jinjava-cve-2026-25526-poc

Step-by-step exploit all 9 steps: mvn exec:java -Dexec.mainClass=ExploitHarness -q 2. Final exploit chains file creation, file read, info disclosure: mvn exec:java -Dexec.mainClass=ExploitFinal -q 3. File content exfiltration reads /etc/passwd, /etc/hosts: mvn exec:java...

CVE-2025-54100

CVE-2025-54100 – PowerShell Response Parsing PoC A concise Proof-of-Concept showing how CVE-2025-54100 can lead to Remote Code Execution RCE in Windows PowerShell 5.1 through malicious HTML parsing. Table of Contents What is CVE-2025-54100? How the PoC Works Quick Start Triggering From a Victim...

cpsniper

cPanelSniper CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection 4-stage exploit chain · Interactive WHM Shell · TRUE STABLE for 10M+ targets · Zero memory usage · stdlib only Overview cPanelSniper is a focused exploitation framework for CVE-2026-41940 , a critical...

CVE-2023-20052

CVE-2023-20052 CVE-2023-20052, information leak vulnerability in the DMG file parser of ClamAV Usage To create malicious DMG file git clone https://github.com/nokn0wthing/CVE-2023-20052.git cd CVE-2023-20052 sudo docker build -t cve-2023-20052 . sudo docker run -v $pwd:/exploit -it cve-2023-20052...

bassmaster-rce

bassmaster-rce Exploiting CVE-2014-7205 by injecting arbitrary JavaScript resulting in Remote Code Execution. I stumbled across this Post by LuuPhu written in viatnamese. Since I have written some code in NodeJS but never came across exploiting it, I figured why not today? The Python PoC includes...

CVE-2025-24893

Exploit for CVE-2025-24893 CVE-2025-24893 is a critical unauthenticated remote code execution RCE vulnerability affecting the XWiki Platform. This flaw lets any guest user inject and execute arbitrary Groovy code —without authentication—via a specially crafted RSS request to the SolrSearch...

CVE-2020-15778

CVE-2020-15778 Introduction This repo reproduces CVE-2020-15778. Steps 1. Build the docker images for scp server and client cd client docker build -t client-cve . cd server docker build -t server-cve . 2. Spin up the scp server in container. docker run -d -P --name scp-server server-cve Retrieve...

LLMMap

LLMMap LLMMap is an automated prompt injection testing framework for LLM-integrated applications. It discovers injection points in HTTP requests, generates targeted attack prompts using a dual-LLM architecture, fires them at the target, and confirms findings with statistical reliability testing...

anamorpher

Anamorpher Anamorpher named after anamorphosis is a tool for crafting and visualizing image scaling attacks against multi-modal AI systems. It provides a frontend interface and Python API for generating images that only reveal multi-modal prompt injections when downscaled. Refer to "Weaponizing...

CVE-2026-1731

CVE-2026-1731 BeyondTrust Remote Support Pre-Auth RCE PoC !WARNING This script is intended for educational and research purposes only. Do not use it against systems without explicit permission. Unauthorized access or testing is illegal and unethical. Read the full DISCLAIMER before using this...

CVE-2026-2256-PoC

CVE-2026–2256 PoC Executive Summary A critical command injection vulnerability CVE-2026–2256, CVSS X.X was identified in the Shell tool component of the MS-Agent framework version 1.5.2. The vulnerability arises from improper sanitization of user-influenced input that is passed directly to a shel...

CVE-2021-44228

CVE-2021-44228-POC Yet another CVE-2021-44228 POC Affected Log4j versions: from 2.0-beta9 up to 2.14.1 Prerequisites Used Java: OpenJDK 11 https://jdk.java.net/archive/ Maven required to build apps in this repo alternatively, download prepared jar files from release: https://maven.apache.org/...

how-to-check-patch-secure-log4j-CVE-2021-44228

How-to-check-log4j-CVE-2021-44228 What is log4j ? LOG4J is a open-source Java-based Apache Software used for logging services. What is log4j Vulnerability CVE-2021-44228 ? The Log4j vulnerability allows remote code execution by simply typing a specific string into a textbox , works on every progr...

CVE-2020-2034-POC

CVE-2020-2034-POC Determine the Version Running on the Palo Alto Network Firewall for the Global Protect Portal Recently a lot of critical vulnerabilities were announced by Palo Alto Networks here: https://security.paloaltonetworks.com/?severity=CRITICAL&product=PAN-OS&sort=-date This is a PoC to...

CVE-2026-1281-Ivanti-EPMM-RCE

CVE-2026-1281 & CVE-2026-1340 - Ivanti EPMM Pre-Auth RCE ⚠️ DISCLAIMER: This PoC is provided solely for educational and security research purposes. Unauthorized use is illegal. 🎯 Description Complete Proof of Concept PoC for exploiting the CVE-2026-1281 and CVE-2026-1340 vulnerabilities affecting...

CVE-2026-2413-POC

CVE-2026-2413-POC The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the getglobalremediations method, where it is...

CVE-2026-21858

CVE-2026-21858 + CVE-2025-68613 - n8n Full Chain Unauthenticated Arbitrary File Read → Admin Token Forge → Sandbox Bypass → RCE Full unauthenticated RCE chain on n8n: 1. CVE-2026-21858 - Content-Type confusion → Arbitrary File Read 2. Read config + database → forge admin JWT 3. CVE-2025-68613 -...

CVE-2022-21661

CVE-2022-21661 CVE-2022-21661 docker and poc functions.php needs to replace the original functions.php in the image, and mount it directly in docker-compose.yml poc POST /wp-admin/admin-ajax.php HTTP/1.1 Host: your-ip:8080 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:132.0 Gecko/201001...

CVE-2025-52688

CVE-2025-52688 Affected Products Alcatel AP13161 - Enterprise WIFI access point Summary There are 2 main vulnerabilities being addressed here: Lack of input sanization on multiple JSON web parameters that allows malicious characters such as ; to be injected to caused a command injection attack La...

CVE-2026-33980

CVE-2026-33980 — KQL Injection in adx-mcp-server via tablename parameter Severity : High CVSS 8.3 CWE : CWE-943 — Improper Neutralization of Special Elements in Data Query Logic Affected : adx-mcp-server = 1.1.0 Advisory : GHSA-vphc-468g-8rfp NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-33980...