CVE-2023-1177-MLFlow

CVE-2023-1177 MLFlow Path Traversal About MLflow MLflow is an open-source platform for managing the end-to-end machine learning lifecycle. Primary Functions: MLflow tackles four primary functions: Tracking experiments to record and compare parameters and results MLflow Tracking. Packaging ML code...

CVE-2026-666

CVE-2026-666 - ShadowWeb Framework Remote Code Execution Vulnerability Description A critical remote code execution RCE vulnerability has been identified in ShadowWeb Framework versions prior to 3.2.1. The flaw resides in the framework's deserialization mechanism within the ShadowParser module,...

CVE-2026-0770-PoC

CVE-2026-0770 - Langflow Remote Code Execution Summary Langflow contains a critical remote code execution vulnerability in the validatecode function located in src/lfx/src/lfx/custom/validate.py. The function uses exec to execute user-supplied Python code without sandboxing, allowing arbitrary...

CVE-2025-24893

Infos This PoC first tests for the SSTI and if it works. It will go in loop and allows you to run commands remotly. The exec and shell command do the same currently. Usage Connecting python3 poc.py Example With debug set to False default python3 poc.py http://127.0.0.1:8080 Targeting...

cve-2024-7965-poc

cve-2024-7965-poc CVE-2024-7965 is a high-severity vulnerability in the V8 JavaScript engine of the Google Chrome browser. The vulnerability stems from improper implementation in the V8 engine when handling specific JavaScript code, leading to heap memory corruption. An attacker could exploit thi...

CVE-2021-26084

CVE-2021-26084 Description - POC of CVE-2021-26084, which is Atlassian Confluence Server OGNLObject-Graph Navigation Language Pre-Auth RCE Injection Vulneralibity. - create by antx at 2022-01-13. Detail - In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability...

CVE-2026-24423

CVE-2026-24423 CVE-2026-24423 – Reproduction ⚠️ 仅用于安全研究与授权测试 / For security research and authorized testing only 简介（Overview） 本项目用于复现 CVE-2026-24423 漏洞。 该漏洞存在于 SmarterMail ConnectToHub 功能中，其根本原因是： - 管理级接口未进行身份认证 - 服务端会主动连接用户指定的 Hub（SSRF） - 外部 Hub 返回的数据被直接用于本地系统级操作 该漏洞属于设计级信任边界破坏（Trust Boundary...

CVE-2026-1560-Authenticated-Remote-Code-Execution-in-Lazy-Blocks-4.2.0

CVE-2026-1560 – Authenticated Remote Code Execution in Custom Block Builder – Lazy Blocks ≤ 4.2.0 Researcher : ZeYrOXxx Plugin : Custom Block Builder – Lazy Blocks Affected Versions : ≤ 4.2.0 Severity : High CVSS : 8.8 Vulnerability Type : Authenticated Remote Code Execution RCE Attack Vector :...

CVE-2023-46474

PMB =7.5.3 - Remote Code Execution via Unrestricted File Upload CVE-2023-46474 CVSS v3.1 Vector| CVSS v3.1 Score ---|--- AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H| 9.1 Discovered during a penetration test by Marcus Reynaud of Devensys Cybersecurity Description The script pmb/admin/convert/startimport.p...

spinnaker-poc

Spinnaker Vulnerability POCs Proof-of-concept demonstrations for CVE-2026-32604 and CVE-2026-32613, two 10.0 severity vulnerabilities in Spinnaker that allow for code execution and production cloud credential theft. Video walkthrough of how to use these POCS Technical blog with more details...

CVE-2024-6387_PoC

Summary This is essentially a statistical vulnerability: a large number of attempts are required to win the race condition and successfully execute arbitrary code. Attackers need to overcome many obstacles, Schwartz told SecurityWeek. "Even in the best-case scenario, the most well-known...

nifi-CVE-2026-39816-poc

Apache NiFi CVE-2026-39816 POC Proof-of-concept demonstration for CVE-2026-39816, an EXECUTECODE permission bypass in Apache NiFi 2.8.0 that lets a flow designer who has been deliberately denied code-execution privileges run arbitrary Groovy in the NiFi JVM via the graph bundle's ExecuteGraphQuer...

CVE-2021-31805

CVE-2021-31805 Remote code execution S2-062 CVE-2021-31805 Due to Apache Struts2's incomplete fix for S2-061 CVE-2020-17530, some tag attributes can still execute OGNL expressions, The vulnerability allows an attacker to construct malicious data to remotely execute arbitrary code...

CVE-2023-22527

CVE-2023-22527 This repository presents a proof-of-concept of CVE-2023-22527 CVE-2023-22527 | RCE using SSTI in Confluence Disclamer This code is a proof of concept of the vulnerability, I'm not pushing anyone to use it on confluence instances they don't own. This tool has been developed for...

CVE-2021-44521

CVE-2021-44521 Automated PoC of CVE-2021-44521 Credits to original poc: https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/ Requirements Cassandra-driver pip3 install cassandra-driver Usage python3 poc.py Note that you can't do more...

CVE-2026-24061_POC

CVE-2026-24061 GNU Telnetd RCE Script Parameters Parameter| Description| Default Value| Required?| Example ---|---|---|---|--- -ip| Specifies the target IP address for the connection.| -| Yes| -ip 192.168.1.10 -u| Specifies the username for the Telnet connection.| root| No| -u admin -p| Specifies...

cube0x0-CVE-2021-1675

CVE-2021-1675 / CVE-2021-34527 Impacket implementation of the PrintNightmare PoC originally created by Zhiniang Peng @edwardzpeng & Xuefeng Li @lxf02942370 Tested on a fully patched 2019 Domain Controller Execute malicious DLL's remote or locally Patch update Microsoft has released a patch to...

CVE-2026-23885

Security Advisory: CVE-2026-23885 Authenticated Remote Code Execution RCE in AlchemyCMS 1. Executive Summary A critical security vulnerability involving Improper Neutralization of Directives in Dynamically Evaluated Code CWE-95 was discovered in the AlchemyCMS framework. The vulnerability allows...

CVE-2025-55752

🚨🚨 CVE-2025-55752 — Apache Tomcat: Directory-protection bypass via Rewrite Valve → PUT-based RCE🚨🚨 Summary CVE-2025-55752 is a security regression in Apache Tomcat introduced while fixing bug 60013. When the Rewrite Valve is used, Tomcat applies path normalization before URL decoding. This...

CVE-2026-0709

Hikvision Wireless AP – CVE-2026-0709 Authenticated RCE Tool This tool is a Python proof‑of‑concept to test Hikvision wireless access points for CVE‑2026‑0709 , an authenticated command injection vulnerability that can lead to remote code execution on affected devices. For security testing and...