CVE-2024-25641-CACTI-RCE-1.2.26

CVE-2024-25641 - Cacti 1.2.26 - Arbitrary file write to RCE 🌵 Authenticated RCE Cacti version v1.2.26 Summary An arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code ...

Added-Pentest-Ground-to-vulnerable-websites-for-training

https://vulners.com/cve/CVE-2017-0089 Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Uniscribe Remote Code Execution Vulnerability." This vulnerability is different from...

CVE-2017-3241-POC

CVE-2017-3241-POC POC for java RMI deserialization vulnerability You probably need to use JDK 8 to run this poc. Just pay attention to Message class in both client and server side. They are different. And the difference is the key to understand this vulnerability. The fix Oracle published is to...

cve-2025-50946

cve-2025-50946 Exploit script for CVE-2025-50946 OliveTin get-theme RCE. The character requirements are finnicky and many commands that include multiple arguments may not be executed properly. I haven't taken the time to run down the root cause or try to make the script more robust. Holler at me ...

CVE-2025-24893-XWiki-SSTI-RCE

CVE-2025-24893 — XWiki SSTI Remote Code Execution Overview Field| Details ---|--- CVE| CVE-2025-24893 Software| XWiki Vulnerability| Server-Side Template Injection SSTI → RCE Authentication| Not required CVSS Score| Critical Context| Discovered during HackTheBox CTF Description XWiki exposes a...

cve-2019-0227

cve-2019-0227 Apache Axis 1.4 remote code execution vulnerability You need to set up a listener on the local machine with msf, and also modify lines 24-30 of the code. ＃You need to change these variables to match your configuration myip = “ 192.168.0.117 ” ＃Your machine's IP target = “...

CVE-2026-47668

CVE-2026-47668 — DbGate Remote Code Execution Unauthenticated RCE in DbGate JSON Script Runner dbgate-serve ≤ 7.1.8. Assessment tool: CVE-2026-47668.py — authorized testing only. | ---|--- CVE| CVE-2026-47668 Severity| Critical Product| DbGate / dbgate-serve Affected| ≤ 7.1.8 Fixed| ≥ 7.1.9 CVSS...

CVE-2025-53770-Scanner

CVE-2025-53770 Scanner by DanSec A simple, effective reconnaissance tool to identify potential exposure to the critical SharePoint vulnerability CVE-2025-53770. !Warning This tool is intended for authorised testing purposes only. The author DanSec takes no responsibility for misuse or damage caus...

Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated--POC

Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated-POC Exploit Author: Ashish Koli Shikari Vendor Homepage: https://github.com/pluck-cms/pluck Version: 4.7.16 CVE: CVE-2022-26965 About this: This script uploads shell.tar to the PluckCMS. An application will untar the package...

CVE-2022-24086

CVE-2022-24086 Tested with: magento 2.4.3 and sample data Docker image: docker.io/bitnami/magento:2.4.3-debian-10-r0 First Name: var this.getTemplateFilter.filter$order.shippingaddress.cityvar...

CVE-2025-55182-React2Shell

CVE-2025-55182-React2Shell xpl0ited by infrar3d A 10.0 critical severity vulnerablility affecting server-side use of React.js, tracked as CVE-2025-55182 in React.js and CVE-2025-66478 specifically for the Next.js framework. This vulnerability was responsibly disclosed by Lachlan Davidson on 29...

Next.js-RSC-RCE-Scanner-CVE-2025-66478

Next.js RSC RCE Scanner and POC/Exploit Collection CVE-2025-66478 A command-line scanner for batch detection of Next.js application versions and determining if they are affected by CVE-2025-66478 vulnerability. This Scanner do not exploit the vulnerability Vulnerability Description...

CVE-2011-2523

CVE-2011-2523 - vsftpd 2.3.4 Backdoor Exploit This is a Python-based exploit script for the infamous backdoor found in vsftpd version 2.3.4. When triggered, it opens a shell on port 6200 — granting remote command execution as the root user in some vulnerable setups. About the Vulnerability vsftpd...

eval-stdin

Util PHP eval-stdin.php CVE-2017-9841 vulnerability is RCE vulnerability in outdated eval-stdin.php. This exploit is just automation for mentioned vulnerability and is still in development. Scripted in Ruby 3.0.4 within 2 hours, tested on Kali linux, Arch Linux, Ubuntu minimal and Termux. How to...

CVE-2026-34197

CVE-2026-34197 Description Improper Input Validation, Improper Control of Generation of Code ‘Code Injection’ vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access polic...

mailenable-cve-2022-36934

MailEnable CVE-2022-36934 Exploit Module Metasploit module for MailEnable's authentication bypass vulnerability CVE-2022-36934, leading to remote code execution. 📌 Features Exploits MailEnable's improper input sanitization in SMTP/POP3 Supports both x86 and x64 Windows targets No user interaction...

cve-2025-29384

CVE-2025-29384 Proof-of-Concept Exploit Overview This repository contains an advanced proof-of-concept PoC exploit for CVE-2025-29384 , a critical stack-based buffer overflow vulnerability discovered in the Tenda AC9 router running firmware version V15.03.05.14multi. This vulnerability allows...

Confluence-EvilJar

aaaademo/Confluence-EvilJar Use CVE-2023-22515 to upload a jar package via the backend to achieve RCE. git clone https://github.com/aaaademo/Confluence-EvilJar cd Confluence-EvilJar mvn package CMDshell http://confluence.local/plugins/servlet/testbin/cmServlet Godzilla webshell connection method...

CVE-2017-11882

CVE-2017-11882 43b Original script from https://github.com/embedi/CVE-2017-11882 109b Original script from https://github.com/unamer/CVE-2017-11882/ Kudos, unamer's code can now execute shellcode CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE...

TryHackMe-Atlassian-CVE-2022-26134

TryHackMe | Atlassian, CVE-2022-26134 TryHackMe Atlassian CVE-2022-26134 Atlassian, CVE-2022-26134 An interactive lab showcasing the Confluence Server and Data Center un-authenticated RCE vulnerability. Task 1 Introduction Confluence | Your Remote-Friendly Team Workspace | Atlassian NVD -...