CVE-2025-60787

CVE-2025-60787 - Authenticated RCE in motionEye PoC for CVE-2025-60787 that is an Authenticated RCE vulnerability for motionEye with all afected versions up to 0.43.1b4 included. This is an automated PoC for the vulnerability described in this repository. Credits to prabhatverma47. Usage The scri...

CVE-2024-38063

CVE-2024-38063 - Windows TCP/IP Remote Code Execution Vulnerability Research Comprehensive research to save you time, energy, sanity, & understanding. I want to start this off by saying that this specific CVE is like many in that due to its high severity score, it has gained an enormous amount...

CVE-2026-23744-PoC

Description MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution RCE vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Sinc...

CVE-2025-49113

CVE-2025-49113 RCE exploit the method for username/password authentication in this Exploit comes in 4 steps the code is a bit messy...

CVE-2026-50612 Import Symlink Following Remote Code Execution Vulnerability in QuMagie

An unix symbolic link symlink following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 a...

CVE-2026-50612

A UNIX symbolic link (symlink) following vulnerability exists in QuMagie . If a remote attacker obtains a user account, they can exploit this flaw to achieve Remote Code Execution and compromise the system's security. The vulnerability is addressed in QuMagie version 2.9.2 and later . No specific...

CVE-2017-0199

CVE-2017-0199 Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick and effective way to exploit Microsoft RTF RCE. It could generate a malicious RTF file and deliver metasploit / meterpreter payload to victim without any complex configuration. Release note:...

Malicious code in py-worm (PyPI)

Source: kam193 d4c5838f30da7c1f684305ec0704ef37e963793449390f5b13a4e06212ccbd9d The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in py-sock2 (PyPI)

Source: kam193 317abc5a9c1b535f3db6fd260a2f77eaaceb45745cd93deea7e9b3dd1d0cb933 The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

CVE-2026-26244 SQLi#1 SQL Injection in class_videos.php _getFilters

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...

Fastjson--CVE-2017-18349-

Fastjson--CVE-2017-18349-Cancel changes After setting the project as a Maven project, run note: using a higher version of JDK may fail, it is recommended to use JDK version 1.8.65 Just run the main function of FastjsondemoApplication.java TouchFile.java file import java.lang.Runtime; import...

CVE-2026-42945_NginxRift

🚀 NGINX Rift PoC Automation — CVE-2026-42945 PoC Automation Driver for RCE exploitation of thenginx-rift container · Target verification → Single-command exploit → Interactive reverse shell One command orchestrates the entire exploit flow — from container check to getting a shell. ⚠️ Ethical &...

CVE-2020-17496

CVE-2020-17496 POST /ajax/render/widgettabbedcontainertabpanel?XDEBUGSESSIONSTART=phpstorm HTTP/1.1 Host: localhost User-Agent: curl/7.54.0 Accept: / Content-Length: 100 Content-Type: application/x-www-form-urlencoded subWidgets0template=widgetphp&subWidgets0configcode=echo shellexec"pwd"; exit;...

INPGer

INPGer | CVE-2022-4063 - InPost Gallery Automatic Mass Tool for checking vulnerability in CVE-2022-4063 - InPost Gallery install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How To Use bash inpger.sh yourlist.txt thread Reference...

CVE-2020-35476

CVE-2020-35476 A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. Not finished and doesn't work. Most of the code is there but payload has to be fixed...

CVE-2021-44228

CVE-2021-44228 Vulnerability recurrence 1. Run RmiServer first to create an RMI registry service. 2. Run Log4jTest, if you use Windows, the calculator will appear...

PanOsExploitMultitool

PanOsExploitMultitool Exploitation and Post-Exploitation Multitool for Palo Alto PAN-OS Systems affected by vulnerabilities CVE-2024-0012 and CVE-2024-9474 During early exploitation of CVE-2024-0012 and CVE-2024-9474's Remote Code Execution vulnerabilities, I acquired a shell and began identifyin...

WAGO-CVE-2023-1698

WAGO-CVE-2023-1698 WAGO System Remote Code Execution Vulnerability CVE-2023-1698 Attention I have developed a tool for local testing and POC development, which is for technical learning reference only. Please do not use it for illegal purposes. Any direct or indirect consequences and losses cause...

CVE-2026-102469

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x DB2 client vertx-db2-client contains DRDA protocol handling code that deserializes User Defined Type UDT column data using a bare ObjectInputStream.readObject call with no ObjectInputFilter or clas...

log4j-rce-test

Build ./build.sh Start log4j RCE Server ./start-log4j-rce-server.sh Test Run java -cp log4j-rce-1.0-SNAPSHOT-all.jar log4j Check if you get logs in hack.log from current folder You can change this line String cmds = "sh", "-c", "echo 'Exploit at '" + getDateString + " ./hack.log" ; in file...