OMIGOD_cve-2021-38647

OMIGODcve-2021-38647 CVE-2021-38647 is an unauthenticated RCE vulnerability effecting the OMI agent as root. While executing payload Change HOST Command :Replace your command with Command here. such as id, whoami etc Credit https://github.com/horizon3ai/CVE-2021-38647 Follow us Vulnmachines YouTu...

PPLwindow

PPLwindow PPLwindow is a Proof-of-Concept for a PPL Bypass that affects Windows 10 1809 to Windows 11 23H2. The NtUserGetWindowProcessHandle syscall from win32kfull.sys driver doesn't properly check if a process is a protected process on the mentioned Windows versions. This can be abused to get a...

vanda-CVE-2025-3102

Vanda CVE-2025-3102 💣 Exploit with graphical interface for vulnerability CVE-2025-3102 in the WordPress plugin SureTriggers = 1.0.78. 🚀 FEATURES Vulnerability site identification 🕵️‍♂️ Automatic exploitation with admin user creation 👨‍💻 Cyberpunk-style graphical interface 🌌 Results saved in .txt...

CVE-2025-47812

CVE-2025-47812 – Wing FTP Server RCE via Lua Injection Author: 0xgh057r3c0n 🧠 Description This exploit leverages a Lua injection vulnerability in Wing FTP Server 's login handler loginok.html to execute arbitrary operating system commands or gain a reverse shell. It abuses unsanitized Lua code...

CVE-2025-49844

CVE-2025-49844 – Use-After-Free Issue in Redis's Lua Parser In short and simple terms, you run this script and instead of localhost you provide the target IP and configure its port, it connects if it is vulnerable, and you can execute any command you want. In Shodan, you can also find vulnerable...

CVE-2020-16947

CVE-2020-16947 Outlook 2019 Remote Command Execution This bug occured when parsing html contents. if attacker successfully executes this exploit, it can lead to remote command execution. When copying strings out of the ascii range among html contents, the corresponding string is replaced with...

ChamiloLMS-CVE-2023-4220

ChamiloLMS CVE-2023-4220 Exploit Python exploit for CVE-2023-4220 , an unauthenticated arbitrary file upload vulnerability affecting Chamilo LMS = 1.11.24. The vulnerability is located in Chamilo's BigUpload component. On vulnerable installations, the upload handler allows a PHP file to be upload...

CVE-2024-41570-Havoc-C2-RCE

Havoc-C2-RCE CVE-2024-41570 This is a Chained RCE CVE-2024-41570 in the Havoc C2 framework. Command injection: Havoc is vulnerable to command injection enabling an authenticated user to execute commands on the Teamserver. Affects versions 0.3 up to the latest release 0.6. Havoc's default profile...

CVE-2019-17638-Jetty

JETTY The Jetty project is a 100% Java HTTP Server, HTTP Client and Servlet Container from the eclipse foundation http://www.eclipse.org/jetty/ Jetty is open source and is dual licensed using the Apache 2.0 and Eclipse Public License 1.0. You may choose either license when distributing Jetty...

edb-40564-mingw-fix

ms11-046-mingw CVE-2011-1249 / MS11-046 — AFD.sys privilege escalation for Windows x86. Original exploit by Tomislav Paskalev EDB-40564. This fork fixes MinGW cross-compilation errors and adds custom command execution via argv1. Changes from the original | Change| Why ---|---|--- 1| FARPROC...

CVE-2024-28397-js2py-Sandbox-Escape

Introduction 中文 Analysis Chinese Analysis English js2py is a popular python package that can evaluate javascript code inside python interpreter. It is used by various web scrapers to parse javascript code on the website. There exists a vulnerability in the implementation of a global variable insi...

CVE-2025-52688

CVE-2025-52688 Affected Products Alcatel AP13161 - Enterprise WIFI access point Summary There are 2 main vulnerabilities being addressed here: Lack of input sanization on multiple JSON web parameters that allows malicious characters such as ; to be injected to caused a command injection attack La...

CVE-2026-34197-payload-Apache-ActiveMQ-

ActiveMQ Jolokia RCE Vulnerability Reproduction Guide This repository provides a remote code execution RCE vulnerability reproduction environment and exploitation script based on the exposed Jolokia API endpoint /api/jolokia/ of Apache ActiveMQ. By invoking the addNetworkConnector operation, it...

CVE-2026-34160

CVE-2026-34160 — Unauthenticated SSRF in Chamilo LMS via PENS plugin pens.php Severity : High CVSS 8.6 CWE : CWE-918 Server-Side Request Forgery Affected : chamilo/chamilo-lms 2.0-RC.2 Fixed in : 2.0-RC.3 Advisory : GHSA-g2xj-4cch-j276 NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-34160 Credit ...

attack-surface-framework

Attack Surface Framework Overview ASF aims to protect organizations acting as an attack surface watchdog, provided an “Object” which might be a: Domain, IP address or CIDR Internal or External, ASF will discover assets/subdomains, enumerate their ports and services, track deltas and serve as a...

CVE-2026-66804-CrossDevice-Service-EoP

CVE-2026-66804: Cross Device Virtual Camera EoP I independently discovered and reported the issue now tracked as CVE-2026-66804. MSRC confirmed my submission as a duplicate of an earlier report with the same underlying Windows Camera FrameServer root cause. A standard Windows user can create a...

CVE-2020-11800

Sections required by the assignment guidelines are marked with “Required”. 1. Environment Required Dockerfile Required This environment uses a custom Dockerfile based on the vulnerable Zabbix Server image provided by Vulhub. FROM vulhub/zabbix:3.0.3-server The Dockerfile builds a local image usin...

CVE-2014-6271

CVE-2014-6271 Description This project allows reproducing the vulnerability CVE-2014-6271 , also known as Shellshock. Shellshock is a security vulnerability in Bash that allows executing malicious code via environment variables. The purpose of this project is to demonstrate the impact of this...

CVE-2026-33310

CVE-2026-33310 CVE-2026-33310Command Injection via shell Expansion in Parameter Defaults Summary The shell syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell, the command may be...

CVE-2017-1000117-test

How it works This operates using the CVE-2017-1000117 vulnerability. When you clone this repository with root privileges using the git command with the --recurse option, an HTTP server that listens on port 12345 will run automatically. To stop the HTTP server, find its process ID and kill it...