PoC-CVE-2025-62222

PoC: CVE-2025-62222 - GitHub Copilot Chat RCE This repository contains a Proof of Concept PoC for the vulnerability CVE-2025-62222. It demonstrates how Remote Code Execution RCE can be achieved on a developer's machine by manipulating the context of GitHub Copilot Chat in VS Code via hidden promp...

CVE-2024-46538

This post is a research article published by EQSTLab. Thanks tophysicszq, who discovered this vulnerability. CVE-2024-46538 ★ CVE-2024-46538 PfSense Stored XSS lead to Arbitrary Code Execution PoC ★ https://github.com/user-attachments/assets/f41d0945-b7f4-4f88-bac5-265904256aae Description...

CVE-2021-38163

CVE-2021-38163 - SAP NetWeaver AS Java Desynchronization Vulnerability Description CVE-2021-38163 is a security vulnerability in SAP NetWeaver Application Server AS Java that allows an authenticated attacker to upload arbitrary files to the server, potentially leading to remote code execution RCE...

RCE-QloApps-CVE-2024-40318

RCE-QloApps-CVE-2024-40318 A remote code execution RCE attack allow an attacker run code on a computer. The ability to execute code could lead to deploying additional malware or stealing sensitive data or even harm the server. The remote code execution was discover in Qloapps version 1.6.0.0 whil...

CVE-2025-29306

POC - CVE-2025-29306 FOXCMS /images/index.html Code Execution Vulnerability Overview An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. Full POC Read about it — CVE-2025-29306 Disclaimer : This Proof of Concept POC ...

CVE-2021-41773

CVE-2021-41773 A Zeek package which raises notices for Path Traversal/RCE in Apache HTTP Server 2.4.49 CVE-2021-41773 and 2.4.50 CVE-2021-42013 References https://httpd.apache.org/security/vulnerabilities24.htmlCVE-2021-41773 https://httpd.apache.org/security/vulnerabilities24.htmlCVE-2021-42013...

Hacking-pdf.js-vulnerability

🚨 CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js This project demonstrates and analyzes CVE-2024-4367 , a high-severity vulnerability in Mozilla’s PDF.js library that allows arbitrary JavaScript execution through improper type checking in font handling code. Our research shows how a...

CVE-2017-1000486

CVE-2017-1000486 This is a PoC of CVE-2017-1000486 with some payloads useful to bypass blacklisting lexicographic checks on standard functions used to achieve RCE getClass, exec, etc.. and for retrieving primefaces secret through Padding Oracle in order to be less noisy possible on exploitation...

itsm-exploit

Exploits for Ivanti Neurons for ITSM On Premise This script exploits several flaws that allow an unauthenticated attacker to gain administrator access and execute remote commands CVE-2023-46808 on Ivanti Neurons for ITSM On Premise. For technical details, see Technical Details Affected versions...

nextjs-security-scanner

日本語版は README.ja.md を参照してください。 nextjs-security-scanner Bash script to detect CVE-2025-55182 React2Shell and credential exposure in Next.js projects. Zero dependencies. CVE-2025-55182: React2Shell CVSS: 10.0 CRITICAL | CWE-502: Deserialization of Untrusted Data | SNORT SID: 65554 Unauthenticated...

POC-CVE-2026-0768

Description Proof of concept exploit code for CVE-2026-0768 Usage python3 poc.py -u -c...

Intel-CVE-2015-2291

Intel-CVE-2015-2291 PoC exploit for CVE-2015-2291 Data-only attack to pop a system shell with the vulnerable intel driver. The code itselfs implements more "functionality" provided from the driver, like physical to virtual address translation, mapping physical memory This two combined = arbitrary...

GPON

RCE on GPON home routers CVE-2018-10561 Vulnerability Many routers today use GPON internet, and a way to bypass all authentication on the devices CVE-2018-10561 was found by VPNMentor. With this authentication bypass, it's also possible to unveil another command injection vulnerability...

CVE-2025-49844

CVE-2025-49844 RediShell AI-made Revshell PoC Untested completition of the Redishell PoC made by AI. Original PoC: https://github.com/raminfp/redisexploit/blob/main/exploitpoc.py Korean Piece: https://github.com/dwisiswant0/CVE-2025-49844/blob/master/CVE-2025-49844.lua Progress ? We later went...

CVE-2025-55182-Scanner

🛡️ CVE-2025-55182 Scanner React2Shell Developed by:SainiON Hacks A standalone GUI tool to detect and demonstrate the React Server Components Remote Code Execution RCE vulnerability CVE-2025-55182 in Next.js applications. 📺 Demo & Tutorial Watch the full breakdown and tool demonstration on my...

CVE-2026-115946 XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder

XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or...

CVE-2026-115946 XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder

XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or...

CVE-2026-115946

The Perl module XS::libbrotli versions before 1.2.1.0 are vulnerable to an out-of-bounds write in the bundled brotli library decoder. Affected versions compile a bundled copy (versions 1.0.7 or 1.1.0) into static archives that dependent modules link against at build time, bypassing the system lib...

CVE-2016-3714

CVE-2016-3714 ImageMagick Code Execution CVE-2016-3714 imagickbuilder.py = Simple Payload Builder to Exploit CVE-2016-3714 imagickbypassshell.php = PHP based web shell leveraging the PHP imagick extension wrapper to bypass disabled functions Few Images of things working: Payload Builder: imagick...

CVE-2014-6271

CVE-2014-6271 A vulnerability known as "ShellShock" exists in GNU Bash through 4.3 due to how it processes trailing strings in the values of environment variables after function definitions. This vulnerability enables remote attackers to execute arbitrary code by crafting the environment in certa...