sjet

sJET by siberas siberas JMX Exploitation Toolkit sJET allows an easy exploitation of insecure configured JMX services. Additional background information can be found here and here. Prerequisites Jython 2.7 Usage SJET implements a CLI interface using argparse: jython sjet.py targetHost targetPort...

CVE-2020-11932

CVE-2020-11932 Double-Free bug in WhatsApp exploit poc. Note: Make sure to set the listner ip in exploit.c inorder to get shell nc -lvp 1337 or whatever port. and then compile. make or gcc -o exploit egiflib.c exploit.c then run ./exploit and save the content to .gif and send to victim. Source...

CVE-2022-24715

Icinga Web 2 - Authenticated Remote Code Execution 2.8.6, 2.9.6, 2.10 Remote command execution Reverse shell Usage usage: exploit.py -h -u URL -U USER -P PASSWORD -i IP -p PORT Welcome. options: -h, --help show this help message and exit -u URL, --url URL Insert URL http://ipvictima -U USER, --us...

CVE-2023-38831

CVE-2023-38831 WinRAR RARLabs WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file such as an ordinary .JPG file and also a folder that has the same name as t...

CVE-2018-4407

CVE-2018-4407 Massive IOS/MAC Attack Exploit CVE-2018-4407 is a Simple and Very Fast BOF attack Against IOS/MAC that can lead to DOS. The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones,...

CVE-2025-1974

🚨 Log Injection Test via Ingress-NGINX Admission Controller 🧠 Overview This script tests for annotation injection vulnerabilities in Kubernetes clusters using the NGINX Ingress Controller. It is meant for detection purposes only in relation to CVE-2025-1974, which allows malicious annotations to...

-CVE-2026-7465

-CVE-2026-7465 CVE-2026-7465 Spectra Gutenberg Blocks Authenticated RCE Exploit...

CVE-2025-54100

CVE-2025-54100 – PowerShell Response Parsing PoC A concise Proof-of-Concept showing how CVE-2025-54100 can lead to Remote Code Execution RCE in Windows PowerShell 5.1 through malicious HTML parsing. Table of Contents What is CVE-2025-54100? How the PoC Works Quick Start Triggering From a Victim...

CVE-2025-68613-n8n-rce-analysis

Matrix GIF...

CVE-2023-38831

Detection Logic for CVE-2023-38831 WinRAR Exploit This repository contains a detection logic for CVE-2023-38831 WinRAR ZIP file spoofing / double-extension exploit with raw queries / code blocks and ETW-specific provider names + Event IDs. A vulnerable version of WinRAR 6.23 on the target system...

CVE-2024-25600

MODIFIED CVE-2024-25600 original - https://github.com/K3ysTr0K3R/CVE-2024-25600-EXPLOIT WordPress Bricks Builder RCE Exploit A Python exploit for CVE-2024-25600 - WordPress Bricks Builder Remote Code Execution vulnerability. Description This tool exploits a critical vulnerability in WordPress...

staystaystay

staystaystay staystaystay is a proof of concept exploit for CVE-2021-1585, a man in the middle or evil endpoint RCE issue affecting Cisco ASA Device Manager ASDM. The issue was originally discovered by Malcolm Lashley and disclosed in the summer of 2021. However, at the time I was looking at this...

CVE-2021-41773

CVE-2021-41773 Playground This is a small Docker recipe for setting up a Debian bookworm based container with an instance of the Apache HTTPd 2.4.49 that is vulnerable to CVE-2021-41773. CGI has been explicitly enabled so it can be used to test/verify Local file Disclosure behavior as well as...

CVE-2019-11043

CVE-2019-11043 quick and dirty PHP RCE proof of concept...

CVE-2024-4577-RCE

PHP CGI Argument Injection CVE-2024-4577 RCE 📜 Description In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command...

CVE-2017-12615-Home-Lab

ENGLISH BELOW CVE-2017-12615 Tomcat: Remote Code Execution via JSP Upload Lab นี้จำลองช่องโหว่ CVE-2017-12615 Tomcat: Remote Code Execution via JSP Upload เกิดจากการตั้งค่า readonly=false ทำให้สามารถอัปโหลดไฟล์ผ่าน HTTP PUT ได้ รวมถึงไฟล์ .jsp ที่สามารถรันคำสั่ง RCE Features Apache Tomcat 7.0.79...

CVE-2025-50754-PoC

CVE-2025-50754 Stored XSS to Remote Code Execution in a PHP-Based CMS Platform Summary A PHP-based CMS platform version 5 contains a stored Cross-Site Scripting XSS vulnerability in the "Report" feature. When an administrator views a user-submitted report, malicious JavaScript is executed within...

CVE-2020-28502

CVE-2020-28502 node-XMLHttpRequest RCE NVD Description This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code bein...

CVE-2025-66802

CVE-2025-66802 Sourcecodester Covid-19 Contact Tracing System 1.0 – Unrestricted File Upload Leading to Remote Code Execution Description Sourcecodester Covid-19 Contact Tracing System version 1.0 contains a vulnerability classified as Unrestricted Upload of File with Dangerous Type CWE-434. The...

CVE-2024-42327_Zabbix_SQLi

🛡️ Zabbix 7.0.0 SQL Injection Exploit Script A Python script to exploit a Zabbix 7.0.0 authenticated SQL injection vulnerability, supporting multiple modes of action including user data extraction, session token leaks, remote command execution RCE, and custom query injection. ⚠️ DISCLAIMER: This...