CVE-2025-55184

React2Shell PoC This repository provides a minimal intentionally vulnerable environment to test security scanners against the recent critical RCE vulnerability React2Shell affecting React Server Components and Next.js. CVE-2025-55182 : A pre-authentication remote code execution vulnerability exis...

roundcube-cve-2025-49113-lab

"免責事項: 教育目的のみ" Roundcube Webmail RCE – CVE-2025-49113 ラボ このリポジトリは、管理されたラボ環境で Roundcube Webmail CVE-2025-49113 を段階的に悪用し、/secret.txt に保存された秘密情報を取得するまでの手順をまとめたものです。 ⚠️ 免責事項 すべての作業は、テスト実施の許可を得たラボ / トレーニング環境に対して行われました。 自分が所有または管理していないシステムに対しては、これらの手法を使用しないで ください。 チャレンジ Roundcube Webmail...

CVE-2021-21974_vuln_dectection

CVE-2021-21974 Vulnerability Detector A Python-based security tool for detecting CVE-2021-21974 vulnerability in SLP Service Location Protocol implementations, specifically targeting VMware ESXi systems. This tool performs safe, non-exploitative detection by analyzing SLP service responses and...

CVE-2023-39115

CVE-2023-39115 Description: Campcodes Online Matrimonial Website System Script v3.3 is vulnerable to an arbitrary file upload vulnerability, potentially allowing attackers to execute arbitrary code on the targeted server. The vulnerability arises from insufficient validation of uploaded files,...

CVE-2020-13671

CVE-2020-13671 ファイルアップロードによるRCE — Drupalコア ソフトウェア: Drupal Core 8.7.5 影響を受けるバージョン: 7.x 7.78、8.x 8.8.11、8.9.x 8.9.9、9.0.x 9.0.8 CVSS: 8.8 高 CWE: CWE-434 — 危険なタイプのファイルの無制限アップロード CISA KEV: 対象 — 既知の悪用済み脆弱性 Advisory: SA-CORE-2020-012 Drupalとは...

CVE-2025-24016

CVE-2025-24016 An unsafe deserialization vulnerability in Wazuh servers allows remote code execution through unsanitized dictionary injection in DAPI requests/responses. This issue arises from the way DistributedAPI parameters are serialized as JSON and then deserialized using the aswazuhobject...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 F5 BIG-IP iControl REST Auth Bypass RCE. root@kitploit: POST /mgmt/tm/util/bash HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Connection: close, X-F5-Auth-Token, X-Forwarded-For, Local-Ip-From-Httpd, X-F5-New-Authtok-Reqd, X-Forwarded-Server, X-Forwarded-Host...

day06-foxcms-rce

Day06 — FoxCMS-style RCE CVE-2025-29306 — Educational lab This tiny lab simulates the core idea behind CVE-2025-29306 : unsafe use of unserialize on attacker-controlled input leading to remote code execution. This is a minimal, intentionally vulnerable educational replica — not FoxCMS itself...

CVE-2025-3248

CVE-2025-3248 — Langflow AI リモートコード実行 認証不要 著者: 0xgh057r3c0n 説明 このエクスプロイトは、Langflow AI の重要な認証不要の RCE 脆弱性 CVE-2025-3248 を標的としています。この脆弱性により、攻撃者は /api/v1/validate/code エンドポイントを介してターゲットサーバー上で任意のシステムコマンドを実行できます。 この概念実証 PoC ツールは、問題のテストと実証のための対話型シェルを提供します。 前提条件 Python 3.8 以降 依存関係をインストールするための pip3 インストール...

relatorio-n8n.md

TryHackMe レポート — n8n: CVE-2025-68613 脆弱性: CVE-2025-68613 公開日: 19/12/2025 CVSS: 9.9 クリティカル 概要 n8n におけるリモートコード実行 RCE を可能にする式インジェクション脆弱性の調査・分析レポート。環境、手順、テストしたペイロード、証拠、推奨事項を文書化します。 目的 TryHackMe ルームでエクスプロイトを再現する。 コマンドと証拠を文書化する。 緩和策と検出方法を提案する。 テスト環境 OS: Linux ディストリとバージョンを記入 テストした n8n バージョン: 記入 ネットワーク:...

ezviz_lan_rce

ezvizlanrce This repository contains the slides and PoC videos for the talk SADProtocol goes to Hollywood which was presented at DEF CON 31 Hardware Hacking Village. You can also find the docker image to build binaries that run on the camera and the proof of concept exploits for CVE-2023-34551 an...

CVE-2025-25257

CVE-2025-25257 FortiWeb CVE-2025-25257 exploit https://pwner.gg/blog/2025-07-10-fortiweb-fabric-rce exp.py: working/full exploit. signed.py: just a PoC of file read/write. initial version of the exploit...

CVE-2025-68613

CVE-2025-68613 — n8n Workflow Automation Expression Engine Isolation Failure The author assumes no liability for misuse or damage caused by this research Provided strictly for educational and defensive purposes Description This repository contains a laboratory-grade analysis and a safe...

CVE-2012-2982

This PoC exploit for CVE-2012-2982 was written as an exercise for the "Intro to PoC scripting" Room on TryHackMe. The room can be found here: https://tryhackme.com/room/intropocscripting I was originally going to use Python to follow along, but decided to practice my Rust skills instead. I also s...

n8n-RCE-CVE-2025-68613

n8n CVE-2025-68613 Overview This repository contains an educational security research project focused on CVE-2025-68613 , a vulnerability affecting specific versions of n8n related to unsafe workflow expression evaluation. The project was tested only in a controlled local lab environment. About...

CVE-2023-33246

CVE-2023-33246 - RocketMQ Remote Code Execution CVE-2023-33246 - Apache RocketMQ config Remote Code Execution Exploit Overview RocketMQ is a distributed messaging and streaming platform. RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is...

CVE-2025-56762

Description: The application leverages “error.php” to serve the respective error code as per the use case back to the web application upon encountering an error. Upon inspecting the source code, it was found that the application does not sanitize the parameter “code” when crafting a malicious...

LogMePwn

LogMePwn LogMePwn is a fully automated, multi-protocol, reliable, super-fast scanning and validation toolkit for the Log4J RCE CVE-2021-44228 vulnerability. Tool Highlights Inherent support for automatic Canary Tokens generation using emails or webhooks. Multi-protocol support: HTTP, IMAP, SSH,...

Log4Shell-CVE-2021-44228

Exploiting Log4Shell CVE-2021-44228: A Complete, Modern Demonstration Lab Log4Shell CVE-2021-44228 is one of the most impactful remote code execution vulnerabilities ever disclosed. It affects Apache Log4j 2 , a widely used Java logging framework, and allows attackers to execute arbitrary code by...

CVE-2025-61882-CVE-2025-61884

CVE-2025-61882 & CVE-2025-61884 EDIT: Oracle just disclosed a new vulnerability CVE-2025-61884, the detection script for that vuln can be found in this repo or originally here:https://gist.github.com/rxerium/6c70bc6b72fc0d1365c85937d35d9550. As quoted from Oracle's security advisory: This Securit...