CVE-2026-41089

CVE-2026-41089 ██████╗██╗ ██╗███████╗ ██╗ ██╗ ██╗ ██████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ██║ ██║███║██╔═████╗██╔═████╗ ██║ ██║ ██║█████╗ ███████║╚██║██║██╔██║██║██╔██║ ██║ ╚██╗ ██╔╝██╔══╝ ██╔══██║ ██║████╔╝██║████╔╝██║ ╚██████╗ ╚████╔╝ ███████╗ ██║ ██║ ██║╚██████╔╝╚██████╔╝ ╚═════╝ ╚═══╝ ╚══════...

WebminRCE-exploit

WebminRCE-exploit CVE-2022-0824, CVE-2022-0829 - File Manger privilege exploit Vulnerable application to test this PoC can be found here as a docker image. Prerequisites: Python3 Requests module Description Vulnerability Improper Access Control to Remote Code Execution Safe users Unpriviledged us...

CVE-2024-53677-Exploitation

CVE-2024-53677 Exploitation Apache Struts RCE via File Upload Description CVE-2024-53677 is a vulnerability which impacts Apache Struts from 2.0.0 before 6.4.0. ⚠️ This was exploited in a Hack The Box lab. File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params...

CVE-2024-32002-git-rce

This repository does not have a README...

CVE-2020-23591

CVE-2020-23591 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Found vulnerability in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" which allows an attacker to upload arbitrary file through "...

ruby-RCE-CVE-2019-5420-

Ruby Deserialization CVE-2019-5420 https://github.com/PenTestical/CVE-2019-5420 References: 1 Ruby on Rails command execution vulnerability payload implementation process https://hackerone.com/reports/473888 Since ActiveSupport::MessageVerifier and ActiveSupport::MessageEncryptor use Marshal as t...

CVE-2024-23692-RCE

TG Join Us https://t.me/WanLiChangChengWanLiChang Join us to regularly receive various vulnerability EXP POC CVE-2024-23692-RCE-EXP CVE-2024-23692 Rejetto HTTP HFS Server RCE FOFA "HttpFileServer" Notes Affected range: HFS 2.3 and below Usage How To Use ulimit -n 999999; zmap -p PORT -B500M | go...

CVE-2021-26700

CVE-2021-26700 Note: this manual is valid for DSNS lab's members only. Intruduction This is a remote code execution RCE vulnerability that resided in an extension of Visual Studio Code VS Code called npm, which was developed by Microsoft and was aimed to support running the npm scripts defined in...

CVE-2026-3854

CVE-2026-3854: RCE on GitHub via X-Stat header injection Practical summary of how the vulnerability discovered by Wiz Research in GitHub.com and GitHub Enterprise Server's internal git push pipeline works. Disclaimer This material is for educational purposes and offensive security research. The...

CVE-2026-20841-PoC

It is unclear whether this is the correct PoC trigger method; therefore, it is provided for reference only. CVE-2026-20841 - Windows notepad.exe RCE Exploitation condition: Notepad Version 11.2510 step 1. step 2...

CVE-2024-26304-RCE-exploit

CVE-2024-26304 - Remote Code Execution Vulnerability in ArubaOS Overview CVE-2024-26304 is a critical remote code execution RCE vulnerability affecting ArubaOS due to a buffer overflow in its L2/L3 Management service. An attacker can exploit this by sending specially crafted packets to the PAPI...

RCE-Simplephpblog-biggiedroid

CVE-2025-15495 - Arbitrary File Upload Leading to Remote Code Execution RCE Product BiggiDroid – Simple PHP Blog CMS Product page: https://biggidroid.com/product/simple-php-blog/ Vulnerability Type Arbitrary File Upload Unrestricted File Upload Remote Code Execution RCE Severity Critical CVSS...

CVE-2022-1388

CVE-2022-1388 RCE, Reverse Shell, and Auto-Export PCAP -- FOR EDUCATIONAL USE ONLY -- The author is not responsible or held liable for any actions taken with any aspect of this project/repository. I created this for the purposes of understanding the attack as well as writing detections within a...

poc-cve-2018-1273

CVE-2018-1273 Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted...

CVE-2026-21858

CVE-2026-21858 + CVE-2025-68613 - n8n Full Chain Unauthenticated Arbitrary File Read → Admin Token Forge → Sandbox Bypass → RCE | ---|--- CVE| CVE-2026-21858 AFR + CVE-2025-68613 RCE CVSS| 10.0 + 9.9 Critical Affected| = 0.211.0 RCE Fixed| 1.121.0 AFR / 1.120.4+ RCE Disclosed| 2026-01-07 11:09 UT...

mgo3-rce

MGO3 RCE This repository contains information regarding CVE-2026-19874. documentation video demo Timeline 2026-06-26: vulnerability is discovered 2026-06-26: first contact with Konami 2026-07-01: vulnerability is reported to Konami 2026-08-04: vulnerability is silently patched by Konami...

CVE-2024-22120-RCE-with-gopher

Usage python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime Summary This exploit was created to exploit an XXE XML External Entity. Through it, I read the backend code of the web service and found an endpoint where I could use gopher to make internal requests on Zabbix version...

CVE-2025-53770

CVE-2025-53770 SharePoint Description The deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an attacker to execute code remotely and compromise the system. Microsoft is aware of active exploitation and is preparing a comprehensive update. Ensure that mitigations...

CVE-2023-44770_ZenarioCMS--Reflected-XSS---Organizer-Alias

ZenarioCMS Reflected XSS v.9.4.59197 Author: Sergio Description: Cross Site Scripting vulnerability in ZenarioCMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias. Attack Vectors: Scripting a vulnerability in the sanitization of the...

CVE-2022-31626

CVE-2022-31626 In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdomysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in...