CVE-2023-49964

CVE-2023-49964: FreeMarker Server-Side Template Injection in Alfresco An issue was discovered in Hyland Alfresco Community Edition =7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage...

textpattern-exploit-rce

Textpattern = 4.8.3 Remote Code Execution Authenticated Textpattern until version 4.8.3 allows authenticated users to upload any PHP file. This script automates the process and allows to delete the uploaded file. Usage python3 exploit.py -t TARGET -u USER -p PASSWORD -c COMMAND -f FILENAME -d -t:...

CSRF-to-RCE-on-Backdrop-CMS

CSRF to RCE on Backdrop CMS 1.20 This PoC describe how to exploit CSRF on Backdrop CMS Version 1.20 with escalation to RCE. CVE ID CVE-2021-45268 Description The Backdrop CMS version 1.20 allows plugins to be added via ZIP files uploaded to the site. And because it does not have anti-CSRF...

solr_rce

Apache Solr RCE via Velocity template python usage: python solrrce.py http://x.x.x.x:8983 command getshell encode payload http://www.jackson-t.ca/runtime-exec-payloads.html whoami bash -c echo,d2hvYW1p|base64,-d|bash,-i 0x01 Introduction to Solr Solr is an open-source enterprise search platform...

CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability

CVE-2024-21413 is a critical remote code execution vulnerability in Microsoft Outlook versions including Microsoft 365 Apps, Outlook 2016/2019, Office LTSC 2021 before February 2024 patch. It allows an unauthenticated attacker to bypass Outlook’s Protected View by sending a specially crafted emai...

CVE-2019-16663

CVE-2019-16663 The official exploit code for Centreon v19.04 Remote Code Execution CVE-2019-16662...

CVE-2021-31805-POC

CVE-2021-31805-POC Vulnerability Information Apache Struts is a free, open-source MVC framework for creating elegant, modern Java web applications. It favors convention over configuration, can be extended using a plugin architecture, and ships with plugins that support REST, AJAX, and JSON...

CVE-2020-11978

CVE-2020-11978: Remote code execution in Apache Airflow's Example DAGs Information Description: This vulnerability allows RCE when Airflow's example DAGs are loaded, potentially unauthenticated with CVE-2020-13927 CVE Credit : xuxiang of DtDream security Versions Affected: On CVE-2020-13927 If...

Dolibarr-17.0.0-Exploit-CVE-2023-30253

Readme.md CVE-2023-30253 CVE-2023-30253 is a security flaw in Dolibarr software that enables authenticated users to execute remote code by utilizing an uppercase manipulation technique in injected data. Impact This vulnerability can lead to unauthorized remote code execution by malicious actors,...

n8n-cve-2025-68613-thm

CVE-2025-68613 – n8n Critical RCE Exploitation Overview This repository documents a hands-on exploitation of CVE-2025-68613 CVSS 9.9 , a critical Remote Code Execution vulnerability affecting the n8n workflow automation platform versions 0.211.0 through 1.120.3. This exploitation was performed...

CVE-2023-3519

CVE-2023-3519 This Nuclei template checks for the presence of the CVE-2023-3519 vulnerability in a target web server. Vulnerability CVE-2023-3519 is a vulnerability that allows unauthenticated remote code execution in the Citrix Application Delivery Controller ADC and Gateway appliances. An...

CVE-2021-22911-RocketChat

CVE-2021-22911 — Rocket.Chat 3.12.1 RCE Improvised Description Exploits a pre-auth NoSQL injection vulnerability in Rocket.Chat 3.12.1 to leak the admin's TOTP secret and password reset token, take over the admin account, and achieve RCE via a malicious webhook integration. Affected Version...

CVE-2025-30065

💥 CVE-2025-30065 - Parquet Deserialization PoC This project demonstrates a safe proof-of-concept for CVE-2025-30065 using Apache Parquet and Java deserialization. When a Parquet file containing a serialized Java object is read, the payload executes a visible command to prove code execution. 📦 Usa...

Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit

Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit CVE-2021-40444 EXPLOIT TO USE IN METASPLOIT, ALLOWS ATTACKERS TO GET AN REMOTE CODE EXECUTION THROUGH MICROSOFT OFFICE WORD BY INJECTING MALICIOUS CODE IN THE FILE...

CVE-2022-25226

ThinVNC 1.0b1 - Authentication Bypass to Remote Code Execution CVE-2022-25226 Author: krill-x7 Reference: https://fluidattacks.com/advisories/sinatra Overview ThinVNC 1.0b1 contains an authentication bypass vulnerability CVE-2022-25226 allowing remote attackers to interact with the backend...

React2Shell-CVE-2025-55182

🔥React2Shell - CVE-2025-55182 / CVE-2025-66478 Proof of Concept Critical Security Vulnerability Demo - CVSS 10.0 - Remote Code Execution in React Server Components ⚠️DISCLAIMER FOR EDUCATIONAL PURPOSES ONLY! This repository demonstrates a critical security vulnerability. Never use on production...

CVE-2024-30850-chaos-rat-rce-poc

https://github.com/chebuya/CVE-2024-30850-chaos-rat-rce-poc/assets/146861503/ac03c8c7-54b3-4280-9f29-719c44af5192 CHAOS RAT v5.01 web panel RCE CVE-2024-30850, CVE-2024-31839 https://github.com/tiagorlampert/CHAOS This exploit works by spoofing an agent callback for an XSS CVE-2024-31839, and...

S2-053-CVE-2017-12611

S2-053-CVE-2017-12611 A simple script for exploit RCE for Struts 2 S2-053CVE-2017-12611 Usage exploit.py Example $ python s2-053-exploit.py "http://127.0.0.1" "name" "uname -a" Generated EXP:...

OA-tongda-RCE

OA-tongda-RCE | Office Anywhere Web-based Intelligent Office System Backend Getshell No Authentication Required 1. Arbitrary file upload vulnerability /ispirit/im/upload.php 2. Local file inclusion vulnerability /ispirit/interface/gateway.php Command Execution Bypass: exec"cmd /c ".$command;...

Exploits

A collection of exploits developed by @xer0dayz @Sn1perSecurity https://sn1persecurity.com Vulnserver.exe GMON SEH Overflow Exploit FreeFloat FTP Server HOST Buffer Overflow ASLR Bypass CoolPlayer+ Portable 2.19.6 Stack Overflow ASLR Bypass HTTPoxy Exploit/PoC Scanner Ability FTP 2.34 Buffer...