CVE-2026-9256-Poc

nginx ngxhttprewritemodule Heap Buffer Overflow Description nginx Plus and nginx Open Source ngxhttprewritemodule contains a heap buffer overflow vulnerability. When a rewrite directive uses a regex with multiple overlapping PCRE capture groups e.g. ^/.$ and a replacement referencing multiple...

CVE-2022-21445

CVE-2022-21445 Exploit - PoC This toolkit generates exploit payloads for CVE-2022-21445, a critical Java deserialization vulnerability affecting Oracle WebLogic Server 12.2.1.x running Oracle ADF Faces. The flaw exists in the RemoteApplicationResourceLoader component and allows an attacker to sen...

CVE-2023-32315

CVE-2023-32315 Openfire's administrative console the Admin Console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environmentin an already configured Openfi...

CVE-2010-1240

CVE-2010-1240 - Embedding backdoor into a PDF ⚠️ For educational and authorized security research purposes only Description Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog,...

active-scan-plus-plus

ActiveScan++ ActiveScan++ extends Burp Suite's active and passive scanning capabilities. Designed to add minimal network overhead, it identifies application behaviour that may be of interest to advanced testers: Potential host header attacks password reset poisoning, cache poisoning, DNS rebindin...

CVE-2025-48827

Description: RCE for Vbullettin versions between 5.0.0 - 5.7.5 and 6.0.0 - 6.0.3 with PHP 8.1 Futures: Multi thread Read from multiple target from file Detect vbullettin websites Checks vulnerabilit, if succes upload a php webshell Detail of usage: usage: CVE-2025-48827.py -h --url URL --list LIS...

EXPLOITING-CVE-2024-27956

Python script that exploits CVE-2024-27956, a vulnerability in Wordpress that allows SQL Injection leading to Remote Code Execution...

SuperGhidra

SuperGhidra SuperGhidra: Compilable C Rewriter & Guardrailed Agent MCP Suite. Python tools that make Ghidra faster to script against, rewrite raw decompiler output into compilable C, and run static binary analyses Ghidra does not include out of the box: MSVC RTTI and MFC CRuntimeClass recovery,...

CVE-2021-42392-exploit-lab

⚠️ H2 Database RCE Exploit PoC CVE-2021-42392 This repository provides a minimal and controlled environment to test the H2 Database Remote Code Execution vulnerability CVE-2021-42392 using the CREATE ALIAS feature. Unlike many demonstrations, this exploit targets the H2 TCP service directly...

CVE-2025-60787

CVE-2025-60787 - MotionEye RCE MotionEye v0.43.1b4 OS Command Injection A proof-of-concept exploit OS Command Injection for vulnerability in motionEye, a web frontend for the motion daemon. The vulnerability abuses the imagefilename configuration parameter, which is passed directly to the shell...

CVE-2021-44228-playground

LOG4SHELL-CVE-2021-44228-Validator About This tool allows you to verify whether a simple Java web app is vulnerable to CVE-2021-44228 for a user provided version of Java and of Log4J. You can also optionally apply one of a view pre-defined mitigations. The simulation lab spun up by...

CVE-2022-1388

CVE-2022-1388 A remote code execution vulnerability exists in the iControl REST API feature of F5's BIG-IP product. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges. USAGE python3 f5bigipscanner.py...

CVE-2025-55182

CVE-2025-55182 Original author:https://github.com/msanft/CVE-2025-55182 This vulnerability allows RCE in React Server Functions, e.g. as offered by Next.js through insecure prototype references. I'm not an expert in React or Next.js, so take all the information here with a grain of salt. Backgrou...

CVE-2021-28476

CVE-2021-28476: Microsoft Hyper-V: Multiple Vulnerabilities in vmswitch Multiple bugs are present in WPP code when handling set OID requests, one of them allowing to dereference read access an attacker controlled pointer, and the rest causing out of bounds read accesses. This repository contains...

CVE-2018-19422-SubrionCMS-RCE

CVE-2018-19422-SubrionCMS-RCE SubrionCMS 4.2.1 Authenticated Remote Code Execution /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these. Exploit Usage Commands: Windows/Linux: $ sudo python3...

wp2shell-poc

wp2shell-poc Independent proof-of-concept for the unauthenticated WordPress REST batch route-confusion SQL injection associated with Searchlight Cyber's wp2shell advisory. This repository is not Searchlight Cyber's official checker. check confirms the SQLi path, read demonstrates database read, a...

CVE-2022-30190

MS-MSDT Follina CVE-2022-30190 PoC Malicious docx generator to exploit Microsoft Office Word Remote Code Execution Creation of this Script is based on CVE-2021-40444 PoC by LockedByte and writeup by Tothi Using First modify backup.html and replace powershell payload. Right now just pops a calc.ex...

CVE-2026-22005-OAuth-2.0-Device-Code-Phishing-Short-Interval-

CVE-2026-22005 – OAuth 2.0 Device Code Phishing Short Interval Program Code Python devicecodeserver.py - Authorization server with too-fast polling import time, secrets codes = @app.route'/device/code' def devicecode: code = secrets.tokenurlsafe16 codescode = 'usercode': secrets.tokenhex4,...

cve-2014-7920-7921

cve-2014-7920-7921 Exploit code for CVE-2014-7920 and CVE-2014-7921 - code-exec in mediaserver up to Android 5.1 The symbols in this exploit are for Android 4.3, for can be adapted to any version up to Android 5.1...

xwiki-cve-2025-24893-exploit

XWiki CVE-2025-24893 Exploit Unauthenticated Remote Code Execution exploit for XWiki versions vulnerable to CVE-2025-24893. Vulnerability Overview XWiki versions prior to 15.10.9 are vulnerable to unauthenticated RCE through Groovy script injection in the SolrSearch RSS feed handler. The...