CVE-2026-1281-CVE-2026-1340-Ivanti-EPMM-RCE

Ivanti EPMM pre-auth RCE Dummy Target A simple demo application that shows how to reproduce the Ivanti EPMM pre-auth RCE vulnerability CVE-2026-1281 / CVE-2026-1340 for educational and security research purposes. Vulnerability Overview This vulnerability exploits Bash arithmetic expansion behavio...

CVE-2024-6387_PoC

Summary This is essentially a statistical vulnerability: a large number of attempts are required to win the race condition and successfully execute arbitrary code. Attackers need to overcome many obstacles, Schwartz told SecurityWeek. "Even in the best-case scenario, the most well-known...

CVE-2024-57487-and-CVE-2024-57488

Online Car Rental System Vulnerabilities This repository contains details about the vulnerabilities identified in Code-Projects Online Car Rental System project Version 1.0. The vulnerabilities have been assigned CVEs and include comprehensive writeups to assist in understanding and mitigating th...

CVE-2025-24893

Infos This PoC first tests for the SSTI and if it works. It will go in loop and allows you to run commands remotly. The exec and shell command do the same currently. Usage Connecting python3 poc.py Example With debug set to False default python3 poc.py http://127.0.0.1:8080 Targeting...

CVE-2023-46474

PMB =7.5.3 - Remote Code Execution via Unrestricted File Upload CVE-2023-46474 CVSS v3.1 Vector| CVSS v3.1 Score ---|--- AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H| 9.1 Discovered during a penetration test by Marcus Reynaud of Devensys Cybersecurity Description The script pmb/admin/convert/startimport.p...

spinnaker-poc

Spinnaker Vulnerability POCs Proof-of-concept demonstrations for CVE-2026-32604 and CVE-2026-32613, two 10.0 severity vulnerabilities in Spinnaker that allow for code execution and production cloud credential theft. Video walkthrough of how to use these POCS Technical blog with more details...

CVE-2026-7229-SQLI

Authenticated SQL Injection in Coaching Management System Allows Database Dump Description A SQL Injection vulnerability exists in the Coaching Management System in PHP. The complaintreply parameter in the admin reply functionality is not properly sanitized before being used in SQL queries. An...

CVE-2026-1560-Authenticated-Remote-Code-Execution-in-Lazy-Blocks-4.2.0

CVE-2026-1560 – Authenticated Remote Code Execution in Custom Block Builder – Lazy Blocks ≤ 4.2.0 Researcher : ZeYrOXxx Plugin : Custom Block Builder – Lazy Blocks Affected Versions : ≤ 4.2.0 Severity : High CVSS : 8.8 Vulnerability Type : Authenticated Remote Code Execution RCE Attack Vector :...

CVE-2021-44521

CVE-2021-44521 Automated PoC of CVE-2021-44521 Credits to original poc: https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/ Requirements Cassandra-driver pip3 install cassandra-driver Usage python3 poc.py Note that you can't do more...

CVE-2023-22527

CVE-2023-22527 This repository presents a proof-of-concept of CVE-2023-22527 CVE-2023-22527 | RCE using SSTI in Confluence Disclamer This code is a proof of concept of the vulnerability, I'm not pushing anyone to use it on confluence instances they don't own. This tool has been developed for...

CVE-2021-31805

CVE-2021-31805 Remote code execution S2-062 CVE-2021-31805 Due to Apache Struts2's incomplete fix for S2-061 CVE-2020-17530, some tag attributes can still execute OGNL expressions, The vulnerability allows an attacker to construct malicious data to remotely execute arbitrary code...

cve-2026-31431-fleet-remediator

CVE-2026-31431 Fleet Audit and Remediation Tool 中文说明 This project is a fleet-scale orchestrator for auditing and remediating CVE-2026-31431 on Linux hosts in enterprise/internal networks. Batch SSH login to multiple hosts Risk evidence collection and status classification Temporary mitigation...

CVE-2026-41177-Squidex-CMS

CVE-2026-41177: Squidex CMS Blind SSRF Technical research and analysis for CVE-2026-41177: A Blind Server-Side Request Forgery SSRF vulnerability in the Squidex CMS Restore API. Vulnerability Overview CVE ID: CVE-2026-41177 Affected Component: Squidex API: Backup / Restore Engine /api/apps/restor...

CVE-2026-21440-POC-EXP

Complete CVE-2026-21440 Vulnerability Information 📁 Brief steps for using the CVE-2026-21440 PoC script 1. Install dependencies python -m pip install --upgrade pip 2. Run the test python CVE-2026-21440-code.py -h 3. 6 built-in preset sensitive paths -s for direct invocation, no need to type long...

CVE-2026-21962

CVE-2026-21962 CVE-2026-21962 EXAMPLE Single target python3 CVE-2026-21962.py http://target:7001 -c "whoami" Batch + default whoami python3 CVE-2026-21962.py -f url.txt Batch + custom command + change thread count python3 CVE-2026-21962.py -f url.txt -c "id" --threads 20 -o result.txt Reverse she...

berdav-CVE-2021-4034

CVE-2021-4034 One day for the polkit privilege escalation exploit Just execute make, ./cve-2021-4034 and enjoy your root shell. The original advisory by the real authors is here PoC If the exploit is working you'll get a root shell immediately: vagrant@ubuntu-impish:/CVE-2021-4034$ make cc -Wall...

CVE-2026-23885

Security Advisory: CVE-2026-23885 Authenticated Remote Code Execution RCE in AlchemyCMS 1. Executive Summary A critical security vulnerability involving Improper Neutralization of Directives in Dynamically Evaluated Code CWE-95 was discovered in the AlchemyCMS framework. The vulnerability allows...

PATCH-CVE-2026-31431-Ubuntu_Debian

🛡️ CVE-2026-31431 Copy Fail Mitigation - Linux Kernel This repository contains scripts designed to neutralize the critical vulnerability CVE-2026-31431 , nicknamed "Copy Fail" , on Ubuntu systems. !IMPORTANT Compatibility: These scripts are tailored for and tested on Ubuntu Server 24.04 LTS. While...

CVE-2021-4034

CVE-2021-4034 polkit privilege escalation exploit Just execute make, ./cve-2021-4034 and enjoy your root shell. The original advisory by my Qualys team here PoC If the exploit is working you'll get a root shell immediately: kali@user:/CVE-2021-4034$ make cc -Wall --shared -fPIC -o pwnkit.so...

LongBow

Archer TP-Link VR1600V Router Local Remote Command Execution Exploit CVE-2023-31756 Overview This Python script demonstrates a local remote command execution vulnerability within the Archer TP-Link VR1600V V1/V2 routers. The exploit allows for administrative-level operating system access on the...