CVE-2024-3094

CVE-2024-3094 Basic POC to test CVE-2024-3094 vulnerability inside K8s cluster ❗ DISCLAIMER ❗ USE ONLY FOR EDUCATIONAL PURPOSES THE AUTHOR IS NOT RESPONSIBLE FOR ANY DAMAGE CAUSED BY THE USE OF THIS SOFTWARE Description We will deploy a vulnerable pod and exploit it to execute commands inside tha...

UnrealIRCd-3.2.8.1-Backdoor-Command-Execution

UnrealIRCd-3.2.8.1-Backdoor-Command-Execution Script that exploits the vulnerability that allows establishing a backdoor in the UnrealIRCd service with CVE-2010-2075 Usage usage: IRCBackDoorCommandExecution.py -h targethost targetport attackerhost attackerport...

CVE-2023-38646

CVE-2023-38646 - Metabase RCE Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1...

CVE-2021-32157

..| XSS a RCE CRON|.. Descripción : Explotando un ataque de Cross-Site Scripting Reflejado XSS para obtener una Ejecución Remota de Comandos RCE a través de la función de Trabajos Cron Programados de Webmin Versión probada : Webmin 1.973 última versión de GitHub 07/03/2021 Tipo de ataque: Remoto...

CVE-2021-32160

..| XSS a usuario privilegiado |.. Descripción : Explotando un ataque de Cross-Site Scripting XSS reflejado para crear un usuario privilegiado a través de la función de añadir usuarios de Webmin, luego obteniendo una reverse shell a través de la función de procesos en ejecución de Webmin Versión...

Jmeter-CVE-2018-1297-

Jmeter RMI Deserialization Command Execution Vulnerability CVE-2018-1297 Apache JMeter is an open-source software suite written in Java by the American Apache Software Foundation for stress testing and performance testing. Versions 2.x and 3.x contain a deserialization vulnerability that allows a...

CVE-2024-23692_Exploit

CVE-2024-23692 / Exploit Code A vulnerability has been discovered in HFS 2.3 and earlier versions that allows sending CMD commands to the server to execute them. Detail: https://asec.ahnlab.com/ko/74113/ This code is for educational purposes only, and legal responsibility for misuse lies with the...

Struts2-045-Exp

Struts2-045-Exp Struts2-045 exploitation script For testing purposes only usage:python3 struts2-045-exp.py url cmd...

CVE-2025-32433

CVE-2025-32433 – Vulnerabilidad RCE en SSH de Erlang/OTP 📌 Resumen CVE-2025-32433 es una vulnerabilidad de ejecución remota de código RCE que afecta al daemon SSH de Erlang/OTP. La causa raíz es el manejo inadecuado de solicitudes de canal SSH previas a la autenticación , que un atacante puede...

CVE-2017-5638

CVE-2017-5638 CVE-2017-5638 Apache Struts2 RCE Exploit 🛠️ Descripción Este es un PoC simple basado en Python para CVE-2017-5638 — una vulnerabilidad de ejecución remota de código en Apache Struts 2. ⚠️ Aviso legal Este código se proporciona solo con fines educativos. NO lo use en ningún sistema sin...

CVE-2018-11235

CVE-2018-11235 RCE vulnerability to exec "git clone --recurse-submodule" CVE-2018-11235...

CVE-2020-29607

Alienfader Exploit / Alien@shell Webshell Upload Exploit Description: This Python script exploits a file upload restriction bypass vulnerability in Pluck CMS e.g., versions prior to 4.7.13 to upload a PHP webshell. Once uploaded, the shell named "shell.phar" can be used to execute commands on the...

CVE-2018-6574

This repository holds a PoC of the CVE-2018-6574 "go get RCE", that allowed to execute commands when downloading a 3rd party package. This could be done, as the cflags allowed to set an external library. In this PoC, the external library executes a command on the constructor...

the-same-key-opens-every-box-cve-2026-71960-hard-coded-jwt-secret-in-cudy-wr3000-mesh-mqtt

CVE-2026-71960 — Secreto JWT hardcodeado en el broker MQTT mesh Cudy WR3000 2.0 Herramientas PoC para el artículo de Hunt-Benito "La misma clave abre todas las cajas: CVE-2026-71960 — Secreto JWT hardcodeado en el broker MQTT mesh WR3000 de Cudy"...

CVE-2022-29303

CVE-2022-29303-Exploit Exploit for CVE-2022-29303 Usage Check against single host / \ \ / / || \ | \ // \ / | \ V /| |/ / / / / // /, /| \ | \ | / || ///| /|//|/// Coded By Valentin Lobstein "With great power comes great responsibility" usage: CVE-2022-29303.py -h -u URL -c COMMAND Example :...

CVE-2023-38831

CVE-2023-38831 Instalación Vagrant 2.4.0 vagrant up...

CVE-2025-57174

CVE-2025-57174 - Siklu EtherHaul Series - Unauthenticated Remote Command Execution CVE-2025-57174 Unauthenticated Remote Command Execution Affected Versions: Firmware 7.4.0 - 10.7.3 likely all versions since 7.4.0 How to use python3 CVE-2025-57174.py 172.16.100.52 'simple-command show system' --n...

CVE-2021-32156

..| CSRF a RCE CRON |.. Descripción : Explotando un ataque de Cross-site request forgery CSRF para obtener una Ejecución Remota de Comandos RCE a través de la función de Trabajos Cron Programados de Webmin Versión Probada : Webmin 1.973 última versión de GitHub 07/03/2021 Tipo de Ataque: Remoto...

CVE-2007-2447

CVE-2007-2447 - username map script "The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the 1 SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows...

CVE-2019-16113-Bludit-3.9.2-RCE

CVE-2019-16113 Bludit 3.9.2 Remote Command Execution RCE...