CVE-2014-6271-Shellshock-

Exploiting Shellshock CVE-2014-6271: A Complete, Modern Demonstration Lab Shellshock CVE-2014-6271 is one of the most influential remote code execution vulnerabilities ever discovered. The flaw affects Bash and allows attackers to execute arbitrary commands simply by injecting crafted payloads in...

CVE-2025-49132-PHP-PEAR

CVE-2025-49132: Pterodactyl Panel 未授权 RCE via PHP PEAR 方法 目录 概述 漏洞详情 技术分析 利用流程 安装 使用方法 示例 缓解措施 免责声明 参考资料 作者 概述 本仓库包含针对 CVE-2025-49132 的概念验证（PoC）利用代码，该漏洞是 Pterodactyl Panel 1.11.11 之前版本中的一个严重未授权远程代码执行漏洞。 Pterodactyl Panel 是一个免费、开源的游戏服务器管理面板，使用 PHP 构建。该漏洞允许未授权攻击者通过不当处理 /locales/locale.json 端点并结合 PH...

CVE-2023-38035-MobileIron-RCE

MobileIron CVE-2023-38035 漏洞利用 README.md 描述 该 bash 脚本自动扫描易受 CVE-2023-38035 漏洞影响的 MobileIron 系统。脚本执行多项检查，包括检查所需程序、从 Shodan 下载潜在目标、扫描这些目标，最后尝试在易受攻击的系统上启动 shell。 功能 自动 Shodan 查询，查找易受攻击的 MobileIron 系统 提取 IP 地址以供扫描 自动评估目标漏洞 提供使用不同方法（如 ncat 或 multireverse.sh）执行反向 shell 的选项 检查缺失的依赖项并推荐安装 漂亮横幅，让工具看起来很酷 😎...

CVE-2019-19781-CitrixRCE

Citrix未授权远程代码执行攻击工具 - CVE-2019-19781 参考资料： https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/ 绕过方式： 1 - 已删除/修改的脚本位于：/vpn/../vpns/portal/scripts/ 2 - Perl命令注入（模板注入）攻击后出现的正斜杠（"/"）问题...

CVE-2019-2729_creal

CVE-2019-2729 - creal PoC for exploiting CVE-2019-2729 on WebLogic Exploit Usage python3 creal.py -h usage: creal.py -h -u URL -f F -c CMD -s SH optional arguments: -h, --help show this help message and exit -u URL, --url URL target url -f F, --file F url file -c CMD, --command CMD command -s SH,...

CVE-2026-100864

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...

CVE-2026-100865

Heym before 0.0.53 evaluates workflow condition expressions using Python's eval with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process use...

CVE-2026-100845

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allowpickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through...

CVE-2026-100846

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algofrompickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algofrompickle ...

CVE-2026-100839

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack "BadAML". ACPI tables containing AML bytecode are passed from the untrusted host QEMU to the guest firmware OVMF and on to the Linu...

CVE-2026-100842

MONAI through 1.6.0 contains an eval injection vulnerability in getfakespatialshape in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval...

CVE-2026-100843

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algofrompickle function due to unsafe pickle.loads deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable...

CVE-2026-100840

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

CVE-2026-100841

In MONAI 1.6.0, PersistentDataset monai/data/dataset.py explicitly rejects the combination trackmeta=True with weightsonly=True, forcing users who cache MetaTensors the default tensor type in MONAI = 1.0 to run torch.loadhashfile, weightsonly=False. Related cache helpers in monai/data/utils.py al...

CVE-2026-100721

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new...

CVE-2015-9331

CVE-2015-9331 POC 漏洞描述 CVE-2015-9331 是 WordPress 插件 WP All Import 中的一个任意文件上传漏洞。该漏洞允许未经身份验证的攻击者上传任意文件到服务器，可能导致远程代码执行。 影响范围 插件名称 : WP All Import 影响版本 : = 3.2.3 漏洞类型 : 任意文件上传 / 远程代码执行 CVE编号 : CVE-2015-9331 文件说明 poc.py - Python 漏洞利用脚本 shell.php - 用于演示的 PHP Webshell 使用方法 环境要求 pip install requests 运行...

MySQL-Remote-Root-Code-Execution

MySQL-Remote-Root-Code-Execution 用法 python rcemysql.py -dbuser -dbpass -dbname -dbhost -mycnf...

WordPress DZS Zoomsounds <=6.50 - Local File Inclusion

WordPress Zoomsounds plugin 6.45 and earlier allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the dzsapdownload action using directory traversal in the link parameter. id: CVE-2021-39316 info: name: WordPress DZS Zoomsounds =6.51 to fix t...

Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection

Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-42071 info: name: Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection author: gy741 severity: critical description: Visual...

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...