CVE-2022-26265

CVE-2022-26265 The first proof of concept of the Contao CMS RCE This repo is part of the hgrab-framework Affected product Contao CMS v1.5.0 Installation Install the app on the server...

CVE-2024-1212

CVE-2024-1212 - Progress Kemp LoadMaster Unauthenticated Command Injection This is an exploit script for CVE-2024-1212 , an unauthenticated command injection vulnerability in Progress Kemp LoadMaster. Vulnerability Summary CVE-2024-1212 affects Progress Kemp LoadMaster , allowing unauthenticated...

http-vuln-CVE-2019-16759

SUMMARY Simple NSE script to detect vBulletin 5.x 0day pre-auth RCE. This should work on all versions from 5.0.0 till 5.5.4 INSTALLATION $ git clone https://github.com/r00tpgp/http-vuln-CVE-2019-16759 $ cd http-vuln-CVE-2019-16759/ $ sudo cp http-vuln-CVE-2019-16759.nse /usr/share/nmap/scripts/...

SpringBreaker

SpringBreaker Exploit PoC for Spring RCE issue CVE-2011-2894...

CVE-2025-13595

CIBELES AI = 1.10.8 - Subida de Archivos Arbitraria No Autenticada El plugin de WordPress Cibeles AI en versiones 1.10.8 y anteriores contiene una vulnerabilidad de ejecución remota de código no autenticada en el archivo actualizadorgit.php. Este archivo es accesible directamente a través de HTTP...

CTT-enhanced-VMware-vCenter

CTT-enhanced-VMware-vCenter Looking at current high-impact vulnerabilities, let's use the VMware vCenter Server CVE-2021-21972 CVSS 9.8 as our base. This is a publicly known RCE with patches available, perfect for demonstrating CTT enhancements. 🔥 What This CTT Enhancement Actually Does: 1...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE An automated exploit for CVE-2025-34085 duplicate of CVE-2020-36847, a critical unauthenticated remote code execution vulnerability in the WordPress Simple File List plugin versions ≤ 4.2.2. Note: CVE-2025-34085 was rejected by MITRE...

CVE-2025-4632_POC

Samsung MagicINFO 9 Server Exploit CVE-2025-4632 This repository contains a Python replication script for CVE-2025-4632, an Unauthenticated Remote Code Execution RCE vulnerability in Samsung MagicINFO 9 Server versions prior to 21.1052. The vulnerability exists due to an improper limitation of a...

CVE-2025-24813-POC

CVE-2025-24813: Apache Tomcat RCE Proof of Concept This repository provides a controlled, automated environment to demonstrate Remote Code Execution RCE vulnerabilities in Apache Tomcat via CVE-2025-24813. Overview This PoC exploits misconfigured file-based session persistence in Apache Tomcat's...

CVE-2026-25938-FUXA-Unauthenticated-RCE

CVE-2026-25938 - FUXA Unauthenticated RCE 1. What is FUXA? FUXA is a free, open-source, web-based SCADA Supervisory Control and Data Acquisition and HMI Human-Machine Interface platform used for industrial automation , IoT , and real-time process visualization. It lets users build custom...

CVE-2025-55182

CVE-2025-55182 Proof-of-Concept for CVE-2025-55182, a critical unauthenticated RCE in React Server Components. ⚠️ Disclaimer This document is provided strictly for educational, defensive, and authorized security research purposes. Do NOT attempt to exploit systems or applications without explicit...

CVE-2026-12227

CVE-2026-12227 — Visual Composer Website Builder Unauthenticated LFI Python 3 PoC for CVE-2026-12227 Wordfence: Local File Inclusion via the vcv-template query parameter in Visual Composer Website Builder visualcomposer on wordpress.org. | ---|--- Platform| WordPress plugin Component| Visual...

WordPress_Backup_Migration-RCE_Unauthenticated

CVE-2023-6553 — The Backup Migration plugin for WordPress - Reverse Shell An extended version of Chocapikk's CVE-2023-6553 exploit that adds a one-command reverse shell mode on top of the original interactive webshell. Vulnerability CVE-2023-6553 — Unauthenticated Remote Code Execution in the...

mc-log4j-patcher

mc-log4j-patcher Replaces old vulnerable - CVE-2021-44228 Log4j2 version with the latest one 2.15.0 that contains the JNDI RCE fix. Tested on Spigot 1.12.2, PaperSpigot 1.8.8, PaperSpigot 1.17.1 This is intended to fix servers that are currently unsupported, such as PaperSpigot 1.8.8 Please check...

innbox_root

Innbox G74/M84 - Unauthenticated Remote Code Execution via log...

CVEHarvest

CVEHarvest Multi-CVE exploitation framework for Windows syste...

CVE-2026-87902-Toolkit

CVE‑2026‑87902 – WordPress Unauth LFI→RCE Toolkit ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer Misuse Act UK...

CVE-2025-13597

AI Feeds = 1.0.11 - Unauthenticated Arbitrary File Upload The AI Feeds WordPress plugin versions 1.0.11 and below contain an unauthenticated remote code execution vulnerability in the actualizadorgit.php file. This file is directly accessible via HTTP without any authentication or authorization...

FULL-ANALYSIS---CVE-2026-45829-ChromaDB-

CVE-2026-45829 - ChromaDB Pre-Auth RCE CVSS 10.0 ⚠️ WARNING This repository contains a FUNCTIONAL PoC for CVE-2026-45829. ONLY for authorized testing in controlled environments. Description Critical vulnerability in ChromaDB versions 1.0.0 to 1.5.8 that allows an unauthenticated attacker to execut...

CVE-2026-85423

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the...