CVE-2025-55188

CVE-2025-55188: 7-Zip Arbitrary File Write Proof-of-concept of CVE-2025-55188, an arbitrary file write in 7-Zip. Patched in version 25.01, released on August 3, 2025. Note: CVE-2025-55188 is different than CVE-2025-11001. The version that CVE-2025-11001 was patched in version 25.00 is still...

CVE-2025-14558

CVE-2025-14558 FreeBSD rtsold DNSSL Command Injection RCE Description rtsold8 does not validate DNSSL domain names for shell metacharacters before passing them to resolvconf8. Command substitution via $ enables remote code execution from an adjacent network. Affected: FreeBSD 13.x, 14.x, 15.x...

solrradar

Mass Reconnaissance & Exploitation Framework for Apache Solr Velocity Template Injection → Remote Code Execution 📑 Table of Contents Vulnerability Overview Affected Versions Features Installation Usage Proof of Concept Technical Deep-Dive Detection Methodology Defense & Mitigation Disclaimer...

react2shell-poc

React2Shell - CVE-2025-55182 PoC Proof of Concept for CVE-2025-55182 , a critical unauthenticated Remote Code Execution vulnerability in React Server Components. CVSS Score: 10.0 Critical Vulnerability The vulnerability exists in React's Flight protocol deserializer. By exploiting prototype...

CVE-2025-8110

CVE-2025-8110 معالجة غير صحيحة للروابط الرمزية في واجهة برمجة تطبيقات PutContents في Gogs تسمح بتنفيذ التعليمات البرمجية محليًا. كيف تعمل طريقة الكشف هذه؟ يستخرج إصدار Gogs من التذييل في /user/login عبر التعبير العادي Gogs Version: X.X.X ويصنف الإصدارات التي تعمل بالإصدار 0.13.3 أو ما قبله على أن...

CVE-2025-55182

CVE-2025-55182 - React & Next.js Server Actions RCE Exploit Full-featured Remote Code Execution exploit and scanner for CVE-2025-55182 in React/Next.js Server Actions. Original PoC: Spritualkb/CVE-2025-55182-exp Overview CVE-2025-55182 is a critical prototype pollution vulnerability in React Serv...

CVE-2026-23744-MCPJam-Exploit

CVE-2026-23744 MCPJam Inspector RCE Exploit ⚠️ AVISO LEGAL Esta herramienta es SOLO para pruebas de seguridad autorizadas y fines educativos. El uso no autorizado es ilegal. Los usuarios asumen toda responsabilidad por sus acciones. 📋 Resumen Este repositorio contiene una prueba de concepto del...

CVE-2026-82598

A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. The exploit has been publicly disclose...

CVE-2026-77956

Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end form lets t...

watchTowr-vs-WatchGuard-CVE-2025-9242

watchTowr-vs-WatchGuard-CVE-2025-9242 Detection Artifact Generator for WatchGuard CVE-2025-9242 https://github.com/user-attachments/assets/097f099b-ba60-4223-adea-04279570460f See our blog post for technical details Detection in Action root@kitploit: python watchTowr-vs-WatchGuard-CVE-2025-9242.p...

CVE-2018-14714-RCE-exploit

CVE-2018-14714 PoC de RCE Vulnerabilidad RCE en routers WiFi ASUS Este PoC es solo con fines de aprendizaje e investigación. No lo utilices para actividades ilegales; eres el único responsable de cualquier consecuencia legal. Esta es una prueba realizada después de modificaciones de código basada...

gogs-CVE-2025-8110

Gogs CVE-2025-8110 PoC This repository contains a Proof of Concept PoC for CVE-2025-8110, a Remote Code Execution RCE vulnerability in Gogs. The exploit targets the internal SSH server implementation, allowing attackers to inject malicious commands via the sshCommand configuration. Usage To run t...

watchTowr-vs-Splunk-CVE-2026-20253

CVE-2026-20253 Splunk Pre-Auth RCE Splunk Pre-Auth RCE 1day Detection Artifact Generator Tool Detection in Action Detection Artifact Generator attempts to access the /v1/postgres/recovery/backup endpoint of PostgreSQL Sidecar Service to verify if it is accessible or not: 400 response - probably...

CVE-2026-48908-PoC

CVE-2026-48908 — SP Page Builder Joomla Unauthenticated RCE Proof-of-concept exploit for CVE-2026-48908 , a critical CVSS 4.0 = 10.0 unauthenticated remote-code-execution vulnerability in the SP Page Builder component comsppagebuilder for Joomla, by JoomShaper...

CVE-2025-55182-shellinteractive

CVE-2025-55182-shellinteractive Base used from: https://github.com/Emiyelbarto/CVE-2025-55182-PoC Thank you very much for the great contribution. Overview CVE-2025-55182 is a deserialization vulnerability in Next.js/React Server Components that allows unauthenticated remote attackers to execute...

wp2shell-poc2

wp2shell-poc إثبات المفهوم لثغرة حقن SQL غير موثّقة في نواة ووردبريس تؤدي إلى تنفيذ أوامر عن بُعد، عبر خلط في مسارات دفعة REST CVE-2026-63030. لا يحتاج الاستغلال إلى بيانات اعتماد أو أي إعدادات تتجاوز الوصول إلى الهدف. يصل إلى الحقن من خلال نقطة نهاية واحدة: POST /wp-json/batch/v1. الاكتشاف نفسه ...

CVE-2025-52691

CVE-2025-52691 SmarterMail الإصدار 9406 والإصدارات الأقدم معرضة لثغرة رفع الملفات التعسفي. يمكن لمهاجم غير مصادق رفع ملفات تعسفية إلى أي موقع على خادم البريد، مما قد يمكن من تنفيذ التعليمات البرمجية عن بُعد. كيف تعمل طريقة الكشف هذه؟ يرسل طلب GET إلى /interface/root/login، ويؤكد وجود SmarterMail...

vuln-app-CVE-2025-55182

Vulnerable Next.js RSC Application - CVE-2025-55182 ⚠️ WARNING: This application is intentionally vulnerable for educational and security research purposes only. DO NOT deploy to production or expose to the internet. Overview This is a vulnerable Next.js application that demonstrates CVE-2025-5518...

CVE-2026-20841-PoC

It is unclear whether this is the correct PoC trigger method; therefore, it is provided for reference only. CVE-2026-20841 - Windows notepad.exe RCE Exploitation condition: Notepad Version 11.2510 step 1. step 2...

CVE-2026-77956 EEx template evaluation of prompt content in AshAi enables remote code execution

Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end form lets t...