CVE-2025-23266

CVE-2025-23266 Autor: Mark Mallia Plataforma objetivo: Ubuntu 22.04, FastAPI v2.4.3 → parcheado a v2.5.1 el 2025‑10‑02 1 – En resumen: ¿qué implica este ataque La rutina parserequest de FastAPI copia los encabezados de las solicitudes HTTP en un pequeño búfer que reside en la pila del llamante. S...

Project-Exploiting-CVE-2024-27198-RCE-Vulnerability

Exploiting CVE-2024-27198-RCE Vulnerability In this project, I exploited the CVE-2024-27198-RCE vulnerability to perform a remote code execution RCE attack on a vulnerable TeamCity server. The vulnerability allows uploading and activating a malicious plugin that provides access to the remote syst...

CVE-2022-24715

CVE-2022-24715 Icinga Web 2 - Authenticated Remote Code Execution 2.8.6, 2.9.6, 2.10 DISCLAIMER: This script is made to audit the security of systems. Only use this script on your own systems or on systems you have written permission to exploit...

CVE-2024-30973

CVE-2024-30973 - V-SOL G/EPON ONU - HG323AC-B Description Item: Item: G/EPON ONU Specification: HG323AC-B Device model XPON+2GE+1POTS+2WIFI+USB Device SN 70B64F-1234570B64F0C2C0C Hardware Version V1.0 Firmware Version V2.0.08-210715 PON S/N GPON000C2C0C Vulnerability Type: Incorrect...

HTB_Nibbles

HTBNibbles In this repository you will find the technical report of Nibbles, the exploit pwned.py to abuse the CVE-2015-6967 and an autopwn tool autopwn.py in case you want to resolve the machine in HackTheBox. Pwned.py tool: This file will help you to exploit CVE-2015-6967. If you want to run th...

CVE-2022-37208

37208 CVE-2022-37208 Suggested description JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

CVE-2025-55182-RCE-Exploit

POC para CVE-2025-55182 – Ejecución Remota de Código en Next.js 16.0.6 Este repositorio contiene un proof-of-concept POC funcional para CVE-2025-55182 , una vulnerabilidad crítica de deserialización que afecta a Next.js 16.0.6. El exploit abusa de la deserialización de chunks $@ y de...

CVE-2021-46703

CVE-2021-46703 Simple payload builder based on POC in: https://github.com/Antaris/RazorEngine/issues/585 Usage C dotnet build --configuration Release .\bin\Release\net4.8\Poc.exe "System.IO.File.WriteAllText"rce.txt", "Hello World";" Python ./poc.py "System.IO.File.WriteAllText"rce.txt",...

log4j-rce-CVE-2021-44228

Overview This is a project to actually test the remote code execution vulnerability CVE-2021-44228 in log4j2. Start the Containers docker-compose up It takes a little time for the log4j container to become usable after starting. Check the progress with the following command: docker logs -f log4j...

l4s-vulnapp

Aplicación vulnerable Log4Shell l4s-vulnapp Esta es una aplicación web Java potencialmente vulnerable que contiene Log4j 2.14.1, afectada por log4shell CVE-2021-44228. Entorno verificado y distintas versiones AdoptOpenJDK 17.0.10+7 Gradle 8.6 Gretty 4.1.2 Apache Tomcat 10.1.15 Apache Log4j Core...

Poleposph

Poleposph 스캔 도구 CVE-2024-25600 - WordPress Bricks Builder 원격 코드 실행RCE...

CVE-2016-2098

CVE-2016-2098 Action Pack en Ruby on Rails anterior a 3.2.22.2, 4.x anterior a 4.1.14.2, y 4.2.x anterior a 4.2.5.2 permite a atacantes remotos ejecutar código Ruby arbitrario aprovechando el uso sin restricciones del método render por parte de una aplicación RCE...

CVE-2023-42793

CVE-2023-42793 TeamCity CVE-2023-42793 RCE Ejecución Remota de Código rce.py Inspirado en - https://www.prio-n.com/blog/cve-2023-42793-attacking-defending-JetBrains-TeamCity python3 rce.py --url teamcity.runner.htb --command whoami exploit.py Este script es una copia de...

CVE-2013-0156

Referencia del Script Original Para más detalles sobre el script de exploit original, consulta el enlace gist CVE-2013-0156 Script de Explotación CVE-2013-0156 Este script está diseñado específicamente para resolver el desafío en PentesterLab para el exploit CVE-2013-0156. Puedes acceder al desaf...

CVE-2022-36804-ReverseShell

Proyecto Original https://github.com/BenHays142/CVE-2022-36804-PoC-Exploit CVE-2022-36804-PoC-Exploit Un exploit PoC algo fiable para CVE-2022-36804 Inyección Crítica de Comandos en BitBucket. Este ataque generalmente requiere que los repositorios públicos estén habilitados, sin embargo, las...

CVE-2025-34227_Nagios-XI-Command-Injection-Configuration-Wizard

CVE-2025-34227 Inyección de Comandos Autenticada en Nagios XI Configuration Wizard Repositorio simple de prueba de concepto para CVE-2025-34227, una inyección de comandos autenticada en Nagios XI - Configuration Wizard Análisis completo aquí:...

CVE-2024-25600

CVE-2024-25600 MODIFICADO original - https://github.com/K3ysTr0K3R/CVE-2024-25600-EXPLOIT Exploit RCE de WordPress Bricks Builder Un exploit en Python para CVE-2024-25600: vulnerabilidad de ejecución remota de código en WordPress Bricks Builder. Descripción Esta herramienta explota una...

CVE-2024-47176

CVE-2024-47176 CUPS Common UNIX Printing System is a printing system that primarily uses protocols such as IPP Internet Printing Protocol to manage print jobs and queues. On September 27, 2024, details of a remote code execution in Unix CUPS were disclosed on the internet, with the exploitation...

CVE-2026-100695

Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...

DEBIAN-CVE-2026-100695

Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...