EUVD-2026-104419

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKEDPATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint...

CVE-2026-23918-Double-free-Apache-httpd-mod_http2

CVE-2026-23918 - Apache httpd modhttp2 PoC This repository contains a proof-of-concept implementation written in Go for a pre-authentication memory corruption scenario affecting Apache httpd with modhttp2. The code in this repository demonstrates a spray-and-trigger approach against a vulnerable...

CVE-2018-6574

CVE-2018-6574 Remote command execution in Golang go get command. CVE-2018-6574 this vulnerability impacts Golang go get command and allows an attacker to gain code execution on a system by installing a malicious library, this vulnerability was fixed in Go 1.8.7, 1.9.4 and 1.10rc2. Golang will bui...

CVE-2025-55182-POC

CVE-2025-55182-POC React2Shell POC Usage: sudo python3 hehe.py -t -c Example: ❯ sudo python3 hehe-t 12.05.12.05 -c "id" . .. . | \ | | / \ / || || | | | / || | | | | || | | | | | | | | / ^ \ | ,----'---| |----| | | | | ----| || | | | | | | | | / | | / /\ \ | | | | | | | | \ \ | | | | | | | | | |...

CVE-2023-32315-Openfire-Bypass

CVE-2023-32315 0x01 Obtain the returned JSESSIONID and csrftoken, construct a request packet to add a user replace JSESSIONID, csrftoken cd CVE-2023-32315-Openfire-Bypass/scanall go mod tidy go run main.go -u http://openfire.com:9090 0x02 Plugin compilation and installation mvn clean package or...

git-clean-filter

This is a documented known issue, but I found this during my research & its pretty useful for RT/PT. Summary: The filter..clean directive in .git/config points at a script and .gitattributes binds that filter to a tracked file. Whenever git renders a real git diff of that file it runs the worktre...

CVE-2026-109432

Camunda versions 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 are vulnerable to an expression injection flaw. The root cause is that AdhocQueryValidator.validate() fails to inspect sub-query expression maps within the orQueries field of TaskQueryDto . This allows authenticated users to bypass ...

CVE-2026-109432 Camunda Expression Injection via orQueries RCE

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

EUVD-2026-104392

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

CVE-2026-109432 Camunda Expression Injection via orQueries RCE

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

CVE-2019-19781

Remote Code Execution Exploit CVE-2019-19781- Citrix Application Delivery Controller & Gateway Remote Code Execution Exploit for Citrix Application Delivery Controller and Citrix Gateway CVE-2019-19781 Usage : bash CVE-2019-19781.sh IPOFVULNURABLEHOST COMMANDTOEXECUTE e.g : bash CVE-2019-19781.sh...

F5-CVE-2022-1388-Exploit

F5-CVE-2022-1388-Exploit Exploit and Check Script for CVE 2022-1388 Usage Check against single host python3 CVE-2022-1388.py -v true -u targeturl Attack host and test command python CVE20221388.py -a true -u targeturl -c command Attack list of hosts python CVE20221388.py -s true -f file...

kubolt

Wat? Kubolt is simple utility for scanning public unauthinticated kubernetes clusters and run commands inside containers Why? Sometimes, the kubelet port 10250 is open to unauthorized access and makes it possible to run commands inside the containers using getrun function from kubelet: // getRun...

winrar_CVE-2023-38831_lazy_poc

winrarCVE-2023-38831lazypoc lazy way to create CVE-2023-38831 winrar file for testing Article that mentioned this vuln and the sample: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ version of winrar i was using is winrar 5.91.0 I took a malicious winrar file...

SpringFramework_CVE-2022-22965_RCE

SpringFrameworkCVE-2022-22965RCE SpringFramework Remote Code Execution Vulnerability CVE-2022-22965 Vulnerability Reproduction Environment docker pull vulfocus/spring-core-rce-2022-03-29 docker run -d -p 8090:8080 --name springrce -it vulfocus/spring-core-rce-2022-03-29 Write webshell Note: The...

cve-2020-0688

cve-2020-0688 I made this script for conducting CVE-2020-0688 more rapidly. It helps to improve checking the vuln, reducing hugely steps for that. Modify these inputs before running the file. url = "https://mail.something.com" input 1 command = "cmd /c echo OOOPS!!! c:/truongtn.txt" input2...

CVE-2022-24112

CVE-2022-24112: Apache APISIX Remote Code Execution Vulnerability go run apisix-exploit.go -t -c Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-24112 https://lists.apache.org/thread/dzmgf0bwfmt58rfbz611gqo2b56qyqwq...

Cisco-IOS-XE-CVE-2023-20198

Cisco-IOS-XE-CVE-2023-20198 Exploit PoC for CVE-2023-20198 Vulnerability information and exploit usage offered by smokeintheshell See references Endpoint, http content type and headers management have been modified from other existing POCs to work in situations in which other exploits fail...

CVE-2020-14750

CVE-2020-14750 PoC for vulnerabilities CVE-2020-14750 and cve-2020-14882 To test if a system is vulnerable use: ./test-CVE-2020-14750 hostname:7001 At the moment, in this version, it only guarantees if the host is vulnerable. If the result is negative, it is not a guarantee that it is not...

Laravel-CVE-2021-3129

Laravel-CVE-2021-3129 CVE-2021-3129 Description Integrates https://github.com/zhzyker/CVE-2021-3129 and https://github.com/SNCKER/CVE-2021-3129. This project has the following advantages: Retains custom command functionality New: automatically exit after successful exploitation, improving...