CVE-2022-21445

CVE-2022-21445 Exploit - PoC This toolkit generates exploit payloads for CVE-2022-21445, a critical Java deserialization vulnerability affecting Oracle WebLogic Server 12.2.1.x running Oracle ADF Faces. The flaw exists in the RemoteApplicationResourceLoader component and allows an attacker to sen...

CVE-2024-36401-poc

CVE-2024-36401 — RCE por Inyección XPath OGC en GeoServer Exploit de ejecución remota de código sin autenticación para GeoServer mediante inyección del parámetro valueReference de filtro OGC evaluación XPath/JXPath. Aviso legal: Esta herramienta está diseñada únicamente para pruebas de penetració...

CVE-2026-45332-PoC

CVE-2026-45332: Broken Access Control in Automad CMS Proof of concept for CVE-2026-45332 , a Broken Access Control vulnerability in Automad CMS that allows any unauthenticated attacker to dump the bcrypt password hash and TOTP secret of every administrator account through the setup endpoint, whic...

CVE-2026-50751

CVE-2026-50751 Escáner IKEv1 de Check Point Un escáner de vulnerabilidades multihilo para CVE-2026-50751 , una vulnerabilidad crítica de omisión de autenticación IKEv1 que afecta a los Check Point Quantum Security Gateways. Resumen Los sistemas VPN de acceso remoto de Check Point con IKEv1...

CVE-2026-0257

🚨 CVE-2026-0257 - 身份验证绕过漏洞 PAN-OS：GlobalProtect 身份验证绕过漏洞 GlobalProtect 门户和网关中的身份验证绕过 📌 概述 CVE-2026-0257 是一个影响 Palo Alto Networks PAN-OS 软件中 GlobalProtect 门户和网关组件的身份验证绕过漏洞 。 未经身份验证的远程攻击者可以绕过安全限制，在受影响防火墙上建立未经授权的 VPN 连接 。 注意 ：Panorama 和 Cloud NGFW 不受影响 。 ⚠️ 严重性与评分 指标 --- 向量（CVSS 4.0 示例） ：...

CVE-2026-37067

CVE-2026-37067 Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2026-15409

🚨 CVE-2026-15409 Critical Unauthenticated SSRF in SonicWall SMA1000 Series Critical Server-Side Request Forgery SSRF vulnerability affecting SonicWall SMA1000 Series appliances. This repository documents the vulnerability, affected products, technical overview, impact, detection guidance, and...

CVE-2025-9074

CVE-2025-9074: Docker Engine API Unauthenticated RCE Severity : CRITICAL | CVSS Score : 9.8 estimated | Affected Versions : Docker Desktop 4.44.3 A proof-of-concept exploit for CVE-2025-9074, an unauthenticated Remote Code Execution vulnerability in Docker Engine API that allows privileged...

CVE-2025-32433-Exploit-edited

CVE-2025-32433 Exploit Windows Compatible Erlang/OTP SSH Unauthenticated Remote Code Execution Description This repository contains an exploit for CVE-2025-32433, a critical unauthenticated remote code execution vulnerability in Erlang/OTP SSH server. Key Features: ✅ Pre-authentication RCE exploi...

FreePBX-SQLi-RCE

FreePBX CVE-2025-57819 - Unauthenticated SQLi to RCE PoC Educational & Security Research Only - See Legal Notice Below Exploitation proof of concept for CVE-2025-57819, a critical unauthenticated SQL injection vulnerability in FreePBX that allows remote code execution. This PoC is published after...

CVE-2019-15107

CVE-2019-15107 This repo contains a small script in bash to exploit CVE-2019-15107 without using metasploit. Use is pretty straightforward, just download and execute, no dependencies root@kitploit: root@kali: ./webmin-CVE-2019-15107.sh 10.10.73.185 'uname -a' Error - Perl execution failed Your...

SessionReaper-CVE-2025-54236

SessionReaper — CVE-2025-54236 Unified PoC for CVE-2025-54236 "SessionReaper", a critical unauthenticated RCE in Magento 2 / Adobe Commerce via nested deserialization in the REST API. CVSS: 9.1 Critical Root cause: Improper Input Validation CWE-20 in ServiceInputProcessor; the exploit primitive i...

CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day

CVE-2025-54253: Inside the Adobe AEM-Forms Zero-Day — What Pentesters & Defenders Must Do TL;DR: Adobe Experience Manager AEM Forms on JEE ≤ 6.5.23.0 contained a critical, network-accessible flaw CVE-2025-54253 that allows unauthenticated remote code execution via misused Struts/OGNL endpoints. A...

CVE-2024-48326

CVE-2024-48326 Descripción: Portabilis i-Educar v2.8.0 es vulnerable a Cross-Site Scripting XSS a través del parámetro nmreligiao en la solicitud POST en /intranet/educarreligiaocad.php y se activa en la solicitud GET en /intranet/educarreligiaolst.php?busca=S&nmreligiao=. Esto permite que un...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps for WordPress Unauthenticated XSS in iframe map rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-56011, an unauthenticated Cross-Site Scripting vulnerability affecting MapPress Maps for WordPress. MapPre...

CVE-2023-22515-Scan.

Escaneo CVE-2023-22515 Acerca de Este es un escáner simple para CVE-2023-22515, una vulnerabilidad crítica en Atlassian Confluence Data Center y Server que está siendo explotada activamente en la naturaleza por actores de amenazas para "crear cuentas de administrador de Confluence no autorizadas ...

CVE-2023-25157-GeoServer-SQLi-Lab

GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-25158 — Vulnerability Lab & PoC Report Practical environment Vulnerable Lab and detailed exploitation analysis report for SQL Injection Error-based vulnerability in GeoServer CVE-2023-25157 and the GeoTools library CVE-2023-25158...

CVE-2026-20253

Splunk Enterprise — Laboratorio de Entrenamiento CVE-2026-20253 Splunk Enterprise 10.2.3 · sidecar de recuperación PostgreSQL · CWE-306 Autenticación faltante para función crítica Una reproducción autorizada y autocontenida que modela el aviso real para educación defensiva. No incluye código...

CVE-2026-49777

CVE-2026-49777 CVE-2026-49777 - ShapedPlugin Product Slider Pro for WooCommerce Backdoor RCE In-Depth Technical Analysis: Product Slider Pro Backdoor Vulnerability Vulnerability Basis and Cause CWE-1284 The technical origin of the vulnerability is classified as CWE-1284: "Improper Validation of...

CVE-2026-40791-WP-Time-Slots-Booking-Form-XSS

CVE-2026-40791: One Booking Slot to Admin XSS I found an unauthenticated stored XSS in the WordPress WP Time Slots Booking Form plugin. A public booking submission controls part of the stored time-slot value. The plugin later prints that value into the administrator Booking Orders page without...