CVE-2026-105791 Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the runshell tool in the CommandLineExecutor component of ufo/client/mcp/localservers/climcpserver.py validates only the first token of the bashcommand parameter and permits...

CVE-2020-15778-SCP-Command-Injection-Check

CVE-2020-15778 – OpenSSH SCP Command Injection Vulnerability Detection Script About CVE-2020-15778 is a command injection vulnerability discovered in the scp utility provided by OpenSSH versions ≤ 8.3p1. The issue allows an attacker to execute arbitrary commands on the client system if a crafted...

spring-cloud-function-rce

Spring Cloud Function SPEL Expression Injection Vulnerability CVE-2022-22963 Spring framework provides a comprehensive programming and configuration model for modern Java-based enterprise applications on any type of deployment platform. The serverless framework in Spring Cloud, the RoutingFunctio...

CVE-2026-26719

描述 摘要 xxl-job-admin 中的 JobInfoController.java 存在一个存储型跨站脚本（XSS）漏洞，其中 addressList 参数接受未经消毒的 URL 编码 JavaScript。该载荷被存储后，会在用户浏览器中执行，导致未授权操作。 受影响产品 xxl-job 3.4.0 影响 xxl-job-admin v3.4.0 中的跨站脚本漏洞允许远程攻击者通过包含恶意脚本的精心构造的 HTTP GET 请求执行任意代码。 概念验证...

CVE-2017-11882

CVE-2017-11882 43b original script from https://github.com/embedi/CVE-2017-11882 109b original script from https://github.com/unamer/CVE-2017-11882/ Kudos, now unamer's code can execute shellcode CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE...

CVE-2024-3660-PoC

CVE-2024-3660 – TensorFlow Keras Arbitrary Code Execution via Malicious Model Overview CVE-2024-3660 is an arbitrary code execution vulnerability in TensorFlow's Keras framework affecting versions \ --build-arg LPORT= \ -t tfimg . && \ containerid=$docker create tfimg && \ docker cp...

ExploitTensorflowCVE-2021-37678

CVE-2021-37678 Exploit To exploit the vulnerability, it is necessary to start a Docker container with an environment prepared to run Tensorflow with version 2.2.3 which still has the vulnerability. It consists of: An AMD 64-bit architecture, CPU or GPU that can execute AVX instructions Python...

Code-27-Companion-Hub-Exploits

Code 27 3D Companion Hub 漏洞（CVE-2026-36027, CVE-2026-36028） Code 27 3D Companion Hub 是一款实体桌面设备，可渲染定制的 AI 角色（"Codie"）作为动画化的 3D 伴侣。用户可以上传或创建任意 3D 模型，多模态 AI 使角色能够观察周围环境、读取语气和肢体语言，并进行开放式对话。 本文涉及两个需要物理接触设备的漏洞。两者均在以下构建版本上验证，且在发布时尚未修补。 受影响设备 / 构建版本 字段| 值 ---|--- 产品| Code 27 3D Companion Hub Companion Hu...

CVE-2022-30525

CVE-2022-30525 Zyxel 防火墙命令注入漏洞 CVE-2022-30525 POC&EXP author:160team.west9B 仅限用于安全研究人员在授权的情况下使用，遵守网络安全法，产生任何问题，后果自负，与作者无关。 01-基本介绍 2022 年 5 月 12 日，Zyxel（合勤）发布安全公告，修复了其防火墙设备中未经身份验证的远程命令注入漏洞（CVE-2022-30525），该漏洞的CVSS评分为9.8。该漏洞存在于某些Zyxel防火墙版本的 CGI 程序中，允许在未经身份验证的情况下在受影响设备上执行任意命令。 影响范围: ATP系列固件：5.10-5....

CVE-2024-24787-PoC

CVE-2024-24787-PoC En Darwin, compilar un módulo de Go que contenga CGO puede desencadenar la ejecución de código arbitrario al usar la versión de ld de Apple, debido al uso de la bandera -ltolibrary en una directiva 'cgo LDFLAGS'. Este no es mi error, solo hice un PoC para el mismo. Referencia...

CVE-2025-25014

POC for CVE-2025-25014 A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints. Currently this POC only detects vulnerable instances. Usage python CVE-2025-25014.py -u username -p password --proxy proxyu...

CVE-2019-7482

Multiple Vulnerabilities in SonicWall SMA/SRA Appliances CVE-2019-7481, CVE-2019-7482,CVE-2019-7483, CVE-2019-7484, CVE-2019-7485, CVE-2019-7486 First Published: 26 Feb 2020 14:00 GMT Status: Developing Last Updated: 26 Feb 2020 14:00 GMT CVSS Score: 9.8 Summary On 18 Dec 2019, SonicWall CSIRT...

asrockploit

ejecución de código arbitrario con CVE-2020-15368...

vulnerable-PDF

vulnerable-PDF = Salaries.pdf - modo develоpe: 08.10.2022 NOTA: Esto es solo para pruebas y puedes abrir solo una calculadora, el programa integrado de Microsoft. = O puedes usar el archivo PDF para descargar calc.exe en un directorio prohibido :D ¡ADVERTENCIA! Solo para pruebas y educación =...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

PS4-5.05-Kernel-Exploit

PS4 5.05 Kernel Exploit Resumen En este proyecto encontrarás una implementación completa del segundo exploit de kernel "bpf" para la PlayStation 4 en la versión 5.05. Te permitirá ejecutar código arbitrario como kernel, para permitir el jailbreak y modificaciones a nivel de kernel del sistema. Es...

Deathnote

Deathnote CVE-2022-30190 的概念验证 当 MSDT 通过 URL 协议从调用应用程序（如 Word）调用时，存在一个远程代码执行漏洞。成功利用此漏洞的攻击者可以以调用应用程序的权限运行任意代码。然后，攻击者可以安装程序、查看、更改或删除数据，或在用户权限允许的上下文中创建新帐户。 使用恶意 Microsoft Word 文档创建 "Deathnote" MS-MSDT 攻击，并通过 HTTP 服务器部署载荷。 用法 usage: follina.py -h --command COMMAND --output OUTPUT --interface INTERFAC...

CVE-2020-7247-POC

Foreword Key facts about the exploit Installing the vulnerable server Configuration Environment disclaimers Exploit Manual Exploitation Scripted Exploitation Foreword This repository should serve as a base to set up and exploit CVE-2020-7247 in a controlled and private environment. All of the...

CVE-2021-4034

CVE-2021- A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling...