nextjs-CVE-2025-55182

CVE-2025-55182 / CVE-2025-66478 React2Shell - Next.js Remote Code Execution RCE PoC Critical vulnerability in Next.js Server Actions allowing unauthenticated Remote Code Execution via React Flight Protocol deserialization Overview This repository contains a Proof of Concept PoC for the critical R...

CVE-2025-55182-exploit

استغلال CVE-2025-55182 يحتوي هذا المستودع على استغلال بسيط لثغرة CVE-2025-55182 ، وهي ثغرة حرجة لتنفيذ التعليمات البرمجية عن بُعد في React Server Components. نظرة عامة على الثغرة CVE-2025-55182 هي ثغرة تنفيذ تعليمات برمجية عن بُعد بدون مصادقة في React Server Components بدرجة CVSS 10.0. تؤثر الثغر...

CVE-2024-20405

Description A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP...

CVE-2025-12139-WordPress-Integrate-Google-Drive-Exploit

CVE-2025-12139: Integrate Google Drive WordPress प्लगिन - सूचना प्रकटीकरण शोषण विवरण यह CVE-2025-12139 के लिए एक Golang प्रूफ ऑफ कॉन्सेप्ट PoC शोषण है। यह भेद्यता WordPress के लिए Integrate Google Drive प्लगिन संस्करण = 1.5.3 में मौजूद है। यह बिना प्रमाणीकरण वाले हमलावरों को संवेदनशील जानकारी...

CVE-2022-26810

CVE-2022-26809 RCE Exploit CVE description CVE-2022-26809 - weakness in a core Windows component RPC earned a CVSS score of 9.8 not without a reason, as the attack does not require authentication and can be executed remotely over a network, and can result in remote code execution RCE with the...

PSO - Printer Security Offensive

🖨️ PSO - Printer Security Offensive Version 0.4.0 | Changelog "Nmap for Printers" - Offensive security tool for printer pentesting. Fast. Focused. No bloat. ⚠️ Legal Notice PSO includes assessment and exploitation features. Always obtain explicit authorization before use. Safe mode: Scanning + IPP...

CVE-2025-67159

CVE-2025-67159 — Vatilon-based IP Cameras Summary Vatilon-based IP camera firmware contains an authentication bypass and plaintext credential exposure vulnerability in the /cgi-bin/web.cgi API. The web interface processes requests containing username and password parameters in plaintext without...

CVE-2025-54726

CVE-2025-54726 JS Archive List = 6.1.5 - Unauthenticated SQL Injection Description The JS Archive List plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

day04-nexus-4956

दिन 4 – Nexus Repository 3 पथ ट्रैवर्सल CVE-2024-4956 क्या: अप्रमाणित पथ ट्रैवर्सल किसी भी व्यक्ति को एक क्राफ्टेड URL के साथ मनमानी फाइलें डाउनलोड करने देता है। कमजोरी: Nexus Repo 3 संस्करण ≤ 3.68.0 को प्रभावित करती है। 3.68.1 में ठीक की गई। स्रोत: Sonatype सलाह + NVD। सुरक्षा: लैब केवल स्थानीय...

CVE-2025-55184

React2Shell PoC This repository provides a minimal intentionally vulnerable environment to test security scanners against the recent critical RCE vulnerability React2Shell affecting React Server Components and Next.js. CVE-2025-55182 : A pre-authentication remote code execution vulnerability exis...

CVE-2024-34102

CVE-2024-34102 POC for CVE-2024-34102 : Unauthenticated Magento XXE and bypassing WAF , You will get http connection on ur webhook root@kitploit: POST /rest/V1/guest-carts/1/estimate-shipping-methods HTTP/2 Host: example.com Accept: application/json, text/javascript, /; q=0.01 Content-Length: 310...

CVE-2025-64458-Demo

CVE-2025-64458 — Django Redirect DoS on Windows Description A denial-of-service DoS issue in Django’s redirect responses allows an attacker to trigger excessive CPU work during URL normalization when constructing redirect responses. On Windows, Python’s Unicode NFKC normalization is particularly...

CVE-2025-12721

g-FFL Cockpit = 1.7.1 - Unauthenticated Information Exposure The g-FFL Cockpit plugin does not implement proper authorization checks on the serverstatus REST API endpoint, allowing unauthenticated users to access sensitive server configuration information, PHP settings, database details, WordPres...

MongoBleed-CVE-2025-14847

MongoBleed CVE-2025-14847 – Vulnerability Checker Systemhaus Schulz – Security Tools A professional-grade security scanner to detect the MongoBleed CVE-2025-14847 MongoDB memory disclosure vulnerability. Unlike simple version-check tools, this scanner uses a PoC-accurate probing technique , safel...

CVE-2025-3248

CVE-2025-3248 — Langflow AI Remote Code Execution Unauthenticated Author: 0xgh057r3c0n Description This exploit targets a critical unauthenticated RCE vulnerability CVE-2025-3248 in Langflow AI. The vulnerability allows an attacker to execute arbitrary system commands on the target server via the...

CVE-2025-505050

CVE-2025- Des: unauthinticated access to uploaded files POC: navigate to any uploaded file it will be accesed without login Discovered by Aljohara Abdulmohsen Alsubaie...

CVE-2023-5359

CVE-2023-5359 - W3 Total Cache Cleartext Storage Vulnerability Description CVE-2023-5359 is a cleartext storage vulnerability affecting the WordPress plugin W3 Total Cache in versions ≤ 2.7.5. This vulnerability allows remote attackers to access sensitive credentials stored in unencrypted PHP fil...

CVE-2022-36267-PoC

CVE-2022-36267 - Airspan AirSpot 5410 Unauthenticated Remote Command Injection. Overview This repository contains a Proof of Concept PoC reverse shell script for exploiting CVE-2022-36267, a critical vulnerability in Airspan AirSpot 5410 devices. The script is a practical demonstration,...

CVE-2020-3452_Cisco_ASA_PathTraversal

CVE-2020-3452CiscoASAPathTraversal Proof-of-concept script for CVE-2020-3452 — Cisco ASA/FTD Path Traversal vulnerability. Supports automated extraction of known file targets with a hard limit on successful downloads for safety. Intended for authorized security testing and research purposes only....

CVE-2025-61882-CVE-2025-61884

CVE-2025-61882 & CVE-2025-61884 EDIT: Oracle just disclosed a new vulnerability CVE-2025-61884, the detection script for that vuln can be found in this repo or originally here:https://gist.github.com/rxerium/6c70bc6b72fc0d1365c85937d35d9550. As quoted from Oracle's security advisory: This Securit...