CVE-2026-22200

CVE-2026-22200: osTicket PDF File Read + CNEXT RCE Proof of concept exploit for osTicket CVE-2026-22200 which abuses PHP filters to exfiltrate files through the mPDF library and can be chained to RCE via CVE-2024-2961 CNEXT. Blog Post Deep-dive here: Horizon3.ai - Ticket to Shell: Exploiting PHP...

CVE-2023-38646

CVE-2023-38646 Automatic Tools For Metabase RCE Exploit Known As CVE-2023-38646. Read https://secry.me/explore/news/metabase-rce-cve-2023-38646/ for more information POC, Dork How to Use single.py python3 single.py --url=http://127.0.0.1:8080 --command="curl sub.requestcatcher.com/some-endpoint" ...

GitLab-preauth-RCE_CVE-2021-22205

GitLab-preauth-RCECVE-2021-22205 single line bash PoC for GitLab preauth RCE CVE-2021-22205 t="http://vuln.site";cmd='echo xxxbase64ofreverseshellcodexxx |base64 -d|bash';f="1.jpg";echo...

Laravel-debug-Checker

Laravel-debug-Checker CVE-2021-3129 Checker By ./MrMad Refrence : https://pentest-tools.com/blog/exploit-rce-vulnerability-laravel-cve-2021-3129 install module python -m pip install -r requirements.txt installation on linux git clone https://github.com/MadExploits/Laravel-debug-Checker sudo mv...

CVE-2025-55182-zoomeye

Zoomeye Next.js RCE Scanner Author: im-ezboy Scanner for Next.js RCE CVE-2025-55182 using Zoomeye search. Finds targets via Zoomeye queries and tests them with the supplied exploit payload. Features Two focused Zoomeye dorks by default: http.header="Vary: RSC, Next-Router-State-Tree"...

CVE-2019-8942

CVE-2019-8942 and CVE-2019-8943: WordPress RCE author privilege Overview CVE-2019-8942 is a vulnerability that exploits an LFI flaw combined with the File Upload feature to achieve RCE on a WordPress web server with author privileges. Affected WordPress versions include those before 4.9.9 and 5.x...

CVE-2024-41570-Havoc-C2-RCE

Havoc-C2-RCE CVE-2024-41570 This is a Chained RCE CVE-2024-41570 in the Havoc C2 framework. Command injection: Havoc is vulnerable to command injection enabling an authenticated user to execute commands on the Teamserver. Affects versions 0.3 up to the latest release 0.6. Havoc's default profile...

CVE-Arsenal-Lab

TomcatScanner Advanced Detection and Exploitation Tool for CVE-2025-24813 TomcatScanner is a comprehensive security tool designed for detecting and exploiting the CVE-2025-24813 vulnerability in Apache Tomcat servers. This vulnerability involves a path equivalence issue in the 'file.Name' paramet...

CVE-2025-3515

CVE-2025-3515 - WordPress File Upload RCE Usage python3 exploit.py Overview CVE-2025-3515 is a file upload vulnerability in the "Drag and Drop Multiple File Upload for Contact Form 7" WordPress plugin that allows unauthenticated attackers to upload malicious files and achieve remote code executio...

evilarc

evilarc Purpose evilarc lets you create a zip file that contains files with directory traversal characters in their embedded path. Most commercial zip program winzip, etc will prevent extraction of zip files whose embedded files contain paths with directory traversal characters. However, many...

CVE-2023-20209

I started looking at Cisco Expressway after I noticed quite a few of them on the internet during Red Team engagements, but never had the time during work to explore the product further. Initially I was looking for an auth bypass to chain into RCE but ran out of time and settled on a post auth RCE...

CLEANSTART-2026-BM08082 Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly speci...

Security vulnerability affects the apache-nifi-registry package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...

CVE-2019-0708

CVE-2019-0708 BlueKeep pre-auth RCE POC on Windows7 This repository demonstrates the remote code execution bug in Windows Remote Desktop Services RDS. Here is a POC code and technical report about BlueKeep vulnerability, which we developed before. NOTE: Our goal is helping analysts to get better...

CVE-2022-46169

CVE-2022-46169 Exploit Exploit to CVE-2022-46169 vulnerability on Cacti 1.2.19 Options -u --url victim's url -f --forwarded X-Forwarded value to bypass the auth -m --mode: check for Checking for Vulnerable Servers, or exploit for Fun exploitation mode :D Usage 1. $ ./cve202246169.py -u...

MyLog4Shell

MyLog4Shell log4j RCE Exploitation Detection You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228 Grep / Zgrep This command searches for exploitation attempts in uncompressed files in folder /var/log - '/usr/var/log' and all sub...

TryHackMe-Atlassian-CVE-2022-26134

TryHackMe | Atlassian, CVE-2022-26134 TryHackMe Atlassian CVE-2022-26134 Atlassian, CVE-2022-26134 An interactive lab showcasing the Confluence Server and Data Center un-authenticated RCE vulnerability. Task 1 Introduction Confluence | Your Remote-Friendly Team Workspace | Atlassian NVD -...

Joomla-JCK-Editor-6.4.4-SQL-Injection

Joomla-JCK-Editor-6.4.4-SQL-Injection The JCK Editor Jtreelink plugin for Joomla! fails to correctly parse the user inputs, allowing SQL Injection. This exploit takes advantage of this security flaw and dump the administrators credentials and possibly upload a PHP RCE shell. Exploit Title: Joomla...

CVE-2026-39987-POC

CVE-2026-39987 - Marimo 0.23.0 Pre-Auth RCE WebSocket Proof of Concept PoC exploit for a Critical Pre-Authentication Remote Code Execution RCE vulnerability in Marimo versions prior to 0.23.0. The vulnerability allows an unauthenticated attacker to connect to the WebSocket endpoint /terminal/ws a...

CVE-2025-3248

CVE-2025-3248 ★ CVE-2025-3248 Langflow RCE PoC ★ Lab Setup docker pull langflowai/langflow:1.2.0 docker run -d --name CVE-2025-3248 -p 7860:7860 langflowai/langflow:1.2.0 localhost:7860 Description Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code...

CVE-2025-32756-POC

CVE-2025-32756: Fortinet RCE PoC A proof-of-concept for the critical stack-based buffer overflow vulnerability CVE-2025-32756 affecting Fortinet products. Vulnerability CVSS : 9.8 Critical Type : Stack-based buffer overflow in AuthHash cookie processing Impact : Unauthenticated remote code...