CVE-2026-115915

A flaw was found in vLLM. The application processes user-supplied image data without restricting accepted file formats or verifying that the content matches the declared media type. A remote attacker can exploit this vulnerability by submitting a specially crafted image, such as an Encapsulated...

CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-110264

A flaw was found in Ruby. When compiling a specially crafted regular expression containing an excessive number of repeats with the methods Regexp.new, Regexp.union, Regexp.compile, or via a string interpolation such as /input/, an integer overflow of internal IDs can occur. This integer overflow...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API Time-Based Blind SQLi → RCE Proof‑of‑Concept Description pocwptot.py is a proof‑of‑concept PoC to exploit a time‑based blind SQL injection vulnerability on the WordPress REST API batch endpoint, and perform an escalation chain up to Remote Code Execution RCE...

cve-2020-00796

Identifying and Mitigating the CVE-2020–0796 flaw in the fly CVE-2020–0796, is pre-remote code execution vulnerability that resides in the Server Message Block 3.0 SMBv3 network communication protocol, which Microsoft will not address the issue as the part of the March 2020 Tuesday. Usage python3...

CVE-2025-55182-Toolbox

React2Shell: Comprehensive Exploitation Tool for CVE-2025-55182 Author: lamaper / BITs2Sys Version: 1.0.1 License: MIT 📝 Tool Introduction This tool is an automated penetration testing tool specifically designed for CVE-2025-55182 React Server Components / Next.js prototype pollution leading to...

papercut-toolkit

PaperCut CVE-2026-81578 + CVE-2026-82078 Defense Toolkit A defensive toolkit to check and understand exposure to the chained pre-auth remote code execution vulnerabilities in PaperCut: CVE-2026-81578 — Missing Authentication for Critical Function CWE-306. A remote unauthenticated request can...

CVE-2021-44228

CVE-2021-44228 Example Example vulnerability container build for CVE-2021-44228. DO NOT USE FOR ANYTHING OTHER THAN HIGHLY CONTROLLED SECURITY TESTING. This repository contains a sample application that deliberately uses a dependency with a dangerous remote-code execution vulnerability. Even in a...

CVE-2025-11953-PoC

Description The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and r...

n8n-Authenticated-Expression-Injection-RCE-CVE-2025-68613

n8n Authenticated Expression Injection RCE – CVE-2025-68613 Critical Remote Code Execution CVSS 9.9 in n8n Workflow Automation Tool Proof of Concept – For educational and authorized security research use only ⚠️ Important Legal Warning This code is provided STRICTLY for educational purposes and...

ruby-RCE-CVE-2019-5420-

Ruby Deserialization CVE-2019-5420 https://github.com/PenTestical/CVE-2019-5420 References: 1 Ruby on Rails command execution vulnerability payload implementation process https://hackerone.com/reports/473888 Since ActiveSupport::MessageVerifier and ActiveSupport::MessageEncryptor use Marshal as t...

CVE-2025-66478-PoC-Reverse-Shell

CVE-2025-66478 / CVE-2025-55182 "React2Shell" — RSC Server Actions Deserialization RCE PoC Proof-of-concept exploit for CVE-2025-55182 — publicly nicknamed "React2Shell" — a server-side prototype pollution vulnerability in React Server Components' Server Actions deserialization...

CVE-2025-12189

Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents CSRF Attack function exploit const form = document.createElement'form'; form.action = 'http://TARGETSITE.COM/wp-admin/admin-ajax.php'; form.method = 'POST'; form.enctype = 'multipart/form-data';...

CVE-2025-55182

CVE-2025-55182 - React2Shell A modified and boosted exploit for CVE-2025-55182 a pre-authentication Remote Code Execution in React Server version 19.0, 19.1.0, 19.1.1, and 19.2.0 The vulnerability spans the following: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack Pat...

cve-2026-32475-elementor-pro-lab

CVE-2026-32475 — Elementor Pro Forms unauthenticated arbitrary file upload → RCE A/B Docker lab that reproduces CVE-2026-32475 CVSS 9.x, Patchstack; Elementor Pro Forms File Upload field, affected ≤ 4.2.1, fixed 4.2.2 on 2026-08-19; reported by Tin Pham / TF1T. Unauthenticated, no user interactio...

CVE-2024-6387

0. TL;DR This is essentially a statistical vulnerability: it requires a large number of attempts to win the race condition and successfully execute arbitrary code. Attackers need to overcome many obstacles, "Schwartz told SecurityWeek." Even in the best case, the most well-known vulnerabilities...

Expoitation-de-la-vuln-rabilit-CVE-2022-22965

Exploitation of vulnerability CVE-2022-22965 The vulnerability CVE-2022-22965, known as Spring4Shell, is a remote code execution RCE flaw in the Java Spring Core framework, present in versions prior to 5.3.18 and 5.2.20. This vulnerability allows an attacker to inject and execute code remotely on...

CVE-2018-6574-go-get-RCE

CVE-2018-6574-Solution gcc -shared -o attack.so -fPIC attack.c...

CVE-2021-41773S

Vulnerable docker images for CVE-2021-41773 Apache path traversal This vulnerabiltiy only applies to version 2.4.49 that have specific non-default configs. In certain situations this can result in either file read or code execution. https://twitter.com/ptswarm/status/1445376079548624899 Vulnerabl...

CVE-2024-44902-env

CVE-2024-44902 - ThinkPHP Insecure Deserialization RCE Vulnerable environment for nuclei-templates validation. Vulnerability Details Field| Value ---|--- CVE ID| CVE-2024-44902 Severity| Critical CVSS 9.8 Product| ThinkPHP Affected Versions| 6.1.3 - 8.0.4 Type| Insecure Deserialization → RCE CWE|...