CVE-2018-2628

CVE-2018-2628 A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. Detailed Steps to Reproduce CVE-2018-2628: 0x01 Run the following command on the JRMPListener host: wget https://jitpack.io/com/github/frohoff/ysoserial/master/ysoserial-master.jar java...

azureOutlookC2

Azure Outlook C2 Azure Outlook Comando y Control que utiliza Microsoft Graph API para comunicaciones C2 y exfiltración de datos. Controla de forma remota un dispositivo Windows comprometido desde tu buzón de Outlook. Creadores: Bobby Cooke @0xBoku & Paul Ungur @C5pider Actualización de amenazas C...

CVE-2019-15107-Scanner

Webmin CVE-2019-15107 Vulnerability Scanner A multi-threaded Python scanner to detect Webmin servers vulnerable to CVE-2019-15107 authenticated RCE vulnerability in Webmin versions 1.890 through 1.920. Description This tool scans a list of Webmin servers provided in CSV format and checks for the...

gdog

Gdog A stealthy Python based Windows backdoor that uses Gmail as a command and control server This project was inspired by the gcathttps://github.com/byt3bl33d3r/gcat from byt3bl33d3r. Requirements Python 2.x PyCrypto module WMI module Enum34 module Netifaces module Features Encrypted...

CVE-2025-24893-PoC

CVE-2025-24893 - XWiki Remote Code Execution RCE An updated proof-of-concept PoC exploit for CVE-2025-24893 , a critical unauthenticated RCE vulnerability in XWiki. This version improves on the original by allowing arbitrary shell command execution and clean reverse shell injection. By:...

overkill

Overkill Overkill is an exploit for a patched vulnerability affecting QNAP QTS. Due to the way QNAP discloses vulnerabilities, I'm unsure if this issue has a CVE or not. However, it was likely patched in November 2020 and April 2021. The n-day was "discovered" while doing diff analysis for...

CVE-2025-24813-apache-tomcat

CVE-2025-24813 Nuclei Template CVE-2025–24813 nuclei -l list.txt -t CVE-2025–24813.yaml execute shell http://target.com/updates.jsp?cmd=whoami...

CVE-2022-1388_PoC

F5 BIG-IP RCE exploitation CVE-2022-1388 POST 1: POST /mgmt/tm/util/bash HTTP/1.1 Host: :8443 Authorization: Basic YWRtaW46 Connection: keep-alive, X-F5-Auth-Token X-F5-Auth-Token: 0 "command": "run" , "utilCmdArgs": " -c 'id' " curl commandliner: $ curl -i -s -k -X $'POST' \ -H $'Host: :8443' \ ...

CVE-2024-41570-Havoc-C2-RCE

Havoc-C2-RCE CVE-2024-41570 This is a Chained RCE CVE-2024-41570 in the Havoc C2 framework. Command injection: Havoc is vulnerable to command injection enabling an authenticated user to execute commands on the Teamserver. Affects versions 0.3 up to the latest release 0.6. Havoc's default profile...

CVE-2026-84409

The Lantronix G520 Series Cellular Gateway is vulnerable to a Cross-site Scripting (XSS) flaw in its update mechanism. The device retrieves update metadata over an unencrypted HTTP connection and stores it; a management interface then returns this data in a JSON response, which the web interface ...

ATutor-Instructor-Backup-Arbitrary-File

ATutor - Exploit de copia de seguridad del instructor Título del exploit: ATutor 2.2.4 'Backup' - Ejecución remota de comandos CVE-2019-12170 Google Dork: inurl:/ATutor/login.php Fecha: 5/13/2019 Autor del exploit: liquidsky Joseph McPeters Página oficial del proveedor: https://atutor.github.io/...

spring4shell-CVE-2022-22965

Simple Spring4Shell POC Check if endpoint is vulnerable python spring4shell.py -u http://192.168.110.117:8080/helloworld/greeting --check Exploit vulnerable endpoint python spring4shell.py -u http://192.168.110.117:8080/helloworld/greeting -f shell.jsp --exploit Execute command on uploaded webshe...

CVE-2022-45025

CVE-2022-45025 Command injection via PDF import in Markdown Preview Enhanced VSCode, Atom Description The Mume markdown tool library was vulnerable to command injection due to use of spawn command with shell: true option. This could allow an attacker to achieve arbitary code execution by tricking...

Follina_Exploiter_CLI

Herramienta CLI de explotación Follina Vulnerabilidad MSDT CVE-2022-30190 Una herramienta Python basada en línea de comandos para explotar la vulnerabilidad Zero-Day en MSDT Microsoft Support Diagnostic Tool, también conocida como 'Follina' CVE-2022-30190. Información: Nuevo día cero de Microsoft...

CVE-2026-102937

The virtualenv tool, used for creating isolated Python environments, is vulnerable to command injection on Windows in versions prior to 21.7.12 . The root cause is in BatchActivator.quote() , which fails to properly escape prompt text before activate.bat inserts it into a cmd.exe `set

VcenterKiller

VcenterKiller -1. Atención Compañeros que construyen un entorno de vulnerabilidad localmente, al usar vckiller para verificar log4j, generalmente fallará, porque en el entorno de Vmware con modo NAT, la tarjeta de red de salida en el módulo de verificación se determina como 127.0.0.1, por lo que ...

pwdgenerator

pwdgenerator Customized password dictionary generator Based on bit4woo's passmaker project～ 🙏 Usage, download release Command line: ./pwdgenerator -h Simple usage ./pwdgenerator -d baidu.com -min 6 -max 10 Customized password dictionary generator How to use download release command line:...

CVE-2025-5840

CVE-2025-5840 CVE-2025-5840 Exploit In Python By hax / haxerr9 How To Use: Make sure Python3 is installed at system. Run "python3 CVE-2025-5840.py URL -c COMMAND". Don't forget to give it parameters before running the script. Example Use: NOT TESTED This exploit is not tested in a lab environment...

gitpwnd

GitPwnd GitPwnd is a tool to aid in network penetration tests. GitPwnd allows an attacker to send commands to compromised machines and receive the results back using a git repo as the command and control transport layer. By using git as the communication mechanism, the compromised machines don't...

cdb

Pown CDB Pown CDB is a Chrome Debug Protocol utility. The main goal of the tool is to automate common tasks to help debug web applications from the command-line and actively monitor and intercept HTTP requests and responses. This is particularly useful during penetration tests and other types of...