EUVD-2026-104600

The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...

CVE-2026-22241

CVE-2026-22241 Lab Environment for CVE-2026-22241 Vulnerability Description: Vulnerability: Unrestricted Upload of File with Dangerous Type. Impact: Remote Code Execution RCE. Description: This flaw allows an attacker with administrative privileges to upload a malicious PHP file Web Shell, leadin...

Mysql_CVE-2024-27766

Exploit Reproduction Guide affected product version MariaDB 11.1 This guide provides step-by-step instructions to reproduce a User-Defined Function UDF attack on a database system. Please note that this exploit may work on some systems, but it might not function correctly on 64-bit architectures ...

-CVE-2024-31211

To create a Metasploit module that exploits the RCE vulnerability in WordPress via the unserialization of instances of the WPHTMLToken class, we'll focus on crafting a payload that triggers the unserialization flaw, leading to arbitrary code execution. Metasploit Module Save the following code as...

CVE-2026-3891

CVE-2026-3891 — Pix for WooCommerce Unauthenticated File Upload RCE Nonce Leak → certificatecrtpath Upload → Code Execution Overview CVE-2026-3891 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin by linknacional versio...

CVE-2026-54424

CVE-2026-54424 Exploiting Parsec for Windows versions 150-104a to gain: Remote code execution as SYSTEM Arbitrary file read as SYSTEM NTLM hash capture for SYSTEM The exploits stem from the same vulnerability, but the actual paths diverge. Technical writeup:...

CVE-2019-18655

CVE-2019-18655 metasploit module. SEH based buffer overflow in file sharing wizard app v.1.5.0. CVE summary: File Sharing Wizard version 1.5.0 is affected of Structured Exception Handler based buffer overflow vulnerability. An unauthenticated attacker is able to perform remote command execution a...

CVE-2025-69212

CVE-2025-69212 Description OpenSTAManager is a management software solution for technical assistance, electronic invoicing, and accounting. The versions =2.9.8 are vulnerable to an authenticated remote code execution vulnerability. An attacker can exploit this issue by uploading a specially craft...

CVE-2022-36804-ReverseShell

Original Project https://github.com/BenHays142/CVE-2022-36804-PoC-Exploit CVE-2022-36804-PoC-Exploit A somewhat reliable PoC exploit for CVE-2022-36804 BitBucket Critical Command Injection. This attack generally requires public repos to be enabled, however session cookies are also compatible with...

CVE-2024-40275_Scanner

CVE-2024-40725 Scanner A Python-based detection tool for CVE-2024-40725 , an Apache HTTP Server source code disclosure vulnerability affecting versions 2.4.0 and 2.4.61. Legal notice: Only run this scanner against servers you own or have explicit written authorization to test. Unauthorized use ma...

vuln-app-CVE-2025-55182

Vulnerable Next.js RSC Application - CVE-2025-55182 ⚠️ WARNING: This application is intentionally vulnerable for educational and security research purposes only. DO NOT deploy to production or expose to the internet. Overview This is a vulnerable Next.js application that demonstrates CVE-2025-5518...

CVE-2026-64638

CVE-2026-64638 // XSS2Shell Technical analysis and defensive mitigation matrix for the CVE-2026-64638 XSS2Shell vector, a critical parsing inconsistency in the WordPress Core authentication screen that makes it possible to chain a reflected pre-authentication Cross-Site Scripting XSS with browser...

CVE-2017-5638-ApacheStruts2.3.5

CVE-2017-5638-ApacheStruts2.3.5 A exploit for CVE-2017-5638. This exploit works on versions 2.3.5-2.3.31 and 2.5 – 2.5.10 Requirements optparse, requests Usage This exploit can be used like this: $ python3 CVE-2017-5638ApacheStruts.py -u http://10.129.187.188:8080/Monitoring/example/Welcome.actio...

CVE-2025-4322-Exploit

CVE-2025-4322 - Unverified Password Change CWE-620 Exploit: Download here Details CVE ID : CVE-2025-4322 Published : 05/20/2025 Impact : Critical CVSS : 9.8 Patch Available: No official patch yet Impact Critical severity vulnerability that enables attackers to potentially: - Escape the browser's...

CVE-2025-52691

CVE-2025-52691 SmarterMail Build 9406 and earlier is vulnerable to arbitrary file upload. An unauthenticated attacker can upload arbitrary files to any location on the mail server, potentially enabling remote code execution. How does this detection method work? Sends a GET request to...

CVE-2025-26264

CVE-2025-26264 CVE-2025-26264 - GeoVision GV-ASWeb with the version 6.1.2.0 or less, contains a Remote Code Execution RCE vulnerability within its Notification Settings feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary command...

cve-2025-66398

⚠️ cve-2025-66398 - Simple RCE Proof of Concept Tool ⚙️ About This Tool This project demonstrates a remote code execution RCE vulnerability in Signal K Server versions 2.18.0 and earlier. The proof of concept PoC shows how an attacker could run commands on a vulnerable device. This tool is designed...

CVE-2025-53772-IIS-WebDeploy-RCE

CVE-2025-53772 - IIS WebDeploy RCE Exploit This repository contains a Proof-of-Concept PoC exploit for CVE-2025-53772, a Remote Code Execution vulnerability in IIS WebDeploy through unsafe deserialization. ⚠️ Disclaimer This tool is for educational and authorized security testing purposes only. Th...

CVE-2024-6783

CVE-2024-6783 - Vue CVE A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript...

CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day

CVE-2025-54253: Inside the Adobe AEM-Forms Zero-Day — What Pentesters & Defenders Must Do TL;DR: Adobe Experience Manager AEM Forms on JEE ≤ 6.5.23.0 contained a critical, network-accessible flaw CVE-2025-54253 that allows unauthenticated remote code execution via misused Struts/OGNL endpoints. A...