cve-2019-7192-check

Comprobador de RCE root sin autenticación en QNAP CVE-2019-7192 CVE-2019-7195 Uso: pip install requests ./CheckerforQNAPRCEcve2019719295.py /path/to/ip-port.txt Ejemplo de archivo de entrada: 1.2.3.4 8080 2.3.4.5 443 Esta herramienta toma una lista de IPs y puertos de NAS QNAP, e indica si cada...

wp2shell-poc

wp2shell PoC The first ever poc of the pre-auth timing-based SQL injection PoC for the WordPress REST API batch-route confusion chain CVE-2026-63030 + CVE-2026-60137 Achieved command execution, without just trying to crack the admins password. Affected: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Fixe...

CVE-2026-63030-POC

wp2shell — CVE-2026-63030 + CVE-2026-60137 One-day WordPress RCE exploit chain. Unauthenticated. CVSS 9.8. Zero dependencies — Python 3.8+ stdlib only. Affected Versions Branch| Vulnerable| Patched ---|---|--- 6.9.x| 6.9.0 – 6.9.4| ≥ 6.9.5 7.0.x| 7.0.0 – 7.0.1| ≥ 7.0.2 The Chain Two CVEs chained...

CVE-2026-20700

dyld-signing-oracle-poc A controlled exploration of dyld's page-in linking and chained fixup machinery as a PAC signing oracle, in the context of CVE-2026-20700. On arm64e, every function pointer is hardware-authenticated. The goal here is to show that dyld itself can be directed — through a...

CVE-2025-6018_CVE-2025-6019_autopwn

Chained Exploit CVE-2025-6018 & CVE-2025-6019 Auto-Pwn This repository contains a full exploit chain "Auto-Pwn" targeting two critical vulnerabilities primarily affecting openSUSE Leap 15.x / SUSE systems: 1. CVE-2025-6018 : PAM Environment Injection. Allows a user to modify sensitive variables...

MDaemon-Advisories

MDaemon-Advisories MDaemon Advisories: CVE-2021-27180 Reflected XSS CVE-2021-27181 CSRF Token Fixation CVE-2021-27182 Iframe injection CVE-2021-27183 Remote Code Execution Those vulnerabilities were already patched on January 2021 and are published for CVE purposes. They can be chained to achieve...

halo-record

halo-record Tamper-evident audit trails for AI agents — hash-chained Runtime Records, rendered as a Runtime Report your customers can check themselves. Every action your instrumentation captures tool calls, model calls, data access, approvals becomes one Runtime Record in an append-only,...

CVE-2024-41570-Havoc-C2-RCE

Havoc-C2-RCE CVE-2024-41570 This is a Chained RCE CVE-2024-41570 in the Havoc C2 framework. Command injection: Havoc is vulnerable to command injection enabling an authenticated user to execute commands on the Teamserver. Affects versions 0.3 up to the latest release 0.6. Havoc's default profile...

PrestaShop-CVE-2018-19126

PrestaShop Back Office Remote Code Execution CVE-2018-19126 This is the PoC for CVE-2018-19126, chaining multiple vulnerabilities in PrestaShop Back Office to trigger deserialization via phar to achieve remote code execution. Prerequisite: PrestaShop 1.6.x before 1.6.1.23 or 1.7.x before 1.7.4.4...

CVE-2024-9464

CVE-2024-9464: Palo Alto Expedition Authenticated Command Injection Proof of concept to exploit CVE-2024-9464 on vulnerable devices. This script chains the admin reset of CVE-2024-5910 to achieve "unauthenticated" arbitrary command execution. Blog Post Root cause and indicators of compromise here...

exploits-rconfig

exploits Three exploits for rconfig = 3.9.4 : CVE-2019-19509 : authenticated RCE CVE-2019-19585 : Local Privilege Escalation root CVE-2020-10220 : unauthenticated SQLi rconfigrootRCEunauth.py : chaining the three CVEs above to get root reverse shell without authentication...

pwn2own2020

Compromising the macOS Kernel through Safari by Chaining Six Vulnerabilities Overview This repository contains exploitation and technical details of our Pwn2Own 2020 winning submission targeting Apple Safari with a kernel escalation of privilege for macOS 10.15.3. For further information, you can...

FreePBX-CVE-2025-57819-RCE

FreePBX 16 — SQLi no autenticado a RCE Exploit de prueba de concepto que encadena dos vulnerabilidades de FreePBX para pasar de acceso nulo a ejecución remota de código en FreePBX 16. CVE| Componente| Impacto ---|---|--- CVE-2025-57819| Cargador del módulo Endpoint parámetro brand| Inyección SQL...

CVE-2019-7192_QNAP_Exploit

QNAP Pre-Auth Root RCE CVE-2019-7192 CVE-2019-7195 Exploit for now, you can read system files /etc/shadow, ssh private key, etc. Usage: pip install -r requirements.txt or just pip install requests python3 gundy.py https://vulnerableurl:port Sample Output Vulnerability The vulnerabilities can be...

CVE-2019-9745

Author: Arn Vollebregt Introduction Creativity is at the core of penetration testing, which keeps our work interesting. One pitfall however is the tendency to 'over-engineer' attack scenarios and focus solely on bugs error conditions. Flaws unintended behaviour may however be present with equally...

CVE-2024-2961

Buddyforms 2.7.7 CNEXT RCE Abusing CVE-2024-2961 and CVE-2023–26326 to RCE Usage git-clone https://github.com/suce0155/CVE-2024-2961buddyforms2.7.7 pip install -r requirements.txt python3 buddyforms2.7.7cnextexploit.py http://site/wp-admin/admin-ajax.php ip port Analysis and Technical Details Che...

wp2shell

wp2shell — WordPress Core Pre-Auth RCE CVE-2026-63030 Batch Route Confusion, CVSS 7.5 + CVE-2026-60137 SQL Injection, CVSS 9.1 A pre-authentication remote code execution chain in WordPress Core that requires no plugins, no special configuration, and works on default installs. Affected Versions...

sentrygrid

SentryGrid ML-driven threat detection and continuous monitoring platform built for federal zero-trust architectures. OSCAL-native, FedRAMP Moderate-aligned, hash-chained audit, three-model anomaly ensemble. Quick start make setup install bun + python deps make dev-up bring up the local stack via...

CVE-2021-46080

CVE-2021-46080 Exploit Title: Vehicle Service Management System - 'Multiple' Cross-Site Request Forgery CSRF Leads to Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-46080 CVSS: 4.8 MEDIUM References:...

chyrp-lite-rce-poc

chyrp-lite-rce-poc CVE-2026-53767 + CVE-2026-53768 - Authenticated RCE in Chyrp Lite ≤ 2026.01 "Iriomote" Chained attack: uploadspath blocklist bypass CVE-2026-53768 + missing file extension validation in adminupdateupload CVE-2026-53767 → Remote Code Execution as www-data Overview Chyrp Lite ≤...