CVE-2011-2523

CVE-2011-2523 - vsftpd 2.3.4 Backdoor Exploit This is a Python-based exploit script for the infamous backdoor found in vsftpd version 2.3.4. When triggered, it opens a shell on port 6200 — granting remote command execution as the root user in some vulnerable setups. About the Vulnerability vsftpd...

CVE-2024-32462

CVE-2024-32462 CVE-2024-32462 code exec sbx escape How the directory should look to compile this ├── org.exploit.SandboxEscape.yaml ├── exploit.py └── app/ └── exploit.desktop How to run & build 1.Install Flatpak SDK if needed: flatpak install flathub org.freedesktop.Platform//21.08 flatpak insta...

hack-winrar

hack-winrar WinRar is a very widely known software for windows. Previous version of WinRaR was a vulnerability which has been patched in Feb-2019. Most of the people didn't update winrar so they are vulnerable in this Absolute Path Traversal bug CVE-2018-20250 exp for Extracting Code Execution Fr...

CVE-2024-48359

CVE-2024-48359 - Qualitor = v8.24 Unauthenticated RCE PoC CVE-2024-48359 | Qualitor = v8.24 RCE Description Qualitor is a platform for business process management, and this system is present in various companies in Brazil that can be identified simply by using Google dorking. Our team identified ...

CVE-2025-3248

CVE-2025-3248: Langflow Unauthenticated Remote Code Execution RCE This repository contains two Python scripts: LangflowCheck.py: A scanner that checks for Langflow AI instances vulnerable to CVE-2025-3248. exploit.py: A working reverse shell exploit for vulnerable Langflow targets. Summary...

CVE-2025-22457

PoC for CVE-2025-22457 A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways Overview This is a proof of concept exploit to demonstrate exploitation of CVE-2025-22457. For a complete technical analysis of...

openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()

A flaw was found in OpenSSL. When processing a specially crafted PKCS7 or S/MIME Secure/Multipurpose Internet Mail Extensions signed message, a heap use-after-free vulnerability in the PKCS7verify function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an emp...

Apache-CouchDB-CVE-2022-24706-RCE-Exploits-Blog-post-

Apache-CouchDB-CVE-2022-24706-RCE-Exploits-Blog-post- I wrote a blog post about Apache CouchDB CVE-2022-24706 RCE Exploits...

cve-2025-24893-poc

CVE-2025-24893 — XWiki Unauthenticated RCE PoC Proof-of-Concept exploit for CVE-2025-24893 , a critical unauthenticated Remote Code Execution vulnerability in XWiki. This exploit abuses a Groovy template injection in the SolrSearch endpoint to execute arbitrary commands — including reverse shells...

CVE-2014-6271

CVE-2014-6271 Description This project allows reproducing the vulnerability CVE-2014-6271 , also known as Shellshock. Shellshock is a security vulnerability in Bash that allows executing malicious code via environment variables. The purpose of this project is to demonstrate the impact of this...

CVE-2025-25257

CVE-2025-25257 - FortiWeb Vulnerability Checker & Exploit A Python-based tool for checking and exploiting CVE-2025-25257 vulnerability in FortiWeb devices. This vulnerability allows SQL injection and remote code execution through a crafted Authorization header. 📋 Description CVE-2025-25257 is a...

cve-2017-9822

CVE-2017-9822 Key Information Setup Environment Setup Debug Analysis Debug XmlSerializer Attack Gadget ObjectDataProvider ResourceDictionary From XML Insecure Deserialization to RCE CVE-2017-9822 DNN also known as DotNetNuke before version 9.1.1 has the ability to execute remote code via cookies,...

CVE-2025-3248

CVE-2025-3248 Remote Code Execution using vulnerable API endpoint Proof of Concept. Info: ⚠️ Use this at your own risk! ❓ Added option to reverse shell. ✅ Auto retry if validatecode is off. Showcase Usage python CVE-2025-3248.py / python3 CVE-2025-3248.py Footprint By using this tool, you agree...

CVE-2020-10257

/ \ \ / / || \ \ / |/ \ | | | \ V /| |/ / / / || | / /| \ / / | / || /// ||/|/// by darkcast CVE-2020-10257: WordPress TRX Addons Plugin Unauthenticated Remote Code Execution RCE Vulnerability Affected Plugin: TRX Addons Vulnerability Type: Unauthenticated Remote Code Execution RCE CVSS Score:...

CVE-2023-25202

CVE-2023-25202: Insecure file upload mechanism Description CVE-2023-25202 involves an insecure file upload mechanism within the Therefore application, which is overly permissive in the types of files users can upload. The application only blocks uploads of HTML, EXE, and BAK files, leaving it...

CVE-2021-22053

CVE-2021-22053 CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability Description Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the...

CVE-2026-92982 Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource CR specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressio...

EUVD-2026-102157

A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource CR specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressio...

CVE-2026-92982

A Jinja2 template injection vulnerability exists in Ansible Operator Plugins . A low-privileged Kubernetes user can exploit this by crafting malicious custom resource (CR) specification values that lack proper sanitization. When processed by Ansible, these values allow embedded Jinja2 expressions...

CVE-2026-92982

A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource CR specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressio...