices allow remote code execution via the ipAddr parameter to the systemlog.cgi page. id: CVE-2020-17456 info: name: SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution author: gy741,edoardottt severity: critical description: SEOWON INTECH...

Optergy Proton/Enterprise - Unauthenticated RCE via Backdoor Console

Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console. id: CVE-2019-7276 info: name: Optergy Proton/Enterprise - Unauthenticated RCE via Backdoor Console author: daffainfo severity: critical description: | Optergy Proton/Enterprise devices allow Remote Root Cod...

CVE-2026-3395-MaxSite-CMS-Unauthenticated-RCE

CVE‑2026‑3395 — MaxSite CMS Unauthenticated Remote Code Execution Overview Unauthenticated Remote Code Execution RCE vulnerability in MaxSite CMS ≤ 109.1. The flaw arises from weak authorization checks in the MarkItUp editor plugin’s AJAX endpoints, combined with unsafe execution of user‑supplied...

CVE-2018-20250

exp for Extracting Code Execution From Winrar poc by Ridter how to use ? you just need to install python 3.7, and prepare a evil file you want to run, set the values you want, this exp script will generate the evil archive file automatically! 1. set the values you want ... ... The archive filenam...

CVE-2020-27955

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2026-60004

CVE-2026-60004 Gitea diffpatch RCE ★ CVE-2026-60004 Gitea diffpatch Git Hook RCE PoC ★ https://github.com/user-attachments/assets/403a70f4-4ff4-4ab7-b11c-d73d70adaf0b Overview CVE-2026-60004 is a Remote Code Execution RCE vulnerability in Gitea. The diffpatch API applies a supplied patch with git...

CVE-2025-55182-React2Shell-RCE

CVE-2025-55182 - React2Shell Unauthenticated RCE in React Server Components CVE-2025-55182, also known as React2Shell , is a critical unauthenticated Remote Code Execution RCE vulnerability affecting React Server Components packages versions 19.0, 19.1.0, 19.1.1, and 19.2.0. This vulnerability ma...

RCE-Exploit-Framework

RCE-Exploit-Framework This framework is designed to assist penetration testers or developers in understanding the mechanics of remote code execution RCE exploitation. Features Payload Generator : Supports the creation of custom payloads based on Python, Bash, and PHP. Exploit Executor : Delivers...

Exploiting-Stagefright-Vulnerability-CVE-2015-3864

Exploiting-Stagefright-Vulnerability-CVE-2015-3864 Stagefright refers to a set of software flaws in Android versions 2.2 "Froyo" through 5.1.1 "Lollipop," which affected 95% of all Android phones still. If the vulnerability is exploited, an attacker can use remote code execution and privilege...

exploit-CVE-2016-10033

PHPMailer 5.2.18 Remote Code Execution PHPMailer is the world's most popular transport class, with an estimated 9 million users worldwide. Downloads continue at a significant pace daily. Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more PHPMailer...

CVE-2023-38831

CVE-2023-38831 - RARLAB WinRAR Code Execution Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author b1tg and Group-IB Threat Intelligence Description RARLabs WinRAR before 6.23 allows attackers to execute...

Follina

Follina Notes related to CVE-2022-30190 FOLLINA: CVE-2022-30190 1. Uses Microsoft Support Diagnostic Tool MSDT 2. Exploits diagnostic window opened for Diagnosis and when executed properly, gives reverse shell to attacker. 3. Github: a. https://github.com/JohnHammond/msdt-follina b...

CVE-2025-26264

CVE-2025-26264 CVE-2025-26264 - GeoVision GV-ASWeb with the version 6.1.2.0 or less, contains a Remote Code Execution RCE vulnerability within its Notification Settings feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary command...

CVE-2023-46019-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46019-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overvi...

CVE-2026-55200

CVE-2026-55200 - Critical libssh2 Remote Code Execution Vulnerability Critical Pre-Authentication Memory Corruption Vulnerability in libssh2 Overview Field| Detail ---|--- CVE| CVE-2026-55200 CVSS| 9.2 Critical Type| Out-of-Bounds Write Component| libssh2 Affected Versions| = 1.11.1 Attack Vector...

exploit_CVE-2022-26134

exploitCVE-2022-26134 CVE-2022-26134, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. This script can find vulnerable server for CVE-2022-26134 from Shodan Search Engine. Just need to ent...

CVE-2025-55182-PoC

⚡ React2Shell Exploit PoC CVE-2025-66478 Next.js Remote Code Execution RCE via Prototype Pollution in Server Components 🕵️‍♂️ Overview This repository contains a Proof of Concept PoC for CVE-2025-66478 also referenced as CVE-2025-55182 in some contexts, a critical vulnerability affecting Next.js...

CVE-2024-4947-PoC

CVE-2024-4947 — V8 Maglev Type Confusion → Full RCE d8 PoC A complete, self-contained exploitation chain for CVE-2024-4947 V8 Maglev type confusion, from the initial type-confusion trigger all the way to arbitrary code execution. The PoC runs against a non-sandboxed d8 build and prints...

hackcar-writeup

Hackcar - Writeup Platform: DockerLabs Difficulty: Medium more or less, it has its quirks Objective: From webuser to root by breaking a Next.js The start: reconnaissance As always, first things first: see what we're up against. nmap -sC -sV -T4 172.17.0.2 PORT STATE SERVICE VERSION 8080/tcp open...

CVE-2026-96630

Adminer blocks "ATTACH" queries for SQLite to prevent arbitrary file creation. However, "VACUUM INTO" is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to...