CVE-2026-21643

CVE-2026-21643 Checker & Nuclei Template This repository contains detection tools for CVE-2026-21643 , a pre-authentication SQL Injection vulnerability in FortiClient EMS 7.4.4. The vulnerability exists in the /api/v1/initconsts and /api/v1/auth/signin endpoints, where the Site HTTP header is...

CVE-2012-2982-Exploit-Script

CVE-2012-2982-Exploit-Script A short and sweet simple exploit script for the CVE-2012-2982 Authenticated RCE vulnerability in the /file/show.cgi/bin endpoint. Webmin RCE Exploit — CVE-2012-2982 This repository contains a Python proof-of-concept exploit for Webmin 🧠 Notes Payload defaults to a bas...

CVE-2023-25157

CVE-2023-25157 - GeoServer SQL Injection - PoC CVE: CVE-2023-25157 Date: 06/06/2023 Vendor/Software: GeoServer Severity: 9.8/10 - This script is a proof of concept for OGC Filter SQL Injection vulnerabilities in GeoServer, a popular open-source software server for sharing geospatial data. It send...

CVE-2025-68613-n8n-rce-analysis

Matrix GIF...

CVE-2026-29954

KubePlus ResourceComposition ChartURL SSRF + Header Injection This vulnerability exists in the ResourceComposition resource handling component of KubePlus, allowing an attacker with Provider privileges to access internal services via SSRF by crafting a malicious chartURL parameter, and inject...

CVE-2023-49052

CVE-2023-49052 - Microweber CMS v2.0.4 - Uploading Malicious Files Description In version 2.0.4 of Microweber CMS where the file upload option is active in created forms, it is possible to send malicious HTML files, even when certain types of validations are applied in this field. This...

CVE-2026-24061-POC

CVE-2026-24061 Vulnerable Lab ⚠️ WARNING : Intentionally vulnerable environment. Do NOT expose to untrusted networks. Overview Vulnerable GNU InetUtils telnetd v2.5 for testing CVE-2026-24061 - authentication bypass via argument injection. Quick Start Build sudo docker compose up -d Test...

CVE-2025-1974

DEMO https://youtu.be/3hYlHeaf2mQ What is CVE-2025-1974? CVE-2025-1974 IngressNightmare is a critical CVSS 9.8 unauthenticated Remote Code Execution vulnerability in the Kubernetes ingress-nginx admission controller. Attack Flow: 1. Upload : Send malicious shared library .so file to NGINX via HTT...

CVE-2023-49313

CVE-2023-49313 A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unauthorized code can be injected into the product's processes, potentially leading to remote control and unauthorized access to sensitive user data. Portable version...

CVE-2023-41507

CVE-2023-41507 CVE-2023-41507 - Super Store Finder v3.6 was discovered to contain multiple SQL injection vulnerabilities in the store locator component via the products, distance, lat, and lng parameters. Vulnerability Type SQL Injection Vendor of Product Super Store Finder Affected Product Code...

CVE-2024-25600

MODIFIED CVE-2024-25600 original - https://github.com/K3ysTr0K3R/CVE-2024-25600-EXPLOIT WordPress Bricks Builder RCE Exploit A Python exploit for CVE-2024-25600 - WordPress Bricks Builder Remote Code Execution vulnerability. Description This tool exploits a critical vulnerability in WordPress...

ez-iRZ

ez-iRZ Exploit for CVE-2022-27226 Cross Site Request Forgery to Remote Code Execution in iRZ Mobile Routers Credits John Jackson Chris Mack --- https://github.com/0xHalcyon Stephen Chavez --- https://github.com/redragonx/ Robert Willis Description A CSRF issue on iRZ Mobile Routers through...

CVE-2021-44529

CVE-2021-44529 A code injection vulnerability in CVE-2021-44529 Ivanti EPM Cloud Services Appliance CSA allows unauthenticated users to execute arbitrary code with limited privileges nobody...

CVE-2024-22274-RCE

Privilege Escalation: VMware vCenter Server Authenticated RCE 📜 Description The “com.vmware.appliance.recovery.backup.job.create” and the “com.vmware.appliance.recovery.backup.validate” API components are vulnerable to a flag injection attack that can be leveraged to execute arbitrary commands as...

LdrShuffle

LdrShuffle Stealthy code execution via modification of the EntryPoint of loaded modules at runtime. Summary Windows processses have various modules loaded at runtime. Each of theses modules has a DllMain function defined, which will be invoked on process or thread creation/destruction four possib...

CVE-2024-4577

Just for researching Poc For Default XAMPP curl -v -d "" http://127.0.0.1/php-cgi/php-cgi.exe/?%add+allowurlinclude%3Don+-d+autoprependfile%3Dphp%3A//input+-d+cgi.forceredirect%3D0...

BotCon

BotCon Attlasian Confluence Un-Authenticated Remote Code Execution via OGNL Injection CVE-2022-26134 On June 02, 2022 Atlassian released a security advisory for their Confluence Server and Data Center applications, highlighting a critical severity unauthenticated remote code execution...

wp2shell

wp2shell Exploit WordPress REST API route confusion CVE-2026-63030 + SQL injection CVE-2026-60137 in the batch endpoint to achieve Remote Code Execution. Vulnerabilities Route Confusion CVE-2026-63030 The WordPress REST API batch endpoint /batch/v1 does not properly isolate request routing. By...

Cups-RCE-Exploit

CUPS RCE Exploit - CVE-2024-47176 Chain What It Is A fully functional proof-of-concept exploit targeting the CUPS Common Unix Printing System remote code execution vulnerability chain discovered in September 2024. This chain consists of four CVEs — CVE-2024-47176, CVE-2024-47076, CVE-2024-47175,...

CVE-2022-40684

CVE-2022-40684 by 1vere$k For now it's a POC copy for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager appliances. Coppied from https://github.com/horizon3ai/CVE-2022-40684 Analysis The exploit uses the simple payload: PUT /api/v2/cmdb/system/admin/admin HTTP/1.1 Host...