ibm-sterling-b2b-integrator-poc

IBM Sterling B2B Integrator PoC Proof of concept code for the exploitation of the vulnerabilities discovered against IBM Sterling B2B Integrator, versions 6.2.0.0 to 6.2.0.2, and 6.0.0.0 to 6.1.2.5 for Linux, Windows and AIX systems: LPE Command Injection - if authentication is disabled Pre-auth...

Log4J-Simulation-Tool

About The Project This is a specially crafted automated Vulnerability Scanner, Patch Management and Exploitation tool for CVE-2021-44228. This is a combination of Python, Java and Linux shell program which will make it easier for a Network Administrator, Endpoint Security Developers and...

CVE-2024-9441

CVE-2024-9441 Description of the Vulnerability: This code exploits a Remote Code Execution RCE vulnerability that occurs due to improper input sanitization in a PHP-based web application. The specific weakness is in the "forgot password" functionality index.php?c=user&m=forgotpassword, where user...

Confluence-CVE-2022-26134

Confluence-CVE-2022-26134 Description Confluence unauthorize remote code execution vulnerability : CVE-2022-26134 Confluence is a web-based corporate wiki developed by Australian software company Atlassian. On June 02, 2022 Atlassian released a security advisory for their Confluence Server and Da...

cve-2020-24616-poc

cve-2020-24616-poc cve-2020-24616 poc The first poc written by a Java rookie Referenced many JNDI injection Pocs...

CVE-2026-115806 Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...

CVE-2026-115806

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 2.2.1 . The flaw exists in the recursiveUnserializeReplace() routine within the migration search-and-replace functionality. An unauthenticated attacker can inject ...

EUVD-2026-109213

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...

Log4Shell-Vulnerability-Replication

CVE-2021-44228 Log4Shell Vulnerability Complete Replication Record This record is based on the Apache Solr 8.11.0 target environment provided by Vulhub, fully replicating the Log4j2 JNDI injection vulnerability, and successfully verifying the vulnerability's existence through DNSLog and local LDA...

react2shellpoc

This repository contains a proof‑of‑concept demonstrating how a specific class of React Server Component vulnerabilities behaves inside a controlled, legal training environment. Manual ┌──kali㉿kali-/Documents/tools/2025-55182 └─$ python exploit.py -h /\ /\ /\ /\ /\ /\ || CVE-2025-55182 React Serv...

HikvisionExploiter

HikvisionExploiter HikvisionExploiter is a powerful and automated exploitation toolkit targeting unauthenticated endpoints on Hikvision IP cameras , particularly those running firmware version 3.1.3.150324. It performs: Snapshot access verification Config file retrieval and decryption User...

woody-woodpacker

Woody-Woodpacker A 42 school project that implements a binary packer for 64-bit ELF executables. The packer encrypts the executable's code sections and injects a decryption routine that executes at runtime. 🎯 About Woody-Woodpacker is a program that takes a 64-bit ELF binary as input and creates ...

distributed-system-testing

Distributed Systems Testing Skills Two skills for AI coding agents that design and run claim-driven tests for distributed and stateful systems. Together they produce a structured Markdown test plan and a findings report with 10-state verdicts and an explicit SUT / harness / checker / environment...

victorian_machinery

Victorian Machinery Victorian Machinery is a proof of concept exploit for CVE-2022-30525. The vulnerability is an unauthenticated and remote command injection vulnerability affecting Zyxel firewall's that support zero touch provisioning. Zyxel pushed a fix for this issue on April 28, 2022. The...

CVE-2024-31317

CVE-2024-31317 Preface A couple of days ago, I saw an analysis of the CVE-2024-31317 vulnerability posted on JD's official account. After reading it through, I found it quite interesting. Moreover, the current mainstream solutions for automotive IVI In-Vehicle Infotainment are all based on Androi...

matchlock

Matchlock Experimental: This project is still in active development and subject to breaking changes. Matchlock is a CLI tool for running AI agents in ephemeral microVMs - with network allowlisting, secret injection via MITM proxy, and VM-level isolation. Your secrets never enter the VM. Why...

CVE-2021-44228-Demo

CVE-2021-44228-Demo An example of remotely injecting code via RMI and LDAP using CVE-2021-44228. Exploit class from RMI Server loaded Hello, $jndi:rmi://127.0.0.1:1099/exploit Exploit class from LDAP Server loaded Hello, $jndi:ldap://127.0.0.1:1389/org.mazhuang.ldap.Exploit RmiServer and LdapServ...

CVE-2025-48703

🛡️ CVE-2025-48703 - Remote Code Execution RCE in cPanel File Manager 📌 Description CVE-2025-48703 is a Remote Code Execution RCE vulnerability in the filemanager module of a web hosting control panel e.g., cPanel. It occurs due to unsanitized input handling in the acc=changePerm function, which...

mssqli-duet

MSSQLi-DUET - MSSQL Injection-based Domain User Enumeration Tool SQL injection script for MSSQL that extracts domain users from an Active Directory environment based on RID bruteforcing. Supports various forms of WAF bypass techniques through the implementation of SQLmap tamper functions...

r77-rootkit

r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration...