CVE-2026-76070

CVE-2026-76070: Unauthenticated Pre-Auth Stack Buffer Overflow via Base64-Decoded Password in Netis NC63 login.cgi Leading to RCE Researcher: Özcan Ersan @ozcanpng Disclosure status CVE: CVE-2026-76070 Vendor: Netis Systems Co., Ltd. Product: Netis NC63 Wireless AC1200 Router Tested firmware:...

bitbucket-test

Docker container to investigate CVE-2022-36804 Recreating a remote code execution vulnerability where Bitbucket fails to sanitize user input, which allows attackers to inject Git flags and execute code remotely. This repository documents how I reproduced the vulnerability CVE-2022-36804, an issue...

CVE-2023-49070

CVE-2023-49070 ¡RCE sin autenticación previa en Apache Ofbiz! Vea el video del POC: https://youtu.be/gDzYb6YvBSQ...

CVE-2022-24087

CVE-2022-24087-RCE and CVE-2022-24086-RCE CVE description CVE-2022-24086 and CVE-2022-24087 - improper Input Validation vulnerability in contact form Magento Open Source and Adobe Commerce - has received a CVSS score of 9.8 out of 10, it is classified as a pre-authentication issue which means tha...

CVE-2025-55182-React2Shell-Exploit

Next.js React2Shell CVE-2025-55182 Expl0it A proof-of-concept tool for demonstrating the critical React2Shell vulnerability CVE-2025-55182 / CVE-2025-66478 on authorized, local testing environments only. ⚠️ CRITICAL WARNING: ACTIVE EXPLOITATION LEGAL USE ONLY : Use exclusively against systems you...

CVE-2025-55182

CVE-2025-55182 - React2Shell React Server Components / Next.js Pre-Authentication Remote Code Execution...

CVE-2026-57517

Control Web Panel ≤ 0.9.8.1224 — Inyección SQL Ciega a Ejecución Remota de Código Puerto 2083 → userRes POST → INTO DUMPFILE → Puerto 2031 Webshell → cwpsvc 🔴 Resumen de la Vulnerabilidad CVE-2026-57517 es una inyección SQL ciega crítica previa a la autenticación en versiones ≤ 0.9.8.1224. El...

0-click-RCE-Exploit-for-CVE-2024-51793

CVE-2024-51793 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858668072279626138 This repository contains a proof-of-concept exploit for CVE-2024-51793, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress plugin, leading to remote...

CVE-2026-64638-XSS-to-Shell-PoC

CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concept PoC tool for validating CVE-2026-64638 , a pre-authentication reflected Cross-Site Scripting XSS vulnerability affecting WordPress installations versions 6.4 – 7.0.2. Overview This tool automates the process of fingerprinting,...

React4Shell

React2Shell Exploit Prueba de concepto PoC para la vulnerabilidad de ejecución remota de código en React Server Components RSC / Next.js. Descripción Existe una vulnerabilidad de ejecución remota de código sin autenticación previa en React Server Components versiones 19.0.0, 19.1.0, 19.1.1 y...

CVE-2026-86218 pre-authentication remote code execution

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14...

CVE-2026-86218 pre-authentication remote code execution

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14...

cve-2024-38077-madlicense_reproduction

CVE-2024-38077: Windows Remote Desktop Licensing Service Remote Code Execution "MadLicense" I. Vulnerability Overview CVE ID : CVE-2024-38077 Alias : MadLicense CVSS Score : 9.8 Critical Type : Heap-Based Buffer Overflow CWE-122 Discovered by : Ver, Lewis Lee, Zhiniang Peng Description : A...

PT-2026-86470

Name of the Vulnerable Software and Affected Versions N-central versions prior to 2026.3.1.14 Description N-central contains a flaw that allows for pre-authentication remote code execution, enabling an attacker to execute arbitrary code on the system without requiring valid credentials...

cve-2024-50330-ivanti_epm_sqli_reproduction

CVE-2024-50330: Ivanti Endpoint Manager EPM SQL Injection to RCE Overview CVE-2024-50330 is a critical pre-authentication SQL injection vulnerability in Ivanti Endpoint Manager EPM that allows a remote unauthenticated attacker to achieve remote code execution on the target server. The vulnerabili...

CVE-2025-55182

CVE-2025-55182 - React2Shell A modified and boosted exploit for CVE-2025-55182 a pre-authentication Remote Code Execution in React Server version 19.0, 19.1.0, 19.1.1, and 19.2.0 The vulnerability spans the following: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack Pat...

React2Shell

@React2Hell — CVE-2025-55182 Exploit 🔥 Exploit de Ejecución Remota de Código RCE en Next.js / React Server root@kitploit: █████▄ ▄▄▄▄▄ ▄▄▄ ▄▄▄▄ ▄▄▄▄▄▄ ████▄ ▄▄▄▄▄ ██ ██ ▄▄▄▄▄ ▄▄ ▄▄ ██▄▄██▄ ██▄▄ ██▀██ ██▀▀▀ ██ ▄██▀ ██▄▄ ██████ ██▄▄ ██ ██ ██ ██ ██▄▄▄ ██▀██ ▀████ ██ ███▄▄ ▄▄▄███ ██ ██ ██▄▄▄ ██▄▄▄...

CVE-2026-67279 SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...

CVE-2026-67279

MikroTik RouterOS is affected by a SSH pre-authentication rekey state bypass (CVE-2026-67279). The root cause is that the SSH service enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated remote client to ope...

cve-2024-3400-panos_rce_reproduction

CVE-2024-3400: Palo Alto PAN-OS GlobalProtect Command Injection RCE CVSS 10.0 CRITICAL | CWE-78: OS Command Injection | Mass Exploited In The Wild Overview CVE-2024-3400 is a pre-authentication command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect portal and gateway interface...