CVE-2025-55182

CVE-2025-55182 — React2Shell: Advanced Exploit & Master's Thesis Research -brightred Deserialization of Untrusted Data + Prototype Pollution in React Server Components Unauthenticated Remote Code Execution via Next.js Server Actions Affected: React 19.0.0 - 19.2.0 · Patch: React 19.0.1 / 19.1.2 /...

CVE-2026-111386

The Nezha platform, versions 1.7.0 before 2.3.15 , is vulnerable to an information disclosure flaw. Authenticated members can perform Cross-Tenant Server-ID Enumeration by leveraging differential responses from the getServerConfig and setServerConfig functions. By sweeping sequential IDs, an atta...

CVE-2026-111378

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parsenlamodepdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffe...

MSSQLand

✈️ MSSQLand Land gracefully in your target Microsoft SQL Server MS SQL DBMS, as if arriving on a business-class flight with a champagne glass in hand. 🥂 MSSQLand is a C Microsoft SQL Server MSSQL / MS SQL post-exploitation tool built for red team operators. Designed to run inside the target...

sh4d0wup

sh4d0wup % docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h Usage: sh4d0wup OPTIONS Commands: bait Start a malicious update server front Bind a http/https server but forward everything unmodified infect High level tampering, inject additional commands into a package tamper Low level tampering,...

CVE-2016-10140-Zoneminder-Poc

ZoneMinder Unauthorized Access CVE-2016-10140 Poc -- Batch Verification Script Vulnerability Description ZoneMinder is an open-source video surveillance system. When abnormal events occur, you can receive email or SMS notifications. There is an information disclosure and authentication bypass...

mose

MOSE Master Of SErvers Copyright 2020 National Technology & Engineering Solutions of Sandia, LLC NTESS. Under the terms of Contract DE-NA0003525 with NTESS, the U.S. Government retains certain rights in this software MOSE is a post-exploitation tool that helps security professionals leverage...

jebmcp

A quick-and-dirty MCP server&Plugin for JEB Pro. Tested on Cline & Cursor & RooCode. Reference: https://github.com/mrexodia/ida-pro-mcp Installation Requirements Python = 3.11 uv: https://docs.astral.sh/uv/getting-started/installation/ Usage COPY the src/jebmcp/MCP.py to...

CVE-2023-22515-POC

CVE-2023-22515 CVE-2023-22515, a critical vulnerability affecting on-premises instances of Confluence Server and Confluence Data Center, a Broken Access Control vulnerability. Attlassian has provided a CVSS base score of 10.0 Exploit Brief explanation: 1- Due to how Xwork interceptors parses...

CVE-2025-55182

RSC/Next.js RCE Vulnerability Detector & PoC Chrome Extension CVE-2025-55182 & CVE-2025-66478 This repository contains a security research toolkit designed to detect and demonstrate PoC the recently disclosed RCE vulnerabilities affecting React Server Components RSC / Next.js. The toolkit include...

BirDuster

BirDuster About BirDuster is a Python based knockoff of the original DirBuster. BirDuster is a multi threaded Python application designed to brute force directories and files names on web/application servers. Often is the case now of what looks like a web server in a state of default installation...

SMBGhost

SMBGhost Simple scanner for CVE-2020-0796 - SMBv3 RCE. The scanner is for meant only for testing whether a server is vulnerable. It is not meant for research or development, hence the fixed payload. It checks for SMB dialect 3.1.1 and compression capability through a negotiate request. A network...

GenGravSSTIExploit

EN GenGravSSTIExploit is a PoC Python script that exploits an authenticated Server-Side Template Injection SSTI vulnerability in Grav CMS versions -p : Target URL in the format https://hostname. : Port number default is 80. Example: python GenGravSSTIExploit.py -t http://example.com -p 8080 4...

react2shell-ultimate

React2Shell Ultimate Scanner v2.0 Professional Next.js RSC RCE Vulnerability Scanner for CVE-2025-66478 🎯 Overview React2Shell Ultimate is a comprehensive vulnerability scanner for CVE-2025-66478 - a critical Remote Code Execution RCE vulnerability affecting Next.js applications using React Serve...

log4shell-rmi-poc

log4shell-rmi-poc A Proof of Concept of the Log4j vulnerability CVE-2021-44228 over Java-RMI It uses Log4j 2.5.7 from spring-boot-starter-log4j2 Requirements: Tested with Java 8 JDK 1.8.025 and Java 11 JDK 11.0.1 How to run the POC 1. Clone the repo: git clone...

CVE-2021-42013-Apache-RCE-Poc-Exp

Vulnerability Name Apache Remote Code Execution CVE-2021-42013 Vulnerability Description Apache HTTP Server is an open-source web server from the Apache Software Foundation. It is fast, reliable, and extensible via a simple API. It was discovered that the fix for CVE-2021-41773 in Apache HTTP...

PoC-CVE-2021-41773

CVE-2021-41773 PoC Proof of concept to check if hosts are vulnerable to CVE-2021-41773. Description https://vulners.com/cve/CVE-2021-41773 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49-2.4.50. An attacker could use a path traversal attack to map URLs to file...

CVE-2026-18782-TREX-MES-Uygulamalarinda-SQL-Zafiyeti

TREX-MES-Uygulamalarında-SQLi-Zafiyeti CVE-2026-18782 Genel Bakış TREX MES, üretim sahasından veri toplamak ve yönetmek için kullanılan ticari bir Üretim Yürütme Sistemi MES / Endüstri 4.0 platformudur. Uygulamanın web API'si, istemciden gelen sql parametresi doğrudan arka uçtaki Microsoft SQL...

telnet-iot-honeypot

Disclaimer This project neither supported or in development anymore. It is based on python2 which has reached its EOL in 2020 and uses dependencies which are getting harder to install over time. Use at your own risk! Telnet IoT honeypot 'Python telnet honeypot for catching botnet binaries' This...

CLEANSTART-2026-VR65122 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...