CVE-2021-26814

CVE-2021-26814 A simple python PoC to exploit CVE-2021-26814 and gain RCE on Wazuh Manager v.4.0.0-4.0.3 through the API service. To run it, simply make the .py script executable and launch it with the required parameters. PoC.py -h -user USERNAME -pwd PASSWORD -lip SRCIP -lport SRCPORT -tip DEST...

CVE-2018-7600

CVE-2018-7600 PoC for CVE-2018-7600 Drupal SA-CORE-2018-002 Drupalgeddon 2. Installation: $ git clone https://github.com/dwisiswant0/CVE-2018-7600 $ cd CVE-2018-7600/ $ composer install Usage: $ php exploit.php WARNING! For Educational Purposes Only! References: -...

CVE-2019-10915

The vulnerability is an authentication bypass in the TIA Administrator server. An attacker could execute arbitrary application commands through websockets on the node.js server which is externally exposed by default. By exploiting this vulnerability, an unauthenticated remote attacker could perfo...

CVE-2022-22947

Spring Cloud Gateway Example: python3 exploit.py http://localhost:8080 'id' + St...

ResponsiveFileManager-CVE-2022-46604

ResponsiveFileManager-CVE-2022-46604 Responsive FileManager v.9.9.5 vulnerable to CVE-2022-46604 File Creation Extension Bypass which leads to RCE. The current exploit is made in Python 3 and exploits the vulnerability to upload a webshell which allows the remote execution of commands in the...

CVE-2026-49009

▄█████ ██ ██ ██████ ████▄ ▄██▄ ████▄ ▄██▀▀▀ ██ ██ ▄█▀▀█▄ ▄██▄ ▄██▄ ▄█▀▀█▄ ██ ██▄▄██ ██▄▄ ▄▄▄ ▄██▀ ██ ██ ▄██▀ ██▄▄▄ ▄▄▄ ▀█████ ▀▀▀██ ██ ██ ██ ██ ▀▀▀██ ▀█████ ▀██▀ ██▄▄▄▄ ███▄▄ ▀██▀ ███▄▄ ▀█▄▄█▀ ██ ▄▄██▀ ▀██▀ ▀██▀ ▄▄██▀ ░█▄█░█▀▀░█▀█░█▀▄░█▀▀░█▀▄░░░█▀▀░█▀▀░█▀▄░█░█░█▀▀░█▀▄░░░█▀▄░█▀▀░█▀▀░...

CVE-2019-11043

CVE-2019-11043 Python exp for CVE-2019-11043 You can use build environment from https://github.com/vulhub/vulhub/tree/master/php/CVE-2019-11043 Usage： python3 main.py -u http://iptopage/index.php If you success, you will see: Base status code is 200 qsl:1760 with status code 502 The target maybe...

cve-2019-0227

cve-2019-0227 Apache Axis 1.4 remote code execution vulnerability You need to set up a listener on the local machine with msf, and also modify lines 24-30 of the code. ＃You need to change these variables to match your configuration myip = “ 192.168.0.117 ” ＃Your machine's IP target = “...

CVE-2024-27954

⚠️ CVE-2024-27954 💀 Automatic Remote code Execution Exploit Tools | By GhostSec 💀 📝 Description Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WP Automatic Automatic allows Path Traversal, Server Side Request Forgery.This issue affects Automatic: from...

CVE-2019-16113-PoC

CVE-2019-16113 PoC Bludit = 3.9.2 Remote Code Execution Vulnerability via "Upload function". Simple Python PoC. Discovery by @christasa: https://github.com/bludit/bludit/issues/1081 Usage Edit the script with your URL, username, password and command to execute then run the script: $ python...

poc-cve-2018-1273

CVE-2018-1273 Spring Data Commons, versiones anteriores a 1.13 hasta 1.13.10, 2.0 hasta 2.0.5, y versiones antiguas no soportadas, contienen una vulnerabilidad de enlace de propiedades causada por una neutralización incorrecta de elementos especiales. Un usuario malicioso remoto no autenticado o...

CVE-2019-0708

CVE-2019-0708 Mass Detection 0x01 Preface CVE-2019-0708 Windows RDP Remote Code Execution Vulnerability On May 15, 2019, a high-risk vulnerability was disclosed for Windows series servers. This vulnerability affects a wide range of systems, including Windows 2003, Windows 2008, Windows 2008 R2,...

cve-2024-21534

POC - CVE-2024-21534 Jsonpath-plus vulnerable to Remote Code Execution RCE due to improper input sanitization Overview CVE-2024-21534 is a critical vulnerability found in versions of the jsonpath-plus package prior to version 10.0.0. The vulnerability stems from improper input sanitization, which...

CVE-2022-22980

CVE-2022-22980 Spring Data MongoDB SpEL Expression Injection MongoDB is a document-oriented NoSQL database with the scalable and flexible that used for high volume data storage. Instead of using tables and rows as in the traditional relational databases, MongoDB makes use of collections and...

Check-vuln-CVE-2019-0708

CVE-2019-0708 Unauthenticated CVE-2019-0708 "BlueKeep" Scanner PoC by @JaGoTu and @zerosum0x0. Metasploit module PR: https://github.com/rapid7/metasploit-framework/pull/11869 In this repo A scanner fork of rdesktop that can detect if a host is vulnerable to CVE-2019-0708 Microsoft Windows Remote...

F5-BIG-IP-POC

F5-BIG-IP POC Written in Go, a collection of POCs for CVE-2020-5902, CVE-2021-22986, CVE-2022-1388. Other F5 POCs will be added later. author:160team.west9B For use only by security researchers with authorization. Comply with cybersecurity laws. Any consequences are your own responsibility, and t...

oracle-weblogic-CVE-2021-2109

oracle-weblogic-CVE-2021-2109 Oracle Weblogic RCE - CVE-2022-2109...

CVE-2007-2447-in-Python

CVE-2007-2447 - Python implementation Description Python implementation of 'Username' map script' RCE Exploit for Samba 3.0.20 IP - Ip of the remote machine. PORT - Optional Port that smb is running on. PAYLOAD - Payload to be executed on the remote machine e.g. reverse shell. Examples: python3...

EUVD-2026-89995

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing task=getContent, a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates th...

CVE-2026-102427 Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing task=getContent, a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates th...