269584 matches found
pinky
Subir una webshell es casi siempre el siguiente paso después de explotar una vulnerabilidad web, pero servicios como Cloudflare y la nueva generación de firewalls hacen un muy buen trabajo impidiendo que los atacantes ejecuten comandos en el objetivo a través de HTTP o HTTPS. Por otro lado, el...
Php-unit-CVE-2017-9841
phpunit Remote Code Execution Vulnerability CVE-2017-9841 Composer is a PHP package management tool. Using Composer to install extension packages will create a vendor folder in the current directory and place all files in it. Usually this directory should be placed outside the web root so that...
CVE-2020-5902
CVE-2020-5902 Python script to exploit F5 Big-IP CVE-2020-5902 Examples Exploit local file read: python3 CVE-2020-5902.py -t example.com -x lfr -f /etc/passwd Exploit RCE: python3 CVE-2020-5902.py -t example.com -x rce -a list+auth+user+admin...
CVE-2020-12124
CVE-2020-12124 An implementation of a proof-of-concept for CVE-2020-12124 https://vulners.com/cve/CVE-2020-12124 root@kitploit: The following is an actualization of CVE-2020-12124, a vulnerability which exploits a command injection in the Wavlink WN530H4 router in which certain parameters are tak...
CVE-2025-55182-Toolbox
React2Shell: Comprehensive Exploitation Tool for CVE-2025-55182 Author: lamaper / BITs2Sys Version: 1.0.1 License: MIT 📝 Tool Introduction This tool is an automated penetration testing tool specifically designed for CVE-2025-55182 React Server Components / Next.js prototype pollution leading to...
freepbx-endpoint-sqli-rce
CVE-2025-57819 — FreePBX Endpoint Module SQL Injection → Remote Code Execution Summary FreePBX is the open-source web GUI for Asterisk PBX, widely deployed in enterprise telephony environments. The Endpoint Manager module exposes an AJAX handler at /admin/ajax.php that accepts a brand parameter a...
CVE-2025-24893
CVE-2025-24893 XWiki Remote Code Execution RCE Exploit A Python3 exploit for CVE-2025-24893 , a critical Unauthenticated Remote Code Execution RCE vulnerability affecting the XWiki platform. This script exploits a Code/Expression Injection flaw CWE-95 within the SolrSearch macro component. The fl...
CVE-2026-2586
Authenticated GlassFish EL Injection RCE CVE-2026-2586 An Expression Language Injection vulnerability in the GlassFish Administration Console allows an authenticated user to inject malicious EL expressions into parameters processed by the administrative web interface. Successful exploitation may...
CVE-2025-14174-Poc
CVE-2025-14174 PoC Exploit Overview This repository contains a fully functional Proof-of-Concept PoC exploit for CVE-2025-14174 also tracked as EUVD-2025-203113, a critical memory corruption vulnerability in the ANGLE graphics engine. The flaw stems from improper restriction of operations within...
CVE-2024-25600
CVE-2024-25600 Unauthenticated Remote Code Execution – Bricks Usage: python3 bricks.py Example: python3 bricks.py https://example.org reference: https://github.com/Chocapikk/CVE-2024-25600...
cve-2025-43564-tomcat_put_rce_reproduction
CVE-2025-43564 — Ejecución remota de código RCE en el manejo de solicitudes PUT parciales de Apache Tomcat...
cve-2021-44228
CVE-2021-44228 This repository represents a simplified simulation of infamous CVE-2021-44228 issue. Aside from system properties and other dictionary structures lookups, Apache Log4j also implements JNDI lookup feature for various reasons. The JNDI can obtain services from a number of service...
CVE-2021-44909
CVE-2021-44909 Título del Exploit: orangescrum 1.8.0 - Ejecución Remota de Comandos RCE no autenticado Fecha: 03/12/2021 Página del proveedor: https://www.orangescrum.org/ Enlace del software: https://github.com/Orangescrum/orangescrum Versión: 1.8.0 Probado en: Windows 10 x64 usando XAMPP 7.4.23...
React2Shell-POC
Esta Prueba de Concepto PoC para la vulnerabilidad React2Shell CVE-2025-55182 ha sido desarrollada estrictamente con fines educativos y de investigación únicamente. Está destinada a demostrar la existencia y el impacto potencial de una vulnerabilidad de seguridad específica en un entorno...
DVWA-ZAP-PENTEST
DVWA Vulnerability Assessment using OWASP ZAP A hands-on web application security assessment of DVWA Damn Vulnerable Web App , performed using OWASP ZAP Zed Attack Proxy 2.17.0. This project documents the full workflow: reconnaissance spidering, automated vulnerability scanning, and analysis of t...
CVE-2017-5638
CVE-2017-5638 Apache Struts 2 Introduction: Apache Struts 2 is an open source web application framework for developing Java EE Web applications,It is the second generation of the struts framework first released on 10th Oct 2006. Struts Framework is designed in a way that it helps creating Web...
OgnlContentTypeRejectorValve
OgnlContentTypeRejectorValva Esta es una Valve para Tomcat7 que bloquea la vulnerabilidad de ejecución remota de código de Struts 2 CVE-2017-5638...
CVE-2019-11580
CVE-2019-11580 Atlassian Crowd and Crowd Data Center RCE Usage: python CVE-2019-11580.py http://xx.xx.xx.xx/ Crowd-2.11.0 VulnVersion Donwload https://product-downloads.atlassian.com/software/crowd/downloads/atlassian-crowd-2.11.0.tar.gz Powered by Atlassian Crowd Version: 2.11.0 Build:725 -...
cve-2021-41773
Apache httpd RCE A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside these directories are not protected by default...