189424 matches found
cisco-rv-rce-poc
CVE-2023-20048 — Cisco RV Series PoC & Exploit ⚠ WARNING: For authorized testing only. Do not use against systems you do not own or have written permission to test. This is a Proof of Concept for authorized testing only. What this is Small repository with: CiscoPoc.py — harmless PoC to check for...
CVE-2024-25082_CVE-2024-25081
⚠️ FontForge RCE — CVE-2024-25081 & CVE-2024-25082 - PoC 📖 Overview Proof-of-concept exploit for two command injection vulnerabilities in FontForge ≤ 20230101 Splinefont component. CVE| Vector| Trigger ---|---|--- CVE-2024-25081| Crafted filename| Direct file open CVE-2024-25082| Crafted archive...
CVE-2022-22947
SpringCloud-Gateway Command Execution Vulnerability CVE-2022-22947 Environment Setup Method 1: Clone the ready environment code from GitHub. GitHub Repository //⚠️Note: The environment code download path must not contain Chinese characters or spaces git clone...
CVE-2023-38646-PoC
CVE-2023-38646 - Metabase Pre-auth RCE Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1,...
CVE-2024-3400
CVE-2024-3400 CVE-2024-3400 Palo Alto OS Command Injection send this HTTP request: POST /ssl-vpn/hipreport.esp HTTP/1.1 Host: 127.0.0.1 Cookie: SESSID=/../../../var/appweb/sslvpndocs/global-protect/portal/images/hellome1337.txt; Connection: close Content-Type: application/x-www-form-urlencoded...
sandbox-runtime
Anthropic Sandbox Runtime srt A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. srt uses native OS sandboxing primitives sandbox-exec on macOS, bubblewrap on Linux and proxy-based network filterin...
CVE-2023-33538-msf
CVE-2023-33538 – TP-Link TL-WR940N/841N Command Injection Metasploit module This Metasploit auxiliary module targets an authenticated command injection vulnerability in TP-Link TL-WR940N V2/V4 and TL-WR841N V8/V10 routers. The issue lies in the vulnerable ssid1 parameter used in WlanNetworkRpm.ht...
CVE-2020-1938
CVE-2020-1938-tomcat-File Download + File Inclusion Tomcat-Ajp protocol file read vulnerability】 Source POC source: https://github.com/nibiwodong/CNVD-2020-10487-Tomcat-ajp-POC/blob/master/poc.py After modification, it can include files, and under certain conditions, execute commands...
atomic-operator
license atomic-operator This python package is used to execute Atomic Red Team tests Atomics across multiple operating system environments. What's new? Why? atomic-operator enables security professionals to test their detection and defensive capabilities against prescribed techniques defined with...
CVE-2019-16920-MassPwn3r
0day exploit for Multiple D-Link Routers Vulnerability was found in latest firmware of the following D-Link products: DIR-655 DIR-866L DIR-652 DHP-1565 Current Description Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue...
mcp-pwn
CVE-2026-23744 — MCPJam Unauthenticated Remote Code Execution Summary MCPJam is an open-source MCP Model Context Protocol inspector and proxy used to connect, debug, and manage MCP servers. Versions = 1.4.3 Attack Vector| Network — No Authentication Required Disclosure| 2026-01-15 Technical...
CVE-2021-31761
CVE-2021-31761 Description : Exploiting a Reflected Cross-Site Scripting XSS attack to get a Remote Command Execution RCE through the Webmin's running process feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Remote Command Execution eXploit's...
PoC-CVE-2025-66224
OrangeHRM RCE Exploit - CVE-2025-66224 📋 Description This Proof of Concept PoC demonstrates a Remote Code Execution RCE vulnerability in OrangeHRM through command injection in the sendmailpath configuration parameter. The exploit works by: 1. Injecting a malicious payload into the MySQL database...
CVE-2024-21533-PoC-ggit
CVE-2024-21533 Argument Injection vulnerability in ggit ggit describes itself as: Local promise-returning git command wrappers Resources: Project's GitHub source code: https://github.com/bahmutov/ggit Project's npm package: https://www.npmjs.com/package/ggit Article write-up on this argument...
CVE-2020-8515
CVE-2020-8515 Draytek CVE-2020-8515 PoC I had kicking about. Amusingly, the command injected gets executed twice, see here: $ ./draytek.py draytek.local executing command: cat /etc/passwd + vulnerable! executing command: uname -a Linux Vigor3900 2.6.33.5 1 Wed Mar 28 00:49:28 CST 2018 armv6l...
CVE-2021-22123
CVE-2021-22123 Fortinet FortiWeb Authenticated OS Command Injection Hit Counter The command injection vulnerability in the FortiWeb management interface may allow an authenticated remote attacker to execute arbitrary commands in the system via the SAML server configuration page. Executing command...
CVE-2022-30525_Exploit
CVE-2022-30525 Zyxel Firewall Remote Command Injection A python based exploit for CVE-2022-30525 Vulnerability Summary NIST An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100W firmware versions 5.00 up to and including 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 ...
Mass-CVE-2025-29306
FoxCMS Mass Exploiter CVE-2025-29306 A specialized automation tool for security researchers to perform remote command execution RCE testing across multiple targets. 🛡️ Security Note This program is written in Bash and has been encrypted/compiled with SHC Shell Script Compiler. The source code is...
DropboxC2C
DropboxC2C DropboxC2C is a post-exploitation agent which uses Dropbox Infrastructure for command and control operations. DO NOT USE THIS FOR MALICIOUS PURPOSES. THE AUTHOR IS NOT RESPONSIBLE FOR ANY MISUSE OF THIS PROGRAM. Dropbox-C2C is an old project of mine to use a thirdparty for command and...