CVE-2021-33558

CVE-2021-33558 Reference: https://www.cvedetails.com/cve/CVE-2021-33558 Shodan dork: product:"Boa Web Server" 0.94.13 Payload: /backup.html /preview.html /js/log.js /log.html /email.html /online-users.html /config.js POC:...

CVE-2024-50964

MX Server misconfiguration CVE-2024-50964 Description A critical vulnerability has been identified in Ferozo Webmail v1.1 , where the MX Mail Exchange server of DonWeb completely disregards configured DMARC Domain-based Message Authentication, Reporting, and Conformance policies. Although domains...

CertificateDsc

CertificateDsc Code of Conduct This project has adopted this code of conduct. Releases For each merge to the branch main a preview release will be deployed to PowerShell Gallery. Periodically a release version tag will be pushed which will deploy a full release to PowerShell Gallery. Contributing...

CVE-2022-26134

CVE-2022-26134 PoC !WARNING LEGAL DISCLAIMER: This tool is STRICTLY for EDUCATIONAL PURPOSES ONLY! Usage of this tool for attacking targets without prior mutual consent is ILLEGAL. It is the user's responsibility to obey all laws that apply whilst using this tool. The developer of this tool assum...

RDGScanner

Scanner for CVE-2020-0609 & CVE-2020-0610 A proof-of-concept scanner to check an RDP Gateway Server for vulnerabilities CVE-2020-0609 & CVE-2020-0610. Tested on: Windows Server 2012 x64 Windows Server 2016 x64 Windows Server 2019 x64 Disclaimer Scanning for memory corruption vulnerabilities is...

PunchingBag-for-React2Shell

🥊 PunchingBag - CVE-2025-55182 Security Research Platform ⚠️ EDUCATIONAL PURPOSE ONLY : This is an intentionally vulnerable application designed for authorized security research and CTF challenges. Do NOT use these techniques on unauthorized systems. A deliberately vulnerable Next.js 15.1.6...

WPS-CVE-2022-24934

Warning THIS PROGRAM USE GENERIC WHICH IS INTRODUCED IN GO 1.18, UPGRADE YOUR COMPILER! CVE-2022-24934 Web Server for exploiting this vuln by utilizing wpsupdate.exe Fake WPS Update Server PoC Research Purpose Only. Download file Set the file you want to send to client as environment variable:...

CVE-2025-55182-Lab

CVE-2025-55182 – Local RCE Lab React Server Components This repository is a small local lab to understand how CVE-2025-55182 works in practice on a deliberately vulnerable React Server Components / Next.js application. It is meant for education, blue teaming and secure development awareness only...

CVE-2024-22274-RCE

Privilege Escalation: VMware vCenter Server Authenticated RCE 📜 Description The “com.vmware.appliance.recovery.backup.job.create” and the “com.vmware.appliance.recovery.backup.validate” API components are vulnerable to a flag injection attack that can be leveraged to execute arbitrary commands as...

CVE-2023-22527-POC

CVE-2023-22527: Atlassian Confluence Vulnerability Introduction The CVE-2023-22527 vulnerability is a critical security flaw in Atlassian Confluence, a widely used collaboration and documentation platform. This vulnerability exists in both Confluence Data Center and Confluence Server, which are...

pivotnacci

pivotnacci Pivot into the internal network by deploying HTTP agents. Pivotnacci allows you to create a socks server which communicates with HTTP agents. The architecture looks like the following: This tool was inspired by the great reGeorg. However, it includes some improvements: Support for...

PoC-CVE-2025-55182

The Script exploits CVE-2025-55182, an RCE that affects the React Server Components used in React.js and Next.js. Affected React Versions: 19.0.0 19.1.0 and 19.1.1 19.2.0 Next.js: Next.js 15.x all versions prior to fixes Next.js 16.0.0 initial alpha/beta/RC versions built on vulnerable React 19...

EP3_Redes

EP3Redes Implementations of HTML servers in GO for analysis of vulnerability CVE-2023-29406...

CVE-2023-22515

Confluence Vulnerability - CVE-2023-22515 📓 Introduction Atlassian was informed about a possible vulnerability that could be exploited and compromising the environment through administrative access. On October 4, 2023, Atlassian released a security advisory regarding CVE-2023-22515 which got a CV...

CVE-2025-55182-Scanner

🛡️ CVE-2025-55182 Scanner React2Shell Developed by:SainiON Hacks A standalone GUI tool to detect and demonstrate the React Server Components Remote Code Execution RCE vulnerability CVE-2025-55182 in Next.js applications. 📺 Demo & Tutorial Watch the full breakdown and tool demonstration on my...

evilact

evilact Fast vulnerability scanner for CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server Components. Supports bulk scanning, RCE confirmation, and high-performance concurrent checks. Install git clone https://github.com/cypholab/evilact.git cd evilact go build -o scanne...

CVE-2025-55182

🚨 NextRce — CVE-2025-55182 Next.js / React Server Components RCE NextRce is a security research tool demonstrating CVE-2025-55182 , a critical vulnerability in Next.js App Router applications using React Server Components RSC and Server Actions. This vulnerability allows an attacker to achieve...

Nimbo-C2

Nimbo-C2 Nimbo-C2 About Features Installation Easy Way Easier Way Usage Limitations, Warnings, Notes Contribution About Nimbo-C2 is yet another simple and lightweight C2 framework. Nimbo-C2 agent supports x64 Windows & Linux. It's written in Nim, with some usage of .NET on Windows by dynamically...

bepr

bepr bepr is a tiny authenticated client/server reverse shell program over outbound WebSocket connections. A single binary cover all 3 mode: server mode, client mode, and user mode. It is packaged with installation direction for rpm, deb, and pkg, it comes in 1MB. I created bepr because I'm...

WSO2RCE

WSO2RCE The CVE-2022-29464 affects some WSO2 products such as WSO2 API Manager and WSO2 Open Banking , allowing arbitrary file upload and remote code execution. Affected Products: WSO2 API Manager 2.2.0, up to 4.0.0 WSO2 Identity Server 5.2.0, up to 5.11.0 WSO2 Identity Server Analytics 5.4.0,...