CVE-2020-9547

CVE-2020-9547：FasterXML/jackson-databind Remote Code Execution Vulnerability...

execute-assembly-pico

Execute Assembly PICO A PICO for Crystal Palace that implements native CLR hosting to execute an appended .NET assembly in memory, using the same technique as the donut shellcode generator. This allows you to load .NET tools like Rubeus or Seatbelt from position-independent code without dropping...

CVE-2024-23897

CVE-2024-23897 Jenkins CI Authenticated Arbitrary File Read Through the CLI Leads to Remote Code Execution RCE Jenkins is a self-contained open source continuous integration/continuous delivery and deployment CI/CD automation software DevOps tool written in the Java programming language. It is us...

CVE-2022-21907

CVE-2022-21907 Description - POC for CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability. - create by antx at 2022-01-17. Detail - HTTP Protocol Stack Remote Code Execution Vulnerability. - Similar to https://github.com/antx-code/CVE-2021-31166CVE-2021-31166. - This problem...

EvilClippy

This tool was released during our BlackHat Asia talk March 28, 2019. A video recording of this talk is available at https://www.youtube.com/watch?v=9ULzZA70Dzg. Evil Clippy A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code via P-Code and...

CVE-2024-22274-RCE

Privilege Escalation: VMware vCenter Server Authenticated RCE 📜 Description The “com.vmware.appliance.recovery.backup.job.create” and the “com.vmware.appliance.recovery.backup.validate” API components are vulnerable to a flag injection attack that can be leveraged to execute arbitrary commands as...

CVE-2021-44228

Overview This repository contains OpenIOC rules to facilitate hunting for indicators of compromise related to the Apache Log4j 2 remote code execution vulnerability CVE-2021-44228. These rules are considered hunting rules and as such detection efficacy will vary by organization. With...

EagleVM

EagleVM Playground for generating virtual machine protected x64 assembly. Project Breakdown EagleVM Main protection application that virtualizes code. EagleVM.Core Static library used by EagleVM that provides all virtualization and analysis functionality. EagleVM.Sandbox Project for future testin...

CVE-2026-84706

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list an ANSIBLE prefix check plus a fixed ENVBLOCKLIST that omits process-hijacking loader variables such as BASHENV, ENV,...

SCMKit

SCMKit Description S ource C ode M anagement Attack Toolkit - SCMKit is a toolkit that can be used to attack SCM systems. SCMKit allows the user to specify the SCM system and attack module to use, along with specifying valid credentials username/password or API key to the respective SCM system...

svn-extractor

Svn-Extractor Many a times web application pen-testers are encountered with the presence of .svn folders. For those not aware .svn folder is used by SVN version control system to perform its operations. For a blackbox pentest this folder contains huge amount of information. Some of the key areas...

CVE-2019-16759

CVE-2019-16759 vBulletin 5.x Unauthorized RCE Batch Detection Script This vulnerability is quite trivial; out of 200+ random targets, only 5 had it. Now handle it yourself—you already have PHP, how can you not get a reverse shell?...

CVE-2019-19634

CVE-2019-19634 - class.upload.php = 2.0.4 Arbitrary file upload Author - Jinny Ramsmark Affected vendor - Verot.net Affected product - class.upload.php = 2.0.4 Tested on newly installed Ubuntu 14.04 with PHP5 and Apache Specifically Debian/Ubuntu has been found to be vulnerable since they add the...

the-hacking-trove

This repository does not have a README...

CVE-2024-23746

CVE-2024-23746 Miro Desktop 0.8.18 on macOS allows Electron code injection. PoC signature and version: tool used to explore the vulnerability: https://github.com/r3ggi/electroniz3r verify if is vulnerable: inject a Blind Shell: References...

CVE-2019-19609

Strapi CMS Exploit This exploit targets two vulnerabilities in the Strapi CMS Framework version 3.0.0-beta-17.4 allowing for unauthenticated remote code execution RCE. Vulnerabilities CVE-2019-18818 Weak Password Recovery Mechanism for Forgotten Password CVSS : 9.8 - Critical More details:...

CVE-2024-6387

CVE-2024-6387.py - PoC Important Notes!!! The exploit works ONLY for 32-bit OpenSSH-Servers. This is due to the POC uses 32-bit pointers! It is also known that some versions are already patched, and not every server is vulnerable. Tested on: Kali Linux, ParrotSec, Ubuntu 22.04 📜 Description Remot...

CVE-2026-84684

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a source inventory to a constructed inventory through the inputinventories relationship endpoint, the controller verifies only that the requesting user can read the source inventory, rather than that...

CVE-2026-84679

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The AWXTASKENV setting accepts arbitrary environment variable keys with no restriction, and its values are applied directly to the running automation controller web and task processes rather than only to sandboxed...

rails-exploit-cve-2013-0156

== Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155 Bootstrapped a Rails 3.2.10 application with the remote code execution exploit. Ref: https://github.com/ronin-ruby/ronin-ruby.github.com/blob/rails-pocs/blog/posts/2013-01-09-rails-pocs.md === Setup Install gem dependencies and fire up the...