log4j-CVE-2021-44228

log4j-CVE-2021-44228 On December 5, 2021, Apache identified a vulnerability later identified as CVE-2021-44228 in their widely used Log4j logging service. The vulnerability, also known as Log4shell, enables attackers to gain full control of affected servers by allowing unauthenticated remote code...

pbck-exploit

Mass Exploitation & Validation Framework for Joomla Page Builder CK Unauthenticated Arbitrary File Upload → Remote Code Execution 📑 Table of Contents Vulnerability Overview Affected Versions Features Installation Usage Proof of Concept Technical Deep-Dive Detection Methodology Defense & Mitigatio...

CVE-2025-23942-poc

WP Load Gallery Exploit CVE-2025-23942 📌 Description Unrestricted Upload of File with Dangerous Type vulnerability in NgocCode WP Load Gallery allows Upload a Web Shell to a Web Server. This issue affects WP Load Gallery: from n/a through 2.1.6. ⚠️ Vulnerability Details CVE ID: CVE-2025-23942...

CVE-2026-45562 FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-45562 FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

CVE-2026-45562

The FreePBX Music on Hold (MoH) module is vulnerable to Authenticated Remote Code Execution in versions prior to 16.0.4 and 17.0.6 . The root cause is a lack of sanitization for a POST parameter that defines a custom Asterisk application . This unsanitized data is stored in the database and subse...

CVE-2023-21716

CVE-2023-21716 Microsoft Word RTF Font Table Heap Corruption https://twitter.com/jduck A vulnerability within Microsoft Office's wwlib allows attackers to achieve remote code execution with the privileges of the victim that opens a malicious RTF document. The attacker could deliver this file as a...

CVE-2022-22965_Spring4Shell

CVE-2022-22965Spring4Shell CVE-2022-22965 Spring4Shell, SpringShell is a vulnerability in the Spring Framework that uses data binding functionality to bind data stored within an HTTP request to certain objects used by an application. The bug exists in the getCachedIntrospectionResults method, whi...

Php-unit-CVE-2017-9841

phpunit Remote Code Execution Vulnerability CVE-2017-9841 Composer is a PHP package management tool. Using Composer to install extension packages will create a vendor folder in the current directory and place all files in it. Usually this directory should be placed outside the web root so that...

CVE-2024-4947-PoC

CVE-2024-4947 — V8 Maglev Type Confusion → Full RCE d8 PoC A complete, self-contained exploitation chain for CVE-2024-4947 V8 Maglev type confusion, from the initial type-confusion trigger all the way to arbitrary code execution. The PoC runs against a non-sandboxed d8 build and prints...

Deep-Reaver

Deep Reaver Deep Reaver — это мощный инструмент для оценки уязвимостей и эксплуатации с использованием ИИ, написанный на Python. Вдохновленный такими инструментами, как Nmap и Nessus, Deep Reaver предназначен для глубокого модульного сканирования веб-приложений и сервисов. Возможности Анализ с...

CVE-2026-23744

CVE-2026-23744 MCPJam inspector Remote-Code-Execution: Proof Of Concept POC usage: python3 cve-2026-23744.py --target https:// --att-ip --att-p...

CVE-2024-34833-payroll-management-system-rce

CVE-2024-34833 Payroll Management System RCE Unauthenticated PoC RCE via file upload for https://www.sourcecodester.com/php/14475/payroll-management-system-using-phpmysql-source-code.html. The filenames have timestamp prepended with a minute accuracy. The script tries to guess the filename using...

CVE-2021-44228-PoC

CVE-2021-44228 PoC PoC for CVE-2021-44228. Project made for EDUCATIONAL PURPOSES ONLY. Exploit server This project creates two servers: http and ldap. Both are necessary for exploit to work. Specified java file is compiled and servers are started in Dockerfile. Payload is shown to user - it has t...

CVE-2024-46209

Redaxo Security Research CVE-2024-46209, CVE-2024-46210 Redaxo CMS v5.17.1 security research Completed at 09 August 2024 Contains detailed description of: CVE-2024-46210 - Stored Cross-Site Scripting via file Upload in MediaPool module CVE-2024-46209 - Authenticated arbitrary code execution...

CVE-2025-55182-NextJS-RCE-PoC

CVE-2025-55182 React2Shell Reproduction Environment ⚠️ EDUCATIONAL PURPOSE ONLY This repository is created strictly for educational and research purposes. It demonstrates a critical vulnerability in React Server Components Next.js to help developers understand the risks and importance of updating...

CVE-2020-5902

CVE-2020-5902 Summary In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has a Remote Code Execution RCE vulnerability in undisclosed pages. Proof Of...

CVE-2023-27326

Parallels Desktop VM Escape This repository contains an exploit for a Parallels Desktop vulnerability which has been assigned CVE-2023-27326. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. The exploit was tested on Parallels Deskto...

WSO2-CVE-2022-29464

WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-29464. Full technical analysis will be published at my blog post: https://mr-r3bot.github.io Usage python exploit.py -u...

rendering-code-outside-the-sandbox-cve-2026-76036-dawn-webgpu-buffer-overflow-in-chrome-on-android

CVE-2026-76036 — Dawn WebGPU NPOT Depth/Stencil Mipmap Detection Harness Critical CVSS 9.6, CWE-122 heap buffer overflow in Dawn , Chromium's WebGPU implementation, in Google Chrome on Android prior to 151.0.7922.169 stable 151, released 2026-08-18. Root cause, per Dawn fix commit 178fb7048ad3: t...