CVE-2026-73310

CVE-2026-73310: OAuth2 redirect URI not bound to authorization code XenForo before 2.3.13 does not bind an OAuth2 authorization code to the redirect URI used when that code was issued. What happens At the token endpoint, XenForo checks that the submitted redirecturi is somewhere in the client's...

Vidar-Stealer-Chrome-Injection-Malicious-JS-Targeting-Google-Reddit-Sessions-Analysis

1. Binary Ninja – Obfuscation & In-Memory Payload Construction The Vidar Stealer sample loaded in Binary Ninja displays heavily obfuscated code within the main.vxormo function. The analysis reveals that the malware relies on string encryption, custom XOR routines, and runtime memory assembly to...

CVE-2025-55182

RSC Detector - React Server Components Vulnerability Scanner A Python-based security scanner for detecting and exploiting React Server Components RSC vulnerabilities in Next.js applications. This tool performs passive detection, active fingerprinting, and RCE exploitation testing. ⚠️ WARNING : Thi...

CVE-2026-47117-openmed-rce

CVE-2026-47117: OpenMed Unauthenticated Remote Code Execution via PII Model Loading Severity: Critical, CVSS 4.0 9.3 , CVSS 3.1 9.8 assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...

CVE-2020-14882

WebLogic RCE Vulnerability - CVE-2020-14882 Introduction CVE-2020-14882 is a remote code execution RCE flaw in the Console component of Oracle WebLogic Server. The pre-authentication flaw was given an attack complexity of “low” and highlighted as “easily exploitable” by Oracle resulting in it bei...

CVE-2017-12615-PoC

CVE 2017-12615 Apache Tomcat Windows RCE ⚠️Warning This is a proof of concept environment and exploit for known CVEs, strictly for learning and educational purposes. Do not use these scripts or techniques on systems you do not own or have explicit permission to test. Unauthorised access or...

CVE-2024-27956-RCE

CVE-2024-27956-RCE A PoC for CVE-2024-27956, a SQL Injection in ValvePress Automatic plugin. This PoC exploit the vulnerability creating a user in the target and giving Administrator rights. Being an administrator in wordpress can lead to Remote Code Execution. Usage git clone...

CVE-2024-38063

CVE-2024-38063 Research – Windows IPv6 Kernel Remote Code Execution 1. Project Overview This repository contains our research and analysis of CVE-2024-38063 , a critical vulnerability in the Windows TCP/IP stack. CVE stands for Common Vulnerabilities and Exposures. It is a standardized dictionary...

CVE-2025-62369

CVE-2025-62369 PoC This script exploits CVE-2025-62369 in Xibo CMS to execute a reverse shell command. Author Name: Cristian Branet GitHub: cristibtz Usage 1. Start a listener nc -lvnp 2. Run the exploit python3 exploit.py -u "http://:" -s "" -i -p : Xibo CMS server IP : Xibo CMS server port :...

stylesmuggler-ioc-toolkit

StyleSmuggler IOC Toolkit — CVE-2026-75650 Magento zero-day · Adobe Commerce zero-day · CVE-2026-75650 · APSB26-146 · VULN-39341 · unauthenticated RCE · Magento malware · Magento backdoor removal · Magento 2.4.9 vulnerability · Rust implant · GraphQL styles injection · PHP web shell Community...

agentic-workflow-injection

Agentic workflow injection: fixtures and a coverage comparison Reproducible vulnerable/fixed fixtures for the class of bug published as CVE-2026-44246 nnU-Net, agentic workflow injection, CVSS 7.2, CWE-1427, plus the measured output of three detectors against them. It exists because there was...

CVE-2024-21413

CVE-2024-21413 Microsoft Outlook Remote Code Execution Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413 python3 CVE-2024-21413.py -u [email protected] -p password -d [email protected] -s mail.example.com -i -u sender email address -p sender password -d...

POC-CVE-2017-8464-OpenCalculator

CVE-2017-8464 / research + PoC Create 1 Shortcut + 1 .DLL containing malicious payload = Put it on a USB and send to victim = victim opens USB = Payload automatically triggers ! ROOT CAUSE 1. First, we need to know exactly where this bug comes from! It's because of a feature called Plug-and-Play ...

cve-2007-2447

CVE-2007-2447 Requisites pysmb Information The CVE-2007-2447 affects Samba from version 3.0.0 to 3.0.25rc3. It allows attackers to execute shell commands in the username parameter. Usage Open a listening port of your choice, set up the variables in the script and execute the script...

CVE-2021-42013

CVE-2021-41773 / CVE-2021-42013 Apache Vulnerability Scanner A comprehensive Python-based vulnerability scanner for detecting CVE-2021-41773 and CVE-2021-42013 path traversal and remote code execution vulnerabilities in Apache HTTP Server versions 2.4.49 and 2.4.50. Overview CVE-2021-41773 and...

rendering-code-outside-the-sandbox-cve-2026-76036-dawn-webgpu-buffer-overflow-in-chrome-on-android

CVE-2026-76036 — Dawn WebGPU NPOT Depth/Stencil Mipmap Detection Harness Critical CVSS 9.6, CWE-122 heap buffer overflow in Dawn , Chromium's WebGPU implementation, in Google Chrome on Android prior to 151.0.7922.169 stable 151, released 2026-08-18. Root cause, per Dawn fix commit 178fb7048ad3: t...

CVE-2023-43355-CMSmadesimple-Reflected-XSS---Add-user

CMSmadesimple Reflected XSS v2.2.18 Author: Sergio Description: Multiple cross-site scripting XSS vulnerabilites in install/adduser.php of CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again in the My Preferences - Add...

WordPress PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution vulnerability

Unauthenticated PHP Object Injection to Remote Code Execution vulnerability discovered by Osman Hussein in WordPress Plugin PDF Invoice Builder for WooCommerce versions = 7.1.1...

CVE-2026-16723

CVE-2026-16723 Fastjson RCE ★ CVE-2026-16723 Fastjson @JSONType RCE PoC ★ Overview CVE-2026-16723 is a Remote Code Execution RCE vulnerability in Fastjson 1.x 1.2.68 – 1.2.83. When Fastjson parses attacker-controlled JSON, a crafted @type value is turned into a class-resource lookup inside...

CVE-2025-55182-POC

CVE-2025-55182-POC React2Shell POC Usage: sudo python3 hehe.py -t -c Example: ❯ sudo python3 hehe-t 12.05.12.05 -c "id" . .. . | \ | | / \ / || || | | | / || | | | | || | | | | | | | | / ^ \ | ,----'---| |----| | | | | ----| || | | | | | | | | / | | / /\ \ | | | | | | | | \ \ | | | | | | | | | |...