textpattern-exploit-rce

Textpattern = 4.8.3 Remote Code Execution Authenticated Textpattern until version 4.8.3 allows authenticated users to upload any PHP file. This script automates the process and allows to delete the uploaded file. Usage python3 exploit.py -t TARGET -u USER -p PASSWORD -c COMMAND -f FILENAME -d -t:...

CVE-2026-92183

GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

CVE-2019-1040

CVE-2019-1040 Great writeup! Exploiting CVE-2019-1040 - Combining relay vulnerabilities for RCE and Domain Admin . So, I wrote CVE-2019-1040.py for easy to use. You can also check out my exchange2domain repo: https://github.com/ridter/exchange2domain, another way to use exchange to get DC...

CVE-2026-39987

CVE-2026-39987 — Marimo Python Notebook Pre-Authenticated Remote Code Execution TL;DR A pre-authenticated remote code execution vulnerability in Marimo , an open-source Python notebook for data science and AI/ML. The terminal WebSocket endpoint /terminal/ws completely skips authentication...

Exploit for CVE-2026-109618

PHP Vulnerability Exposure Scanner An interactive Bash utilit...

Exploit for CVE-2026-109618

php2shell-check for Claude A passive check for Claude whether...

Exploit for CVE-2026-109618

php2shell-check A passive check for Claude whether a website...

CVE-2025-49844-Vulnerability-Scanner

CVE-2025-49844 RediShell Vulnerability Scanner A comprehensive vulnerability scanner for testing Redis instances against the critical CVE-2025-49844 RediShell vulnerability. About the Vulnerability CVE ID : CVE-2025-49844 Name : RediShell CVSS Score : 10.0 Critical Type : Use-After-Free UAF in Lu...

CVE-2026-32475-PoC

CVE-2026-32475 — Elementor Pro Unauthenticated Arbitrary File Upload → RCE Proof-of-concept for CVE-2026-32475 CVSS 9.0: an unauthenticated arbitrary file upload vulnerability in the Elementor Pro WordPress plugin ≤ 4.2.1 that leads to remote code execution. | ---|--- CVE| CVE-2026-32475 CVSS| 9....

exphub

Notice In the end, I still felt that having separate scripts for each vulnerability was very inconvenient, so I integrated all poc and exp scripts into one, enabling one-click scanning + exploitation. Since I've been working on integration recently, Exphub has not been updated for a long time. Th...

sjet

sJET by siberas siberas JMX Exploitation Toolkit sJET allows an easy exploitation of insecure configured JMX services. Additional background information can be found here and here. Prerequisites Jython 2.7 Usage SJET implements a CLI interface using argparse: jython sjet.py targetHost targetPort...

cve-2021-22005-exp

cve-2021-22005-exp 0x01 Vulnerability Overview On September 21, 2021, VMware released a security advisory disclosing 19 security vulnerabilities in vCenter Server, with CVSSv3 scores ranging from 4.3 to 9.8. Among them, the most critical vulnerability is an arbitrary file upload vulnerability in...

tplmap

Tplmap This project is no longer maintained. I'm happy to merge new PRs as long they don't break the test suite. Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operatin...

CVE-2025-61882

Oracle E-Business Suite RCE Scanner CVE-2025-61882 A fast, multi-threaded bulk scanner for detecting CVE-2025-61882 in Oracle E-Business Suite installations. This critical vulnerability allows unauthenticated remote code execution. 🎯 Features Bulk Scanning - Process hundreds or thousands of...

Apache-CVE-2026-23918-fix

Apache HTTP Server: http2: Double Free and possible RCE on early reset CVE-2026-23918. Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issu...

CVE-2026-94127

CVE-2026-94127 — F5 BIG-IP APM Detection Tool Defensive Author: https://github.com/FurkanKAYAPINAR/ A defensive, non-exploit detector for CVE-2026-94127 , a heap-based buffer overflow CWE-122 in F5 BIG-IP APM that allows an unauthenticated remote attacker to achieve remote code execution RCE. CVS...

CVE-2026-86218

CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit Overview This is a Python 3 proof-of-concept exploit for CVE-2026-86218, a critical pre-authentication remote code execution vulnerability in N-able N-central. Vulnerability Details: CVE: CVE-2026-86218 CVSS Score: 10.0 Critical CWE: CWE-96...

Atom-CMS-2.0---File-Upload-Remote-Code-Execution-Un-Authenticated-POC

Atom-CMS-2.0---File-Upload-Remote-Code-Execution-Un-Authenticated- Remote Code Execution RCE Exploit Author: Ashish Koli Shikari Vendor Homepage: https://thedigitalcraft.com/ Software Link: https://github.com/thedigicraft/Atom.CMS Version: 2.0 CVE: CVE-2022-25487 About this: This script uploads...

Exploit for CVE-2026-109618

PHP2Shell: Two Days of Records – From Exposure, Previews to Pa...

CVE-2025-27480-The-Silent-Gateway-Risk

CVE-2025-27480-The-Silent-Gateway-Risk Letting attackers run malicious code without needing a cracked password, user interaction, or even a foothold in your network. That’s CVE-2025-27480 It’s late you are running on red-bull we have all been there. You’re troubleshooting a production issue and...