CVE-2026-22356

CVE-2026-22356: Jetpack CRM Path Traversal Vulnerability and RCE Warning: This tool should only be used in authorized test environments. The user is solely responsible for illegal use. 📥 Requirements pip3 install requests urllib3 $ python3 exploit.py https://example.com --rce --cmd "id" + Target ...

CVE-2024-4358_Mass_Exploit

CVE-2024-4358MassExploit Modified tools from @sinsinology to do mass exploit. Requirements Python 3.x Installation git clone https://github.com/Sk1dr0wz/CVE-2024-4358MassExploit.git cd CVE-2024-4358MassExploit pip intstall -r requirements.txt How To Run usage: python CVE-2024-4358.py --target-fil...

log4j-CVE-2021-44228

Apache Log4j Zero Day aka Log4Shell aka CVE-2021-44228 Introduction Reproducing the problem in k8s env Setting up k8s env with the vulnerability Possible Solutions KubeArmor Security Policy Not allowing any execs from the JVM/Java Default Deny based rules KubeArmor Visibility/Observability into t...

Langflow-CVE-2025-3248-Multi-target

⚠️ Langflow RCE Exploit Scanner CVE-2025-3248 This Python-based scanner automates the detection of unauthenticated Remote Code Execution RCE vulnerabilities in Langflow instances via CVE-2025-3248. It uses a proof-of-concept payload that abuses the /api/v1/validate/code endpoint to execute...

CVE-2019-11932-whatsApp-exploit

CVE-2019-11932-whatsap-exploit The address of system and the gadget must be replaced by the actual address found by an information disclosure vulnerability. After replacing address of system and gadget. Run the code to generate the corrupted GIF file: now lets do it...

WhatsRCE

WhatsRCE This is a Automated Generate Payload for CVE-2019-11932 WhatsApp Remote Code Execution 1. Auto install GCC no harm command, you can see this is open-source 2. Saving to .GIF file How To Use ? sudo apt install git git clone https://github.com/KeepWannabe/WhatsRCE cd WhatsRCE && bash...

SNOWCRASH

SNOWCRASH A polyglot payload generator Introduction SNOWCRASH creates a script that can be launched on both Linux and Windows machines. Payload selected by the user in this case combined Bash and Powershell code is embedded into a single polyglot template, which is platform-agnostic. There are fe...

CVE-2024-43468

Microsoft Configuration Manager ConfigMgr / SCCM 2403 Unauthenticated SQL injections CVE-2024-43468 exploit This script exploits the CVE-2024-43468 that allows an unauthenticated attacker, with network access to a Management Point, to execute arbitrary SQL queries on the site database. As queries...

CVE-2025-4190

CVE-2025-4190 — WordPress CSV Mass Importer ≤ 1.2 Arbitrary File Upload -purple 📌 Description The CSV Mass Importer plugin ≤ 1.2 for WordPress contains an Admin+ Arbitrary File Upload vulnerability. Due to improper validation of uploaded files, high-privilege users such as admin can upload...

frigate

Frigate NVR™ - Realtime Object Detection for IP Cameras English | 简体中文 A complete and local NVR designed for Home Assistant with AI object detection. Uses OpenCV and Tensorflow to perform realtime object detection locally for IP cameras. Use of a GPU or AI accelerator is highly recommended. AI...

CVE-2020-14008

CVE-2020-14008 - ManageEngine Applications Manager RCE Authenticated Remote Code Execution via Arbitrary File Upload in Zoho ManageEngine Applications Manager versions Examples Basic python3 cve-2020-14008.py https://192.168.100.2:8443 admin admin 192.168.100.3 1337 Exploit Flow 1. Login -...

Project-CVE-2025-54068

Livewire2025CVE Livewire CVE-2025-54068 Scanner Automated vulnerability scanner for detecting CVE-2025-54068 in Laravel applications using Livewire v3.0.0-beta.1 through v3.6.3. Overview This tool scans a list of websites for indicators of the critical Livewire remote code execution vulnerability...

CVE-2018-8174

CVE-2018-8174 MS Word MS WordPad via IE VBS Engine RCE MS Word and MS WordPad RCE via IE VBS RCE https://github.com/smgorelik/Windows-RCE-exploits/tree/master/Web/VBScript Save the index.html to webserver then use the python script to generate RTF Exploit Shellcode is static Down\Exec Putty.exe...

CVE-2020-14883

CVE-2020-14883 Oracle WebLogic Server Authenticated Remote Code Execution RCE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily...

CVE-2022-22965_PoC

Spring Framework RCE exploitation Quick pentest notes Step 1: Find some endpoint in your target where is accepted POST/PUT methods + encode your payload URL encode POST /path/upload HTTP/1.1 Host: Origin: Cookie: JSESSIONID=BE65B534335A5A2538624404C063B70C; Content-Type:...

CVE-2019-17564

CVE-2019-17564: Apache Dubbo Deserialization Vulnerability 0x00 Introduction Apache Dubbo is a high-performance, lightweight open-source Java RPC framework. It provides three core capabilities: interface-based remote method invocation, intelligent fault tolerance and load balancing, and automatic...

struts-s2-052-deserialization-rce-lab

Apache Struts S2-052 XML Deserialization RCE This repository demonstrates exploitation of Apache Struts S2-052 CVE-2017-9805 using malicious XML deserialization. The exploit was developed while solving the INE eWPTX Practice Range – Struts XML Deserialization RCE lab. Vulnerability Overview Apach...

CVE-2022-22963

CVE-2022-22963 CVE-2022-22963 PoC Slight modified for English translation and detection of https://github.com/chaosec2021/Spring-cloud-function-SpEL-RCE/blob/main/SpelRCEPOC.py . By default whoami is executed on the target and a file vulnerable.txt is created with the URLs that are vulnerable...

cve-2026-67363-67364

Balbooa Forms pre-auth RCE + Payment Tampering CVE-2026-67364 / CVE-2026-67363 PoC and detection templates for two pre-auth vulnerabilities in Balbooa Forms combaforms for Joomla, fixed in 2.4.3.2. CVE-2026-67364 — Pre-auth PHP Code Injection - RCE CVSS 9.8 CVE-2026-67363 — Pre-auth Payment Amoun...

lab-cve-2025-57819

Work in Progress FreePBX CVE-2025-57819 Lab - Unauth SQLi → RCE Chain Nuclei POC Spin up a reproducible FreePBX 15 lab Docker to validate CVE-2025-57819 — a critical unauthenticated SQL injection in userman AJAX endpoints that can be chained to RCE. Includes a working Nuclei template...