CVE-2025-54253-Exploit-Demo

🚨 CVE-2025-54253 – Adobe AEM Forms on JEE OGNL Injection to RCE 🔎 Overview CVE-2025-54253 is a critical OGNL injection vulnerability in Adobe AEM Forms on JEE. It allows unauthenticated attackers to execute arbitrary operating system commands via the /adminui/debug?debug=OGNL: endpoint. Severity:...

CVE-2022-22965

Spring Boot CVE-2022-22965 Docker PoC for CVE-2022-22965 with Spring Boot version 2.6.5 🚀 Getting Started 1. Download the distribution code from https://github.com/itsecurityco/CVE-2022-22965/archive/refs/heads/master.zip and unzip it. 2. Run docker compose up --build to build and start the...

CVE-2025-55182-checker

CVE-2025-55182 Vulnerability Detector - Enhanced Edition A comprehensive vulnerability detection tool for CVE-2025-55182 in React/Next.js applications with multiple detection techniques. ⚠️ Legal Disclaimer FOR AUTHORIZED SECURITY TESTING AND RESEARCH PURPOSES ONLY This tool is designed for:...

CVE-2025-3248-POC

Langflow RCE Exploit - CVE-2025-3248 ⚠️ Disclaimer This code is strictly intended for educational and research purposes only. Unauthorized use on systems without explicit permission may constitute a violation of the law. The author is not responsible for any misuse or malicious activity involving...

CTT-Serverless-RCE-v1.0---Convergent-Time-Theory-Enhanced-MCP-Exploit

hi CTT-Serverless-RCE-v1.0---Convergent-Time-Theory-Enhanced-MCP-Exploit Serverless Framework MCP Server CVE-2025-69256 Base Score: 9.4/10 → CTT Enhanced Score: 9.9/10 A critical command injection vulnerability in Serverless Framework's MCP Model Context Protocol server enhanced with CTT temporal...

neet

NEET - Network Enumeration and Exploitation Tool Neet is a flexible, multi-threaded tool for network penetration testing. It runs on Linux and co-ordinates the use of numerous other open-source network tools, with the aim of gathering as much network information as possible in clear, easy-to-use...

CVE-2025-24893-PoC

Disclaimer: The vulnerabilities and reproduction steps described in this document are intended solely for cybersecurity research and educational purposes. No one shall use the information provided in this document for illegal purposes or unauthorized system testing. The author assumes no...

CVE-2020-14372

CVE-2020-14372: Bypassing not so Secure Boot with one "simple trick" Vulnerability details One day I typed "help" into GRUB2's console and saw some really "fun" commands: readbyte ADDR: Read 8-bit value from ADDR writebyte ADDR VAL: Write 8-bit value VAL to ADDR I immediately thought I found the...

CVE-2024-32019-ndsudo-local-privilege-escalation-NetData

CVE-2024-32019 Proof of Concept Python A Python implementation of the Local Privilege Escalation LPE exploit for Netdata CVE-2024-32019. This script exploits a vulnerability in the ndsudo component where the PATH environment variable is not properly sanitized. This allows a local attacker to...

POC-CVE-2025-55182

POC-CVE-2025-55182 credit : https://github.com/Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478 usage: CVE-2025-55182-Exp.py -h -u URL -l LIST -c COMMAND -i --revshell LHOST LPORT -t THREADS --proxy PROXY --timeout TIMEOUT -v Usage Single target exploit python3 CVE-2025-55182-Exp.py -u...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit A security research tool for detecting and testing the CVE-2025-12735 vulnerability in the expr-eval and expr-eval-fork npm packages. ⚠️ Disclaimer This tool is for authorized security testing and educational purposes only. Unauthorized access to computer...

cpanel_xss_2023

About the Tool ⚒️ cpanelxss2023 is a simple Python script designed for finding CVE-2023-29489 vulnerability and exploitability in cpanel. Features ⚙️ CVE-2023-29489 Scanning: Identifies and scans for the CVE-2023-29489 vulnerability and exploitation. URL Input: Supports scanning a single URL or...

Octopus

What is Octopus ? Octopus is an open source, pre-operation C2 server based on python which can control an Octopus powershell agent through HTTP/S. The main purpose of creating Octopus is for use before any red team operation, where rather than starting the engagement with your full operational...

CVE-2021-38817-Remote-OS-Command-Injection

CVE-2021-38817-Inyección-remota-de-comandos-del-SO Inyección remota de comandos del sistema operativo autenticada/Ejecución remota de código en la parte web Sendmail de TastyIgniter v3.0.7 CVE-2021-38817 Existe una vulnerabilidad de inyección remota de comandos del sistema operativo autenticada e...

CMLoot

CMLoot CMLoot was created to easily find interesting files stored on System Center Configuration Manager SCCM/CM SMB shares. The shares are used for distributing software to Windows clients in Windows enterprise environments and can contains scripts/configuration files with passwords, certificate...

CVE-2020-3452-PoC

CVE-2020-3452 hello Guys This is a simple script to download the nmap NSE script and put in NSE modules file and run the nmap command with and hosts you want Put your host list in list.txt file Thanks...

h2t

h2t - HTTP Hardening Tool Description h2t is a simple tool to help sysadmins to hardening their websites. Until now h2t checks the website headers and recommends how to make it better. Dependences Python 3 colorama requests Install $ git clone https://github.com/gildasio/h2t $ cd h2t $ pip instal...

h2t

h2t - Herramienta de Endurecimiento HTTP Descripción h2t es una herramienta simple para ayudar a los administradores de sistemas a endurecer sus sitios web. Hasta ahora h2t verifica las cabeceras del sitio web y recomienda cómo mejorarlas. Dependencias Python 3 colorama requests Instalación $ git...

CVE-2026-103265

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command...

CVE-2026-103244

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session...