cve-2019-1663

🚀 Exploitation of CVE-2019-1663 🧩 Introduction This repository documents the exploitation of CVE-2019-1663, a critical remote code execution RCE vulnerability affecting Cisco RV110W, RV130W, and RV215W Wireless-N VPN routers. Due to insufficient input validation within the web management interfac...

CVE-2023-21716-POC

History In February 2023, Microsoft patched a critical vulnerability in Microsoft Word, identified as CVE-2023-21716 with a CVSS score of 9.8, which could allow attackers to execute remote code without authentication. This vulnerability also affected the Outlook Preview Pane, meaning it can be...

CVE-2021-46363

CVE-2021-46363: Formula Injection in Magnolia CMS An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported...

poc-cve-2018-1273

CVE-2018-1273 Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted...

drupalgeddon2

drupalgeddon2 Exploit for CVE-2018-7600. Usage: drupalgeddon2 options -h: Url target -c: OS command Examples: drupalgeddon2.py -h http://www.victim.com -c 'ls -la' Based in https://github.com/FireFart/CVE-2018-7600...

cve-2020-11060-poc

CVE-2020-11060 This script is a Python 3.x based exploit for CVE-2020-11060 in GLPI versions 0.85-9.4.5. Original implementation: 0xdreadnaught Python3 refactoring: n3rada The original PoC in ExploitDB is now deprecated since it used Python 2.x. The new version has been submitted, and a link will...

CVE-2020-3956

CVE-2020-3956 PoC exploit for VMware Cloud Director RCE CVE-2020-3956 Technical advisory is available here: https://citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/...

nextjs-security-update

nextjs-security-update There are people building OSS tools to exploit the new Next.js vulnerabilities. This is a tool to fight back - makes it dumb easy to upgrade all your Next.js apps across all your GitHub accounts. Uses the official Vercel fix tool under the hood. What happened Dec 11, 2025:...

CVE-2023-27350

CVE-2023-27350 Exploit POC This is a Proof of Concept POC exploit for CVE-2023-27350, a vulnerability found in PaperCut MF/NG that allows an unauthenticated attacker to execute arbitrary code with SYSTEM privileges. Requirements Before using this exploit, make sure you have installed the followin...

CVE-2025-49113

📧 Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization CVE-2025-49113 🔍 Writeup A critical post-authentication Remote Code Execution vulnerability was discovered in Roundcube versions ≤ 1.6.10, caused by insecure PHP object deserialization. This severe flaw has silently persisted in th...

CVE-2025-5548

⚡ CVE-2025-5548: Vulnerability Research & Exploitation This repository provides a technical analysis and proof-of-concept walkthrough for CVE-2025-5548. This research covers the complete lifecycle of the vulnerability, from initial binary inspection to successful exploitation. ⚠️ Legal & Ethical...

struts-s2-052-deserialization-rce-lab

Apache Struts S2-052 XML Deserialization RCE This repository demonstrates exploitation of Apache Struts S2-052 CVE-2017-9805 using malicious XML deserialization. The exploit was developed while solving the INE eWPTX Practice Range – Struts XML Deserialization RCE lab. Vulnerability Overview Apach...

CVE-2024-29269

Telesquare TLR-2005KSHRCE CVE-2024-29269 Batch scan/exploit 1.このツールはセキュリティテストのみに使用されており、違法な攻撃については責任を負いません. 2.The tool is only used for security testing, and I am not responsible for any illegal attacks. 3.工具仅用于安全测试，任何非法攻击本人概不负责. Help / /\ //\ | \ / \ | || | | \ / \ \ / / / \ / / \ \ / /\ | | |...

CVE-2013-3214

CVE-2013-3214 vTiger 5.4.0 Arbitrary File Upload to Remote Code Execution...

apache-httpd-path-traversal-checker

Apache HTTPD Path Traversal Checker 0x00 Overview On October 5, 2021, the directory traversal vulnerability CVE-2021-41773 in Apache HTTPD 2.4.49 was disclosed online, which could lead to arbitrary file reading if the traversed directory is accessible, such as when configured with Require all...

react2shell-CVE-2025-55182

Attack component contains the attack code. Just uncomment it and press the button to pefrom attach. To run your own code on server exploit simply change the value of prefix key in the payload. See the AttackString file for examples...

Spring4shell

Spring4shell Spring4shell...

CVE-2025-40602

CVE-2025-40602 CVE-2025-40602 is a local privilege escalation vulnerability in the appliance management console AMC of SonicWall Secure Mobile Access SMA 1000 series appliances. The vulnerability stems from insufficient authorization in the AMC, allowing authenticated remote attackers to escalate...

CVE-2023-38831-POC

Description Name : CVE-2023-38831 CVSS Score : 7.8 Affected Versions : Winrar 6.23 CVE-2023-38831 is a zero-day vulnerability affecting WinRAR all versions prior to 6.23. The issue is in the processing of ZIP format which could allow attackers to utilize affected archives to distribute malware. B...

CVE-2024-43918

Wordpress WBW Product Table Pro = 1.9.4 - Unauthenticated Arbitrary SQL Execution to Remote Code Execution CVE-2024-43918 The WBW Product Table Pro plugin for WordPress is vulnerable to unauthorized arbitrary SQL Execution due to a missing capability check on a function in all versions up to, and...