CVE-2025-6218-POC

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open...

CVE-2022-22978-PoC

CVE 2022-22978: Authorization Bypass in RegexRequestMatcher 🥶 Overview According to the information I have gathered, this vulnerability is related to the RegexRequestMatcher class in the Spring Security framework. Specifically, applications using RegexRequestMatcher where the regular expression...

CVE-2025-55182-Advanced-React-Server-Components-RCE-Exploit

🔐 ReactRCE-Scanner CVE-2025-55182 — Advanced React Server Components RCE Exploit & Assessment Framework 📑 Table of Contents Legal Disclaimer & Ethical Notice Overview Key Capabilities Quick Start Guide Architecture & Feature Deep Dive Configuration Reference Automated Test Suite Remediation &...

CVE-2026-108859

The mcp-go library (versions through 1.2.1 ) is vulnerable to a Denial of Service (DoS) attack within the StreamableHTTPServer.ServeHTTP component. The root cause is unbounded POST body buffering , where the application uses io.ReadAll to read request bodies fully before performing any validation...

CVE-2026-108859 mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll befor...

EUVD-2026-97010

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll befor...

CVE-2026-108859

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll befor...

CVE-2024-4577

PHP CGI Argument Injection CVE-2024-4577 RCE 📜 Description In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command...

CVE-2026-45034

🧨 PHPSpreadsheet Phar Deserialization Exploit BypassprohibitWrappers + Remote Code Execution RCE on phpoffice/phpspreadsheet This repository provides a proof-of-concept PoC exploit for a critical vulnerability in the popular PHP library PHPSpreadsheet. The attack abuses the phar:// wrapper to...

CVE-2025-5548

Exploitation Lab - CVE-2025-5548 FreeFloat FTP Repository for a controlled exploitation lab of CVE-2025-5548 on FreeFloat FTP Server, running on Windows inside an isolated VM. The project is divided into two blocks: Environment/: environment setup tools, IDEs, debugger, disassembler, and vulnerab...

CVE-2020-16012-PoC

CVE-2020-16012 | Side Channel Attack This repository contains Proofs of Concept PoCs for CVE-2020-16012 , a side-channel vulnerability identified in the implementation of CanvasRenderingContext2D.drawImage in Firefox and Chromium. This project was conducted as a collaborative effort by a team of...

CVE-2024-3400

PAN-OS Firewall Exploit Script This script is designed to demonstrate the exploitation of vulnerabilities in PAN-OS firewalls. It sends a specially crafted payload to the firewall's API endpoint to execute arbitrary commands. This exploit specifically targets CVE-2024-3400, a command injection...

CVE-2000-0114

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install CVE-2000-0114 Run bellow command to check CVE-2000-0114 -h Configurations 2. We integrated with the Telegram API to receive...

CVE-2022-35650

CVE-2022-35650 This is an arbitrary file read in Moodle. Prereqs You must have compromised a teacher or admin level user. Steps 1. Clone this repo: git clone https://github.com/Gr4y-r0se/CVE-2022-35650.git 2. Run this command to zip the exploit up zip exploit.zip imsmanifest.xml pool.dat 3. Brows...

PoC-Apache-CVE-2021-41773-Infrastructure-LAB

Apache CVE-2021-41773 — Lab Docker PoC Security Notice This repository reproduces a publicly disclosed and patched vulnerability in a controlled Docker lab environment for educational and research purposes. The environment is intentionally vulnerable and must only be deployed in isolated test...

CVE-2018-6574

CVE-2018-6574 Exploit for remote command execution in Golang go get command. Introduction When you go get a package, Go is designed to build and install the package without running any code from it. The intent is that you can safely get, build, and even install Go packages without trusting them a...

CVE-2022-46169

CVE-2022-46169 CVE-2022-46169 Cacti remoteagent.php Unauthenticated Command Injection. This script checks only the conditions of CVE-2022-46169. What is Cacti? Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. ...

CVE-2022-1388

CVE-2022-1388 PoC for CVE-2022-1388 affecting F5 BIG-IP. Usage $ ./poc.sh --help Usage: poc.sh --help --file FILE --scan --exploit --payload PAYLOAD CVE-2022-1388 PoC script. One or multiple IPs can be scanned. Arguments: --help Show this help message and exit. --file FILE File list containing on...

vulhub-struts2

Apache Struts2 S2-045 RCE CVE-2017-5638 📌 Overview This project demonstrates the Remote Code Execution RCE vulnerability in Apache Struts2 CVE-2017-5638. Attackers can exploit a crafted HTTP Content-Type header to execute arbitrary system commands on vulnerable servers. This repo uses Vulhub Dock...

CVE-2020-10567

POC-CVE-2020-10567 RCE poc - RESPONSIVE filemanager v.9.14.0. not Main branche ⚠️ Github project : https://github.com/trippo/ResponsiveFilemanager Requirements: Nothing is required, this exploit is unauthenticated. The Responsive Filemanager application is a web-based file management tool used to...