Exploit for CVE-2026-96451

CVE-2026-96451 WordPress Ultimate Member plugin = 2.13.1 -...

cve-2026-67363-67364

Balbooa Forms pre-auth RCE + Payment Tampering CVE-2026-67364 / CVE-2026-67363 PoC and detection templates for two pre-auth vulnerabilities in Balbooa Forms combaforms for Joomla, fixed in 2.4.3.2. CVE-2026-67364 — Pre-auth PHP Code Injection - RCE CVSS 9.8 CVE-2026-67363 — Pre-auth Payment Amoun...

CVE-2026-80844

CVE-2026-80844 Donar Ayuda a mantener este proyecto Si encuentras útil este proyecto, considera apoyar su mantenimiento continuo a través de PayPal o ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ El diez por ciento de cada donación se destina al Hospital...

copyfail-fix

CopyFail-Fix 🌐 English | Português | Español | 中文 | Íslenska One-command mitigation and patch for CVE-2026-31431 — the Linux kernel "Copy Fail" local privilege escalation vulnerability. The script disables the affected algifaead module, upgrades your kernel via apt, and optionally installs a...

cover

Cover Keep private data, internal infrastructure and secrets out of cloud coding agents without breaking your workflow. Install · Quick start · Policies · Monitoring · Pi / OMP · Security Cover is a bidirectional privacy proxy for AI coding agents. It replaces matched sensitive values locally wit...

Exploit for Unrestricted Upload of File with Dangerous Type in Rconfig

CVE-2022-44384 Authenticated arbitrary file upload leading to...

Security update for the Linux Kernel (Live Patch 74 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.280 fixes various security issues: The following security issues were fixed: CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free i...

FreePBX-SQLi-RCE

FreePBX CVE-2025-57819 - SQLi no autenticada a RCE PoC Solo para investigación educativa y de seguridad - Ver aviso legal a continuación Prueba de concepto de explotación para CVE-2025-57819, una vulnerabilidad crítica de inyección SQL no autenticada en FreePBX que permite la ejecución remota de...

lockjaw

Lockjaw - Advanced Windows C2 Framework v0.2.15 Lockjaw is an advanced, modular command-and-control C2 framework engineered for red team engagements, adversarial simulations, and stealth operations. It utilizes a modern split-language architecture: a high-concurrency Rust Teamserver coupled with ...

react2shell-CVE-2025-55182

React2Shell 漏洞利用 CVE-2025-55182 用于 Next.js React 服务器组件 RCE 漏洞的 Python 利用工具，支持 HTTP/HTTPS。 🚀 快速开始 克隆并运行 git clone https://github.com/BrianLopezM99/react2shell-CVE-2025-55182.git cd react2shell-CVE-2025-55182 python3 exploitreact2shell.py "" 📖 使用方法 HTTP python3 exploitreact2shell.py...

-CVE-2025-8088

-CVE-2025-8088 POWERSHEL script to check if your device is affected or no 🚨 CVE-2025-8088: WinRAR Zero-Day Alert! 🚨 A critical WinRAR vulnerability CVE-2025-8088 is making headlines – attackers can exploit this flaw in versions 7.13 to execute malicious code just by tricking users into opening a...

cve-2026-82222-poc

CVE-2026-82222 Unauthenticated PHP object injection to RCE in GiveWP & % in the command; spaces become $IFS. Pass a form id if discovery misses. Pass -g if the script cannot find an enabled gateway. The donation request often returns HTTP 500 or times out. That is expected. The session write...

CVE-2022-22980

SpEL RCE Exploit - CVE-2022-22980 Exploit for remote code execution RCE on Spring Data via SpEL injection Spring Expression Language. Descriptions Vulnerability The box exposes an endpoint /search that accepts a trackingid parameter vulnerable to SpEL injection. This injection allows the executio...

Dirty-Pipe-Exploits

CVE-2022-0847 Exploits Dirty Pipe What is it ? Disclosed on March 7, 2022 by Max Kellerman2, CVE-2022-0847 is a vulnerability in the Linux kernel versions 5.8 to 5.16.11 that allows attackers to overwrite read-only or immutable files and escalate their privileges on the victim's system...

abyss-c2

ABYSS C2 — HiSilicon DVR Exploit Framework ⚠️ 仅供教育/演示目的 本软件仅供在受控且授权环境中进行教育和授权的安全研究 。旨在演示常见的 IoT 漏洞及后渗透技术。 您不得在以下设备上使用本软件： 任何您不拥有的系统或设备 任何未经您明确书面授权测试的系统或设备 任何未经事先批准的生产基础设施 创建者对使用本软件进行的任何滥用、损坏或非法活动不承担任何责任。 使用本软件即表示您承认自己有责任确保遵守所在司法管辖区所有适用法律法规。未经授权访问计算机系统在诸如《计算机欺诈与滥用法》（CFAA）及全球类似法规下均属非法。 本项目旨在演示：...

CVE-2024-48990

CVE-2024-48990 — needrestart 本地权限提升 通过 PYTHONPATH 注入，针对 Ubuntu/Debian 系统上 needrestart /environ 继承进程的完整环境 ——包括 PYTHONPATH。一个无特权的本地用户可以利用这一点： 1. 将 PYTHONPATH 设置为包含恶意 importlib 包的目录 2. 保持一个 Python 进程运行，以便 needrestart 在扫描时发现它 3. 等待 needrestart 执行——它会以 root 身份加载攻击者的 importlib/init.py 受影响版本 包| 受影响| 已修复...

CVE-2025-55182-PoC

⚡ React2Shell PoC de Exploit CVE-2025-66478 Ejecución Remota de Código RCE en Next.js mediante Contaminación de Prototipos en Componentes del Servidor 🕵️‍♂️ Descripción general Este repositorio contiene una Prueba de Concepto PoC para CVE-2025-66478 también referenciada como CVE-2025-55182 en...

CVE-2026-26119

CVE-2026-26119 WAC RCE - CVE-2026-26119 RCE autenticado en Windows Admin Center mediante WinREST/PowerShell invokeCommand. Uso: python3 wacrce.py "" WACPASS= python3 wacrce.py Entorno: WACBASE - override target base URL default below WACPASS - password, used if not passed positionally...

CVE-2026-16723

CVE-2026-16723 Exploit A standalone C++17 implementation for CVE-2026-16723 , a critical vulnerability affecting Fastjson versions 1.2.68 – 1.2.83. Requirements Linux or WSL on Windows C++17 compatible compiler GCC 7+ or Clang 5+ CMake 3.10 or newer System packages: libzip-dev zlib1g-dev Debian /...

CVE-2025-47812

🚀 Wing FTP Exploit - CVE-2025-47812 针对 Wing FTP Server CVE-2025-47812 的增强型利用工具 - 未授权远程代码执行 RCE 🔧 安装 克隆此仓库并进入目录： git clone https://github.com/0xjuarez/CVE-2025-47812.git cd CVE-2025-47812 pip install -r requirements.txt 或者直接下载 CVE-2025-47812.py 脚本并运行它。 🚀 使用方法 usage: CVE-2025-47812.py -h -u URL -f...