cve-2022-44268

CVE-2022-44268 Credit to the researchers who discovered this: Bryan Gonzalez and the Ocelot Team Create a malicious PNG to take advantage of ImageMagick 7.1.0-40: CVE-2022-44267: Denial of Service CVE-2022-44268: Information Disclosure Disclaimer: The author of this project is not responsible for...

SpawnWith

SpawnWith An experimental Beacon Object File BOF that provides an alternative to the spawnas and inject commands. This exposes a new command, spawnwith pid listener, that performs the following: 1. Obtain a handle to the target process. 2. Obtain a handle to the process' primary token. 3. Duplica...

CVE-2019-12815

CVE-2019-12815 ProFTPd modcopy - arbitrary file copy without authentication mass scanner...

wp-file-manager

wp-file-manager WP File Manager 6.9 - Arbitrary File Upload leading to RCE usage: wp-file-manager.py -h -u URL -f FILE optional arguments: -h, --help show this help message and exit -u URL, --url URL URL of host to check will need http or https -f FILE, --file FILE File of URLS to check + Testing...

0-click-RCE-Exploit-for-CVE-2024-51793

CVE-2024-51793 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858668072279626138 This repository contains a proof-of-concept exploit for CVE-2024-51793, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress plugin, leading to remote...

Disk-Arbitrator

Introduction Disk Arbitrator is a Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device. Disk Arbitrator is essentially a user interface to the Disk Arbitration framework, which enables a program to participate in the...

CVE-2025-8110

CVE-2025-8110 — Gogs RCE PoC Silentium / HackTheBox Disclaimer: This tool is intended strictly for educational purposes and authorized penetration testing. Only use it against systems you have explicit permission to test. This is a modified version of zAbuQasem/gogs-CVE-2025-8110, adapted to work...

EXPLOIT-CVE-2025-27515

CVE-2025-27515 Proof of Concept A practical demonstration of CVE-2025-27515 , a file upload validation bypass vulnerability in Laravel Framework ≤ 12.0.0. Vulnerability Overview CVE-2025-27515 is a validation bypass that allows attackers to circumvent file upload restrictions when Laravel...

CVE-2025-7340

🚨 HT Contact Form Widget = 2.2.1 - Unauthenticated Arbitrary File Upload CVE-2025-7340 CVE: CVE-2025-7340 CVSS: 9.8 Critical 📝 Description The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file uploads due to...

CVE-2018-20580

CVE-2018-20580 A proof of concept for ReadyAPI 2.5.0/2.6.0 Remote Code Execution with interactions. Intro In December 2018 I found a new vulnerability in the ReadyAPI. It allows an attacker to execute a remote code on the local machine putting in danger the ReadyAPI users including developers,...

WinShareEnum

WinShareEnum Windows Share Enumerator download https://github.com/nccgroup/WinShareEnum/raw/master/Info/WinShareEnum.exe running against a range on my local non-domain network, with a few dummy shares. Please remember this is primarily designed for domain-ed / large networks: options: A few thing...

CVE-2022-22954

CVE-2022-22954 CVE-2022-22954 VMware Workspace ONE Access freemarker SSTI Multiple vulnerability trigger point detection, multi-threaded batch detection, command execution, file writing // Single target vulnerability detection python CVE-2022-22954.py -u https://x.x.x.x // Command execution pytho...

CVE-2026-27971_POC

CVE-2026-27971 — Qwik server$ Unauthenticated RCE PoC !WARNING This repository contains an active remote-code-execution proof of concept. Use it only against systems you own or are explicitly authorized to test. The author assumes no responsibility for unauthorized use or damage. A standalone...

dawgmon

dawgmon - Dawg the Hallway Monitor SUMMARY The name of this tool is based upon an episode season 10, episode 10 of South Park in which Cartman is Dawg the Hallway Monitor patrolling the hallways of his school. It's a tool which helps one to monitor changes which have taken place on a Linux-based...

CVE-2023-24249-PoC

CVE-2023-24249 PoC CVE-2023-24249 is an arbitrary file upload vulnerability in laravel-admin v1.8.19. This proof of concept exploits the vulnerability to upload a web shell. The exploit was written to use against the HackTheBox easy machine Usage. Example python3 CVE-2023-24249.py + Web shell...

CVE-2024-21546

CVE-2024-21546 Python Exploit 🔥 Description This Python exploit script targets a vulnerable Laravel Filemanager created by UniSharp , which allows authenticated users to bypass file restrictions and upload malicious files. This can lead to Remote Code Execution RCE when the uploaded payload is...

CVE-2025-47812-Wing-FTP-Server-7.4.3-Unauthenticated-RCE-PoC

CVE-2025-47812 — Wing FTP Server Unauthenticated remote code execution vulnerability in Wing FTP Server whoami root References CVE-2025-47812 W...

CVE-2025-12399

Alex Reservations: Smart Restaurant Booking = 2.2.3 - Authenticated Admin+ Arbitrary File Upload The WordPress Alex Reservations plugin versions 2.2.3 and prior contains an arbitrary file upload vulnerability that allows authenticated WordPress administrators to upload malicious PHP files to the...

CVE-2018-6574

Code n stuff...

CVE-2020-17519

CVE-2020-17519 Apache Flink RESTful API Arbitrary File Read Apache Flink is a framework and distributed processing engine for stateful computations over unbounded and bounded data streams which developed using Java and Scala. A change introduced in Apache Flink 1.11.0 and released in 1.11.1 and...