metasploitable-pentest-lab

Exploitation of vulnerabilities in Metasploitable Complete cycle of a real attack on a controlled and isolated environment: lab preparation, reconnaissance with nmap, attack surface prioritization, mapping to CVE, exploitation with Metasploit, post-exploitation, credential extraction and cracking...

CVE-2025-64512

CVE-2025-64512 – pdfminer.six Deserialization PoC Overview This proof-of-concept demonstrates a vulnerability in pdfminer.six CVE-2025-64512 that can lead to arbitrary command execution when a malicious PDF is processed. The exploit uses a crafted PDF that references a malicious, gzip-compressed...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

EUVD-2026-91651

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970

GitLab has remediated a critical vulnerability in the GitLab AI Gateway component (CWE-1336) affecting versions 18.1.6 before 19.2.4 , 19.3 before 19.3.2 , and 19.4 before 19.4.1 . An authenticated user with Duo Agent Platform access could exploit a template engine weakness to escape the prompt t...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2019-9194-elFinder-Command-Injection-PoC

CVE-2019-9194 — elFinder Command Injection PoC Command injection vulnerability in elFinder = 2.1.47 via the PHP connector component. Allows unauthenticated remote code execution as the web server user. How it works Uploads a valid JPEG with a malicious filename containing a shell command. Trigger...

Exploit for Argument Injection in Thecodingmachine Gotenberg

CVE-2026-40281 Gotenberg --- 📖 Table of...

cve-2026-61732-lab

CVE-2026-61732 — Decepticon ChatML role-boundary forgery lab A self-contained, disposable lab that reproduces GHSA-g5f9-3xfg-p9mf / CVE-2026-61732: Decepticon , an autonomous red-team agent, wrapped web-crawl output into LLM messages without neutralizing ChatML special-token literals. On a...

VectorFreed

VectorFreed Abstract This document introduces "VectorFreed", a vulnerability chain that begins with a use-after-free I @rafabd1 found in librsvg CVE-2026-96889. In a Node.js/Sharp/libvips build, this bug led to command execution. It covers the bug, the paths confirmed in applications so far, and...

log4j-shell-poc

log4shell-poc CVE-2021-44228 Proof-of-concept exploit for the Log4j vulnerability CVE-2021-44228, also known as Log4Shell. This tool generates a malicious Java class, starts an LDAP referral server, and serves the payload over HTTP, allowing a remote attacker to execute arbitrary commands on a...

CVE-2026-63077

Overview • Visual Flow • Requirements • Usage • Limitations • Mitigation !CAUTION This PoC executes an operating-system command and can modify the TeamCity application directory. Use it only in an isolated lab or against systems for which you have explicit written authorization. ⚡ Overview...

HikvisionExploiter_fixed

HikvisionExploiter Educational security tool for testing unsecured Hikvision exposures and checking CVE-2021-36260 in authorized environments. ⚠️ Legal and Ethical Warning This project should be used only on systems you own or have explicit permission to test. Scanning/exploitation without...

CVE-2020-12641

CVE-2020-12641: Command Injection via “imconvertpath” Parameter in Roundcube Webmail A Command Injection vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. Because the "imconvertpath" does not perform sanitization/input filtering, an attacker with access to the Roundcube...

cacti-rce-snmp-options-vulnerable-application

Уязвимое приложение Cacti v1.2.24 с аутентифицированным внедрением команд CVE-2023-39362 Это уязвимое приложение для проверки эксплойта для уязвимости Cacti CVE-2023-39362. ПРЕДУПРЕЖДЕНИЕ! Это приложение содержит серьезные уязвимости безопасности. Запускайте его на свой страх и риск! Рекомендуетс...

cacti-rce-snmp-options-vulnerable-application

Cacti v1.2.24 authenticated command injection CVE-2023-39362 vulnerable application This is a vulnerable application to test the exploit for the Cacti vulnerability CVE-2023-39362. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is recommended usin...

CVE-2025-58098

CVE-2025-58098 exec cmd=... directive CVE-2025-58098 argument injection Lab docker build -t cve-2025-58098-lab . docker run -it -p 8080:80 cve-2025-58098-lab Vulnerable Patched...

CVE-2026-97876

A flaw was found in GRUB2. The bootloader insufficiently validates memory addresses passed to the serial configuration command, allowing arbitrary system memory to be targeted instead of a legitimate serial communication device. A local attacker with control over GRUB's boot configuration can...

DEBIAN-CVE-2026-97876

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...