ipfire-2-25-auth-rce

Ipfire 2-25 core update 156 authenticated rce system run command when install any packet system getting 7zip from just html and check the tmp directory version 2.25 - core update 156 ipfire allows run arbitrary os command as nobody after login Be root! check the suid binaries backup program run...

Limesurvey-RCE

Limesurvey-RCE LimeSurvey Authenticated RCE Proof of Concept: 1. Create your files config.xml and php reverse shell files 2. Create archive with these files 3. Login with credentials 4. Go Configuration - Plugins - Upload & Install 5. Choose your zipped file 6. Upload 7. Install 8. Activate plugi...

CVE-2023-46747-RCE

漏洞详情 fofa： root@kitploit: title="BIG-IP" || iconhash="-335242539" shodan root@kitploit: title:"BIG-IP" 受影响版本 https://my.f5.com/manage/s/article/K000137353 漏洞复现 1. 此时，这里用户仅为 admin： 2. 执行脚本： root@kitploit: git clone https://github.com/W01fh4cker/CVE-2023-46747-RCE.git cd CVE-2023-46747-RCE pip...

CVE-2023-46304

CVE-2023-46304 Authenticated Remote Code Execution in VTiger Open Source CRM v7.5 Summary A vulnerability exists in the Users module in the current release of VTiger CRM Open Source version 7.5.0 which allows an authenticated attacker to write and execute arbitrary PHP code to config.inc.php...

CVE-2018-18852

CERIO路由器 已认证RCE（厂商后门凭据）CVE-2018-18852 Python PoC hook-s3c github.com/hook-s3c, @hooks3c 在Twitter上 针对CVE-2018-18852的有效Python PoC，最初发布在： https://github.com/hook-s3c/CVE-2018-18852 概述 CERIO路由器型号及变体包括DT300N、DT100G、AMR-3204、WMR-200N，存在已认证的基于Web的RCE漏洞，以root用户执行。 该漏洞以0day形式存在且未公开；...

CVE-2023-4861-PoC

CVE-2023-4861 PoC This repository contains a Python proof of concept for CVE-2023-4861 , an authenticated remote code execution issue in the WordPress plugin File Manager Pro - Filester. Vulnerability Summary CVE: CVE-2023-4861 Product: File Manager Pro - Filester filester Vulnerable versions:...

CVE-2026-25512-PoC-Group-Office-Authenticated-RCE

CVE-2026-25512 PoC – Group-Office Authenticated RCE via TNEF Handler Author: Mohammed Idrees Banyamer Handle: @banyamersecurity GitHub: mbanyamer Date: February 04, 2026 Exploit Title Group-Office Intermesh 26.0.4 – Authenticated RCE via TNEF Attachment Handler CVE CVE-2026-25512 CWE CWE-78 OS...

CVE-2026-16348

TP-Link Archer BE800 V1 — Authenticated RCE via VPN Key Injection CVE: CVE-2026-16348 CVSS: 8.5 High — CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L Auth required: Valid admin credentials Network position: Network remote if management interface exposed Summary The VPN server...

cve-2022-23636-poc

CVE-2022-23626 - m1k1o's Blog RCE Autenticado Ejecución Remota de Código Autenticada a través de una vulnerabilidad de carga de archivos en m1k1o's Blog v1.3 y anteriores. Descripción El endpoint ajax.php?action=uploadimage no valida correctamente los tipos de archivo subidos, permitiendo que un...

CVE-2025-54123

CVE-2025-54123 - Hoverfly Command Injection RCE PoC CVE-2025-54123 - Middleware Command Injection in Hoverfly 📌 CVE Details ID : CVE-2025-54123 Type : Command Injection / Remote Code Execution RCE Vendor : Hoverfly Impact : Allows authenticated attackers to execute arbitrary system commands via t...

CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field

Security Advisory: Camaleon CMS - Authenticated RCE via selecteval Custom Field Assigned CVE ID: CVE-2026-66748 Product: Camaleon CMS https://github.com/owen2345/camaleon-cms Affected versions: 2.1.1 – 2.9.1 introduced commit 415cbda6 2015-10-16; fixed commit 15882366 2026-03-29 / v2.9.2 Severity...

CVE-2026-23885

セキュリティアドバイザリ: CVE-2026-23885 AlchemyCMSにおける認証済みリモートコード実行（RCE） 1. エグゼクティブサマリー AlchemyCMSフレームワークにおいて、動的評価コードにおけるディレクティブの不適切な無害化（CWE-95） に関わる重大なセキュリティ脆弱性が発見されました。この脆弱性により、管理者権限を持つ認証済みユーザーが、eval インジェクションシンクを介して、ホストサーバー上で任意のRubyコードおよびシステムコマンドを実行できる可能性があります。 2. 技術的脆弱性分析 脆弱なコンポーネント ファイル:...

CVE-2026-55511

CVE-2026-55511: RCE autenticado en Yamcs StreamSQL Prueba de concepto no armada y documentación técnica para CVE-2026-55511, una vulnerabilidad autenticada de inyección de código Java en el compilador de expresiones agregadas StreamSQL de Yamcs...

CVE-2023-41425-WonderCMS-Authenticated-RCE

CVE-2023-41425-WonderCMS-Authenticated-RCE Description WonderCMS v3.2.0 - v3.4.2 is vulnerable. Remote attackers can take full control of the server using a Cross-Site Scripting XSS exploit For educational purposes only . Here's the game plan: How it works: The exploit abuses the installModule...

cve-2021-31630

cve-2021-31630 OpenPLC WebServer v3 - 인증된 RCE 이 PoC 스크립트는 Fellipe Oliveira가 제공한 익스플로잇을 기반으로 합니다. 기능 : st 파일 업로드 대신 /hardware에 C 코드를 직접 업로드합니다 리버스 셸 업로드 전에 기본 프로그램을 복원합니다 웹 서버가 멈추지 않도록 비차단non-blocking 방식으로 개선된 C 기반 리버스 셸 ; 셸을 백그라운드에서 실행하며, PLC가 중지된 후에도 종료할 때까지 작동합니다 정리cleanup root@kitploit: $ pyth...

CVE-2019-19356

NETIS router WF2419 RCE CVE-2019-19356 Context The vulnerability is an authenticated Remote Code Execution RCE as root through the NETIS WF2419 router Web management page. The vulnerability has been found on firmware version V1.2.31805 and on the last available firmware version V2.2.36123. Other...

CVE-2025-68613

🚀 n8n 인증 RCE PoC Pocsuite3 CVE ID : CVE-2025-68613 유형 : 인증된 원격 코드 실행 프레임워크 : Pocsuite3 이것은 Pocsuite3 프레임워크 기반으로 작성된 취약점 검증 및 이용 스크립트로, n8n 워크플로 자동화 도구의 인증 후 원격 코드 실행 취약점RCE을 탐지합니다. 이 스크립트는 무해한 검증Verify 및 명령 실행Attack 두 가지 모드를 지원하며, 테스트 흔적을 자동으로 정리하는 기능도 갖추고 있습니다. ⚙️ 매개변수 설명 이 스크립트는 Pocsuite3의 기본...

Havoc-C2-SSRF-to-RCE

Havoc-C2-SSRF-to-RCE This is a modified version of the CVE-2024-41570 SSRF PoC from @chebuya chained with the auth RCE exploit from @hyperreality. This exploit executes code remotely to a target due to multiple vulnerabilities in Havoc C2 Framework...

cve-2025-2945-poc

pgAdmin4 쿼리 도구 인증 RCE PoC pgAdmin4 8.10 - 9.1 버전에서 pgAdmin4 쿼리 도구 인증 RCE 취약점CVE-2025-2945을 악용하는 독립 실행형 파이썬 스크립트입니다. Metasploit 모듈에서 포팅됨: pgadminquerytoolauthenticated.rb 참조: https://vulners.com/cve/CVE-2025-2945 https://nvd.nist.gov/vuln/detail/CVE-2025-2945...

motioneye-authenticated-RCE

MotionEye/MotionEyeOS Authenticated RCE A Python 3 script that uploads a tasks.pickle file that enables RCE in MotionEye. You need administrator credentials, so it should not be that big of a deal. Unfortunately, MotionEye/MotionEyeOS can frequently be found running with default credentials...