vcenter_rce

vcenterrce Exploit，Vmware vCenter 6.5-7.0 RCE（CVE-2021-21972），upload 冰蝎3，getshell Usage： python3 vcenterrce -u url...

Fiber

Description A fiber is a unit of execution that must be manually scheduled by the application rather than rely on the priority-based scheduling mechanism built into Windows. Fibers are often called lightweight threads. For more detailed information about what are and how fibers work consult the...

CVE-2025-20260-POC

CVE-2025-20260 EXPLOIT This is a proof of concept for CVE-2025-20260. This is a vulnerability in the ClamAV software's PDF scanning processes. By sending a specially crafted, malicious PDF file it is possible to cause a buffer overflow, resulting in a denial of service or arbitrary code execution...

WinRAR-CVE-2023-38831

WinRAR-CVE-2023-38831 This Metasploit module exploits a vulnerability in WinRAR 6.22 CVE-2023-38831. When a user opens a crafted RAR file and its embedded document, the decoy document is executed, leading to code execution. It is not pretty, but works. 🤷🏻 Alexander Hagenah @xaitax References...

CVE-2025-48384

Overview of CVE-2025-48384 CVE-2025-48384 is a critical vulnerability in Git, the widely used distributed version control system. It involves improper handling of carriage return CR characters in configuration values, which can lead to path traversal issues during submodule checkouts. This flaw...

CVE-2025-63602

CVE-2025-63602 Disclosure for CVE-2025-63602, including a PoC for use of an insecure driver in Awesome Miner 11.2.4 leading to arbitrary kernel read/write to MSRs, resulting in kernel code execution...

mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. .. mimikatz 2....

CVE-2019-18370_XiaoMi_Mi_WIFI_RCE_analysis

This repository does not have a README...

pbck-exploit

Mass Exploitation & Validation Framework for Joomla Page Builder CK Unauthenticated Arbitrary File Upload → Remote Code Execution 📑 Table of Contents Vulnerability Overview Affected Versions Features Installation Usage Proof of Concept Technical Deep-Dive Detection Methodology Defense & Mitigatio...

CVE-2019-9978

CVE-2019-9978 – Proof of Concept PoC Functional PoC for vulnerability CVE-2019-9978 , affecting the plugin Social Warfare = 3.5.2, allowing Remote Code Execution RCE in WordPress. 📌 Description This exploit abuses the swpdebug=loadoptions parameter to force the loading of a remote payload, allowi...

CVE-2023-22515_RCE

A way to achieve RCE after obtaining backend permissions in Confluence Manual GetShell Steps You can upload custom plugins in the backend to achieve RCE Access plugins/servlet/com.jsos.shell/ShellServlet...

CVE-2021-21220

First install: https://commondatastorage.googleapis.com/chromium-browser-snapshots/index.html?prefix=Winx64/848005/ Chrome version: 90.0.4403.0 install chrome-win.zip 1. node server.js run ./chrome.exe --no-sandbox go to localhost:8888 Note that the CVE which this exploits relies on is CVE...

CVE-2025-2945-pgadmin-rce

CVE-2025-2945 — pgAdmin 4 Query Tool Authenticated RCE Proof of concept for CVE-2025-2945, a critical remote code execution vulnerability in pgAdmin 4. Affected versions: 8.10 through 9.1 Fixed in: 9.2 released April 4, 2025 CVSS v3.1: 9.9 Critical Overview The pgAdmin 4 Query Tool exposes an...

CVE-2021-44228_Log4Shell

Demo Exploiting Log4Shell Vulnerability CVE-2021-44228 This project simulates an RCE attack scenario through the Log4Shell vulnerability in the Apache Log4j 2 library. Components 1. vulnerable-app : Spring Boot application using Log4j 2.14.1. 2. attacker : Contains malicious LDAP server marshalse...

CVE-2025-55182-Next.js-RCE

🔍 Next.js Security Testing Tool Professional security assessment utility for Next.js applications ⚠️ Disclaimer This tool is intended for authorized security testing and research purposes only. ✅ Use only on systems you own or have explicit permission to test ✅ For bug bounty programs with proper...

majordomo-CVE-2026-27174-poc

majordomo-CVE-2026-27174-poc A proof-of-concept exploiting an unauthenticated remote code execution via the admin panel's PHP console feature in MajorDomo Major Domestic Module. Vulnerability MajorDoMo's admin panel exposes a PHP evaluation console via /admin.php. Due to a missing exit after an...

sk-cve-2026-26030-lab

CVE-2026-26030 — Semantic Kernel filter eval RCE lab A self-contained lab reproducing CVE-2026-26030 : prompt-injectable remote code execution via the in-memory vector store search filter in Microsoft Semantic Kernel Python, Ethical lab only. Isolated in dedicated virtualenvs; payloads are harmle...

CNTA-2019-0014xCVE-2019-2725

CNTA-2019-0014-CVE-2019-2725 Disclaimer: This tool is only for security testing and learning purposes. Illegal use is prohibited. Usage:python3 weblogicrce.py url command is echo? win or linux For detailed analysis, please visit: https://icematcha.win/?p=1174...

Info-Sys-Security-CVE-2025-55182

CVE-2025-55182 Security Lab "React2Shell" This repository contains a local academic lab for analyzing CVE-2025-55182 in a controlled React Server Components environment. The lab simulates the vulnerability, its exploitation, and the applied patch. 📁 Repository Layout Core Applications...

squarephish

SquarePhish SquarePhish is an advanced phishing tool that uses a technique combining the OAuth Device code authentication flow and QR codes. See PhishInSuits for more details on using OAuth Device Code flow for phishing attacks. / | | | | | | | | | | | | | \ \ / | | | |/ | '/ \ /| ' | / | ' \ | |...