evil-winrm-py

evil-winrm-py evil-winrm-py is a python-based tool for executing commands on remote Windows machines using the WinRM Windows Remote Management protocol. It provides an interactive shell with enhanced features like file upload/download with progress and checksum verification, tab-completion of...

Apache Spark UI - Remote Command Injection

Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilte...

Motorola Baby Monitors - Remote Command Execution

Motorola Baby Monitors contains multiple interface vulnerabilities could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-3577 info: name: Motorola Baby Monitors - Remote Command Execution author: gy741 severity: high...

Flowise < 3.0.1 - Remote Command Execution

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

Variatype.htb-CVE-2025-66034

Hackthebox Season 10 - Variatype This script will get you initial access. First, Install required modules using pip pip3 install -r requirements.txt Usage python3 exploit.py 'id' or python3 exploit.py 'echo BASE64ENCODEDREVSHELL | base64 -d | bash'...

CVE-2021-29003

CVE-2021-29003 https://hackerworld.home.blog/2021/03/19/rce-in-genexis-router/ Exploit db https://www.exploit-db.com/exploits/49764 medium https://sharmajijvs.medium.com/how-i-got-my-first-cve-af2c3009e409 Unit 42 palo alto networks...

CVE-2022-1388

CVE-2022-1388 https://support.f5.com/csp/article/K23605346 This vulnerability may allow an unauthenticated attacker to gain network access to BIG-IP systems through the management port and/or their own IP addresses to execute arbitrary system commands, create or delete files, or disable services...

Struts2-045-Exp

Struts2 S2-045 CVE-2017-5638 Exp Tools Exp Function: Command Execute Get Target Website's Physical Path File Upload Getshell Default Webshell For Chopper Support HTTP/HTTPS Support URL With Any Port Note: Default Webshell's Password is s2045@exp Notice The Project Is Intended For...

OpenSMTPD-CVE-2020-7247-

OpenSMTPD Remote Command Execution Vulnerability CVE-2020-7247 WHS 4th Park Solmin Original link: https://github.com/vulhub/vulhub/blob/43eae7170d09e7748c3aac64cd6a8e5af508a8ef/opensmtpd/CVE-2020-7247/README.md Overview OpenSMTPD is an SMTP server program used on Unix-like operating systems. It c...

CVE-2022-26134_conFLU

CVE-2022-26134 - conFLU PoC for exploiting CVE-2022-26134 on Atlassian Confluence Exploit Usage python3 conFLU.py -h Usage: conFLU.py -h -u URL -f F -cmd CMD optional arguments: -h, --help show this help message and exit -u URL, --url URL target url -f F, --file F url file -c CMD, --command CMD...

CVE-2011-1571

CVE-2011-1571 Summary Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition CE 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors. CVE Detail :...

wp2shell

wp2shell Pre-authentication remote code execution for WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Chains CVE-2026-63030 batch route confusion SQLi with CVE-2026-60137 customizer changeset re-entry to achieve unauthenticated administrator creation and OS command execution. No password cracking required...

CVE-2026-16723

CVE-2026-16723 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments...

Malicious code in hardhat-ftp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e916c23a0efbd49d3cfcd5993957df7afbade3f454925d0672acc8c9f68245c The package's declared main entry index.js unconditionally requires./lib/config, a 4,499,968-byte obfuscator.io-packed file 26,234-entry string array...

CVE-2025-54068

CVE-2025-54068 A tool designed to exploit CVE-2025-54068 and Remote Command Execution if the APPKEY of the Livewire project is known. This tool is a recoded version of the original project by Synacktiv : Livepyre — https://github.com/synacktiv/Livepyre The core concept and methodology are based o...

Malicious code in botmaker-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86fdc86c67d202ca9938942ef7786534d1b72169187cce13b1cefd8899fa54aa On npm install, postinstall.js collects the installer's hostname, username, current working directory, architecture, platform, and network interface...

CVE-2025-55182

CVE-2025-55182 Vulnerability Detection and Exploitation Tool Project Introduction This tool is a GUI tool developed based on Java Swing, used for detecting and exploiting the CVE-2025-55182 vulnerability. This vulnerability is a security flaw in the Next.js framework that allows attackers to...

CVE-2024-29375

CSV-Injection-PoC CSV Injection in Addactis IBNRS 3.10.3.107 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L CVSS: 7.1, Impact Score: 5.3, Exploitation Score: 1.3 Affected Components: Project Description, Identifiers, Custom Triangle Name inside Input Triangles and Yield Curve Name parameters Screenshot 1:...

CVE-2026-39987_RCE_PoC

CVE-2026-39987 — Marimo WebSocket RCE PoC Proof of Concept for CVE-2026-39987 , demonstrating remote command execution through the vulnerable WebSocket terminal endpoint. Disclaimer: This PoC is intended for authorized security testing and educational use only. Use it only against systems you own...

CVE-2021-21300

CVE-2021-21300 In multiple versions of git, the handling of symbolic links is not strict. After uploading files to git on a case-sensitive file system e.g., Linux, cloning a malicious repository on a host using a case-insensitive file system e.g., Windows may lead to remote command execution...