CVE-2021-46362

CVE-2021-46362: FreeMarker Server-Side Template Injection in Magnolia CMS A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows unauthenticated attackers to execute arbitrary code via a crafted payload entered into...

CVE-2021-46364

CVE-2021-46364: YAML Deserialization in Magnolia CMS Magnolia versions =6.2.3 has a Snake YAML parser which is vulnerable to deserialization attacks that can allow an attacker to call arbitrary Java constructors when importing YAML files. Remote Code Execution has been achieved using this...

CVE-2022-41678

CVE-2022-41678: Dangerous MBeans Accessible via Jolokia API in Apache ActiveMQ By listing and inspecting the MBeans exposed by the Jolokia API at http://127.0.0.1:8161/api/jolokia the following attack vectors have been identified: Arbitrary File Write using Log4J resulting in Remote Code Executio...

CVE-2022-40634

CVE-2022-40634: FreeMarker Server-Side Template Injection in CrafterCMS By inserting malicious content in a FTL template, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and obtain RCE Remote Code Execution...

CVE-2026-64638

CVE-2026-64638 // XSS2Shell Technical analysis and defensive mitigation matrix for the CVE-2026-64638 XSS2Shell vector, a critical parsing inconsistency in the WordPress Core authentication screen that makes it possible to chain a reflected pre-authentication Cross-Site Scripting XSS with browser...

CVE-2017-7269-Echo-PoC

CVE-2017-7269 Remote Code Execution Echo Verification Our team's analysis report on the CVE-2017-7269 vulnerability: https://ht-sec.org/cve-2017-7269-vulnerabilities/ The default PoC only launches calc.exe. Now it has been modified to respond to requests. The command format is:...

UltraRealy_with_CVE-2019-1040

UltraRelay Updated by Lazaar Sami for the exploit CVE-2019-1040 UltraRelay is a tool for LLMNR poisoning and relaying NTLM credentials. It is based on Responder and impack. I have updated the original version https://github.com/5alt/ultrarelay for the exploit CVE-2019-1040. Dirk-jan Mollema has...

CVE-2019-2890

Disclaimer For learning and communication purposes only. Use for other purposes is at your own risk. Description The relevant jar files have been imported into the project, and the exploitation method uses yso's JRMP. When learning and debugging, you can modify the exploitation method. First, pla...

EUVD-2026-65440

NLTK: Allowlisted pickle loaders still permit code execution in current source...

CVE-2026-29041

CVE-2026-29041 — Authenticated RCE via Unrestricted File Upload in Chamilo LMS 1.11.32 -yellow?style=for-the-badge Authenticated Remote Code Execution in Chamilo LMS 1.11.32 via improper file upload validation in the ckuploadimage AJAX endpoint. A low-privileged student can upload a PHP web shell...

EUVD-2026-65229

NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution...

cacti-rce-cve-2022-46169-vulnerable-application

Cacti v1.2.22 command injection CVE-2022-46169 vulnerable application This is a vulnerable application to test the exploit for the Cacti vulnerability CVE-2022-46169. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is recommended using a backed-up...

CVE-2026-41179

CVE-2026-41179 — rclone RC API Unauthenticated RCE ⚠️ EDUCATIONAL PURPOSES ONLY This repository is intended strictly for security research, education, and authorized lab environments. PSSec and the contributors of this repository do not condone, support, or take any responsibility for any...

CVE-2026-4882

CVE-2026-4882 User Registration Advanced Fields = 1.6.20 - Unauthenticated Arbitrary File Upload Description : User Registration Advanced Fields = 1.6.20 - Unauthenticated Arbitrary File Upload Description The User Registration Advanced Fields plugin for WordPress versions up to and including...

CVE-2021-26084

CVE-2021-26084 CVE-2021-26084, Atlassian Confluence OGNL Injection Vulnerability Atlassian Confluence is a widely used wiki system in enterprises, and some versions contain an OGNL expression injection vulnerability. Attackers can exploit this vulnerability to execute arbitrary code on the target...

CVE-2026-86732

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

cve-2021-44228-log4j-exploits

CVE-2021-4428 Reproduction This DEMO is a replication of the Log4j2 ultra-high-risk RCE vulnerability CVE-2021-4428, aiming to understand the harmfulness of this vulnerability and make targeted defenses based on your system's situation. Warning This DEMO is solely for technical research purposes...

CVE-2022-26134-Exploit-Detection

Confluence RCE CVE-2022-26134 Exploit Detection Pre-requisites 1. ClamAV Clone this repository or download the Yara rule on your confluence server We are using the Yara rule provided by volexity/threat-intel who first unveiled this vulnerability. Git Clone root@kitploit: git clone...

CVE-2019-11932-whatsApp-exploit

CVE-2019-11932-whatsap-exploit The address of system and the gadget must be replaced by the actual address found by an information disclosure vulnerability. After replacing address of system and gadget. Run the code to generate the corrupted GIF file: now lets do it...

cacti-rce-snmp-options-vulnerable-application

Cacti v1.2.24 inyección de comandos autenticada CVE-2023-39362 aplicación vulnerable Esta es una aplicación vulnerable para probar el exploit de la vulnerabilidad Cacti CVE-2023-39362. ¡ADVERTENCIA! ¡Esta aplicación contiene vulnerabilidades de seguridad graves. Úsela bajo su propio riesgo! Se...