CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit 🛡️ Description CVE-2026-3891 is a critical Unauthenticated Arbitrary File Upload vulnerability found in the Pix for WooCommerce WordPress plugin in versions up to and including 1.5.0. The vulnerability exists in the lknpixforwoocommercec6savesetting...

katana

Katana A BootROM exploit for Qualcomm devices released within 2016 til 2019. Brief Explanation of the Exploit With the MSM8998 Nazgul SoC, the command 0x13 SAHARARESETSTATEMACHINEID was added. The command called into bootsaharaentry, which is supposed to reinitialize Sahara. The flaw is that each...

CVE-2025-40634

CVE-2025-40634 The TP-Link Archer AX50 router is vulnerable to a stack-based buffer overflow on its firmware version 1.0.14 Build 20240108 rel.426554555, leading to Remote Code Execution both in the LAN and in the WAN side. This vulnerability has the same root cause as CVE-2020-10881, found by th...

CVE-2024-7954-RCE

Description The porteplume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. Exploit Proof of concept POST...

CVE-2022-30525

CVE-2022-30525 Zyxel Firewall Command Injection Vulnerability CVE-2022-30525 POC&EXP author:160team.west9B For use only by authorized security researchers. Comply with cybersecurity laws. Any issues arising are your own responsibility, and the author bears no liability. 01-Introduction On May 12,...

CVE-2021-22911

CVE-2021-22911 Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1 The getPasswordPolicy method is vulnerable to NoSQL injection attacks and does not require authentication/authorization. It can be used to take over accounts by leaking password reset tokens. Taki...

cve-2022-22980

spring-data-mongodb-cve-2022-22980-exp A mediocre vulnerability, just making a note. 1. Start Redis, port 27017 2. Start the project, SpringBoot starts on port 6666 3. GET /v1/user/get?username=Tjava.lang.Runtime.getRuntime.exec'open+-a+calculator.app' HTTP/1.1 Host: localhost:6666 Accept-Encodin...

CVE-2022-24734

CVE-2022-24734 PoC An RCE can be obtained on MyBB's Admin CP in Configuration - Add New Setting. The user must have a rights to add or update setting. This is tested on MyBB 1.8.29. Sources: https://github.com/mybb/mybb/ https://vulners.com/cve/CVE-2022-24734...

CVE-2022-46169

CVE-2022-46169 CVE-2022-46169 Cacti remoteagent.php Unauthenticated Command Injection. Auth Bypass Add X-Forwarded-For header to bypass authentication, note that its value is not a fixed value. Brute Force Use Burp Intruder to fuzz test the values of hostid and localdataids. RCE The point of...

CVE-2021-25641-Proof-of-Concept

The 0xDABB of Doom - CVE-2021-25641-Proof-of-Concept Apache/Alibaba Dubbo = 2.7.3 PoC Code for CVE-2021-25641 RCE via Deserialization of Untrusted Data; Affects Versions = 2.7.6 With Different Gadgets Covered in-depth in the article "The 0xDABB of Doom", published on the Checkmarx blog...

CVE-2022-27502

RealVNC server up to 6.9.0 DLL Hijacking Exploit CVE-2022-27502 You can use pre-compiled version 64-bit of it from HERE Copy it to %TEMP% and initiate a repair of RealVNC Server from add or remove programs. It will write the output of whoami command in %TEMP%\output.txt If you want to change the...

CVE-2023-38646

CVE-2023-38646 Code to detect/exploit vulnerable metabase application...

CVE-2026-66066-POC

PoC for CVE-2026-66066 - Minimal stock Rails/libvips lab This repository reproduces the Rails Active Storage file-read-to-RCE chain described by GHSA-xr9x-r78c-5hrm against Rails 8.1.3, the newest affected Rails 8.1 release. Rails 8.1.3.1 is the patched control. Use it only in the disposable loca...

CVE-2025-50165-x64-Exploit

CVE-2025-50165 Windows Graphics Component RCE x64 Critical Remote Code Execution via malicious JPEG – Windows 11 24H2 unpatched CVSS 9.8 – No privileges, no interaction required CVE-2025-50165 - windowscodecs.dll untrusted pointer dereference Discovered by Zscaler ThreatLabz Patched: November 202...

vcenter_rce

vcenterrce Exploit，Vmware vCenter 6.5-7.0 RCE（CVE-2021-21972），upload 冰蝎3，getshell Usage： python3 vcenterrce -u url...

CVE-2022-22965_PoC

Spring Framework RCE exploitation Quick pentest notes Step 1: Find some endpoint in your target where is accepted POST/PUT methods + encode your payload URL encode POST /path/upload HTTP/1.1 Host: Origin: Cookie: JSESSIONID=BE65B534335A5A2538624404C063B70C; Content-Type:...

CVE-2026-34197

CVE-2026-34197 CVE-2026-34197 activemq PoC PoC for the ActiveMQ as per Horizon3 post https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/ krasn@icestorm cve-2026-34197-activemq % docker compose up -d krasn@icestorm cve-2026-34197-activemq % python3 exploitpoc.py au...

CVE-2024-32113-POC

Apache OfBiz vulns POC for CVE-2024-32113 The USERNAME and PASSWORD params can be provided at the /ecomseo/AnonContactus interface, which is publicly accessible to anyone. POC1：RCE curl --noproxy '' -k --location --request POST...

CVE-2024-0012_CVE-2024-9474_PoC

🚀 CVE-2024-0012 & CVE-2024-9474 Palo Alto PAN-OS Exploit 🔐 🛡️ Description This Proof-of-Concept PoC script targeting vulnerabilities in Palo Alto PAN-OS, specifically CVE-2024-0012 and CVE-2024-9474 by automating the exploitation process, including autentication bypass, payload creation, chunked...

CVE-2026-45447

🚨 CVE-2026-45447 - Critical OpenSSL Use-After-Free Vulnerability Heap Use-After-Free in PKCS7verify allowing memory corruption, crashes, and potential remote code execution. 📖 Executive Summary CVE-2026-45447 is a critical vulnerability in OpenSSL's PKCS7 verification functionality. The flaw exis...