CVE-2025-32433-Eploit

CVE-2025-32433-Eploit Erlang/OTP SSH Vulnerable to Pre-Authentication RCE SSH Erlang RCE Exploit crafting SSH payload to execute an arbitrary Erlang command on the vulnerable server. Usage: python3 exploit.py -t targets.txt -p 2222 -o results.log Disclaimer: This tool is for educational purposes...

metabase-pre-auth-rce-poc

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a script written in Python that allows the exploitation of the Metabase's software security flaw described in CVE-2023-38646. The system is vulnerable in versions preceding 0.46.6.1 , in the open-source edition, and preceding 1.46.6.1 , in the...

CVE-2026-28496

CVE-2026-27604 + CVE-2026-28496 — Cadena de RCE Pre-Auth en FOSSBilling Resumen Ejecutivo Este repositorio contiene un laboratorio Docker local para reproducir y validar la cadena de RCE Pre-Auth en FOSSBilling, compuesta por dos vulnerabilidades encadenadas: CVE| Tipo| CVSS v4| GHSA| Descripción...

CVE-2021-26084

CVE-2021-26084 Atlassian Confluence Pre-Auth RCE...

CVE-2025-55182-POC-SCANNER

CVE-2025-55182: Critical Pre-Authentication RCE in React Server Components Security Research byschema.cx "Control is an illusion. It's the systems we build that control us—unless we understand them first." 📋 Table of Contents Disclaimer & Legal Notice Executive Summary Technical Description...

CVE-2022-47986

CVE-2022-47986 Aspera Faspex Pre Auth RCE https://blog.assetnote.io/2023/02/02/pre-auth-rce-aspera-faspex/ Poc Usage: python3 poc.py https://xxxxx whoami...

cve-2022-42475-poc

CVE-2022-42475 PoC Fortinet SSL VPN Pre-Authentication Remote Code Execution Descripción CVE-2022-42475 es una vulnerabilidad de heap-based buffer overflow en el servicio SSL VPN de FortiOS que permite a atacantes no autenticados ejecutar código arbitrario de forma remota RCE mediante solicitudes...

wp2shell-lab

wp2shell lab & detector + pre-auth RCE PoC A self-contained lab, non-destructive detector , and full pre-auth RCE proof-of-concept for wp2shell — the pre-authentication vulnerability chain in WordPress core: CVE| Component| Class| CVSS ---|---|---|--- CVE-2026-60137| WPQuery::authornotin| SQL...

cve-2024-38077-madlicense_reproduction

CVE-2024-38077: Windows Remote Desktop Licensing Service Remote Code Execution "MadLicense" I. Vulnerability Overview CVE ID : CVE-2024-38077 Alias : MadLicense CVSS Score : 9.8 Critical Type : Heap-Based Buffer Overflow CWE-122 Discovered by : Ver, Lewis Lee, Zhiniang Peng Description : A...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 Marimo Pre Authentication RCE --- 📋 V...

Exploit for CVE-2026-63030

wp2shell CVE-2026-63030 / CVE-2026-60137 PoC for an unaut...

GHSA-6C99-87FR-6Q7R OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

Summary Description A deserialization of untrusted data vulnerability CWE-502 exists in OpenAM's WebAuthn authentication module. Under certain conditions, this may allow an attacker to achieve arbitrary code execution in the context of the application server. This affects OpenAM Community Edition...

CVE-2026-53753 Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the safeevalexpression function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes giframe, fback, fbuiltins do NOT...

Exploit for Embedded Malicious Code in Tukaani Xz

XZ Backdoor Labs CVE-2024-3094 Safe, hands-on labs for...

Exploit for Double Free in Apache Http_Server

CVE-2026-23918 Double-free in Apache httpd modhttp2 stream c...

CVE-2025-34300 Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCE

A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. Exploitation allows an unauthenticated attacker can execute arbitrary commands...

CVE-2021-37741: Unrestricted Upload of File with Dangerous Type

ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities...

CISA Emergency Directive 21-03: VPN Vulnerabilities Actively Exploited

On April 20, 2021, the Department of Homeland Security Cybersecurity and Infrastructure Security Agency CISA released an alert on the exploitation of Pulse Connect Secure Vulnerabilities with Alert AA21-110A: Exploitation of Pulse Connect Secure Vulnerabilities, as well as Emergency Directive ED...