186922 matches found
exploit-CVE-2026-2670
exploit-CVE-2026-2670 CVE-2026-2670 – Advantech WISE-6610 Command Injection PoC Proof-of-concept exploit demonstrating a command injection vulnerability in the Advantech WISE-6610 industrial cellular router. The vulnerability exists in the /cgi-bin/luci/admin/openvpnapply endpoint and allows an...
CVE-2026-39866
CVE-2026-39866 — Command Injection via unquoted workflow dispatch input Proof-of-concept lab for command injection in GitHub Actions workflow dispatch Purpose CVE-2026-39866 is a command injection bug in Lawnchair's GitHub Actions release workflow. The releaseupdate.yml file passes user input...
CVE-2025-24893
Infos This PoC first tests for the SSTI and if it works. It will go in loop and allows you to run commands remotly. The exec and shell command do the same currently. Usage Connecting python3 poc.py Example With debug set to False default python3 poc.py http://127.0.0.1:8080 Targeting...
CVE-2026-1281-CVE-2026-1340-Ivanti-EPMM-RCE
Ivanti EPMM pre-auth RCE Dummy Target A simple demo application that shows how to reproduce the Ivanti EPMM pre-auth RCE vulnerability CVE-2026-1281 / CVE-2026-1340 for educational and security research purposes. Vulnerability Overview This vulnerability exploits Bash arithmetic expansion behavio...
CVE-2021-44521
CVE-2021-44521 Automated PoC of CVE-2021-44521 Credits to original poc: https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/ Requirements Cassandra-driver pip3 install cassandra-driver Usage python3 poc.py Note that you can't do more...
CVE-2026-24061
CVE-2026-24061 CVE-2026-24061 Batch Scanning Tool How to use options: -h, --help show this help message and exit -t, --target TARGET Target IP/CIDR or comma-separated list repeatable -f, --file FILE File with targets IP/CIDR, one per line or comma-separated -p, --port PORT Target ports, default 2...
CVE-2026-21962
CVE-2026-21962 CVE-2026-21962 EXAMPLE Single target python3 CVE-2026-21962.py http://target:7001 -c "whoami" Batch + default whoami python3 CVE-2026-21962.py -f url.txt Batch + custom command + change thread count python3 CVE-2026-21962.py -f url.txt -c "id" --threads 20 -o result.txt Reverse she...
CVE-2026-0709
Hikvision Wireless AP – CVE-2026-0709 Authenticated RCE Tool This tool is a Python proof‑of‑concept to test Hikvision wireless access points for CVE‑2026‑0709 , an authenticated command injection vulnerability that can lead to remote code execution on affected devices. For security testing and...
LongBow
Archer TP-Link VR1600V Router Local Remote Command Execution Exploit CVE-2023-31756 Overview This Python script demonstrates a local remote command execution vulnerability within the Archer TP-Link VR1600V V1/V2 routers. The exploit allows for administrative-level operating system access on the...
CVE-2026-16348
TP-Link Archer BE800 V1 — Authenticated RCE via VPN Key Injection CVE: CVE-2026-16348 CVSS: 8.5 High — CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L Auth required: Valid admin credentials Network position: Network remote if management interface exposed Summary The VPN server...
CVE-2026-104078
Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the...
CVE-2023-22527
CVE-2023-22527 Atlassian Confluence Remote Code Execution Vulnerability CVE-2023-22527 options: -h, --help show this help message and exit -u URL, --url URL Target URL; Example: python .py -u http://ip:port -f FILE, --file FILE Target urllist; Example: python .py -f urllist.txt -c CMD, --cmd CMD...
Exploit_CVE-2026-3854
ExploitCVE-2026-3854 CVE-2026-3854 is a Remote Code Execution in GitHub.com and GitHub Enterprise Server The vulnerability could be exploited by injecting commands into the git push command as follows : git push -o '' origin master To review any exploitation of this vulnerability, we recommend th...
cve-2024-51567-poc
cve-2024-51567-poc Simplified Description Vulnerability Overview ID : CVE-2024-51567 Type : Command Injection / CSRF Bypass Affected Versions : CyberPanel 2.3.6 and 2.3.7 unpatched Description : In the upgrademysqlstatus endpoint of CyberPanel, by bypassing the secMiddleware protection for POST...
CVE-2021-44228
CVE-2021-44228 Log4j2 Component Command Execution RCE Code By: Junsheng @Orange Cyber Security Lab Orange Cyber Security Lab https://0range.team/ 0x00 Risk Overview This tool is for authorized security testing only. Unauthorized attacks on illegal sites are prohibited. Read online 《Cybersecurity...
CVE-2021-42237
CVE-2021-42237 This is an exploit/PoC for CVE-2021-42237 taken from: This Assetnote report DISCLAIMER: I'm not associated with Assetnote in any way or form. This content is provided for educational porpouses only. Make sure to replace CMD-COMMAND-HERE, as well as the Host, from the PoC below: POS...
CVE-2026-2256-PoC
CVE-2026–2256 PoC Executive Summary A critical command injection vulnerability CVE-2026–2256, CVSS X.X was identified in the Shell tool component of the MS-Agent framework version 1.5.2. The vulnerability arises from improper sanitization of user-influenced input that is passed directly to a shel...
CVE-2026-33439-PoC
CVE-2026-33439 — OpenAM Pre-Auth RCE Echo Mode Command output directly in the HTTP response — no DNS exfiltration or OOB needed. Uses com.iplanet.jato.RequestManager.getRequestContext to access the active JATO ThreadLocal request/response during deserialization. Works on Java 21+ where classic...
CVE-2024-3400-poc
CVE-2024-3400 Vulnerability PoC Proof of Concept Vulnerability Description CVE-2024-3400 is a command injection vulnerability in Palo Alto firewall systems. By crafting a malicious HTTP request, an attacker can execute arbitrary commands on the target server and even gain root privileges...