CVE-2024-24576-PoC

CVE-2024-24576 PoC The Command::arg and Command::args APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and will not be evaluated by a shell. This means it should be safe to pass untrusted input as an...

CVE-2025-5548-POC

CVE-2025-5548-POC Vulnerability Description CVE-2025-5548 is a stack buffer overflow vulnerability identified in FreeFloat FTP Server, a legacy FTP service for Windows systems. The flaw resides in the NOOP command handler, which does not validate input size before copying it into a fixed-size...

CVE-2003-0358

CVE-2003-0358 Posting for historical reasons. snowcrash [email protected] https://github.com/snowcra5h/ Description Buffer overflow in 1 nethack 3.4.0 and earlier, and 2 falconseye 1.9.3 and earlier, which is based on nethack, allows local users to gain privileges via a long -s command line...

CVE-2020-7384

CVE-2020-7384 This is a small exploit in bash which I had made while solving one of the boxes from Hack The Box. The exploit is modified from the original exploit here: https://github.com/justinsteven/advisories/blob/master/2020metasploitmsfvenomapktemplatecmdi.md Usage dos2unix CVE-2020-7384.sh...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2023-50094_POC

reNgine 2.2.0 - Command Injection - CVE-2023-50094 Description This Python script exploits an authenticated command injection vulnerability in reNgine 2.2.0. The exploit targets the nmapcmd parameter in the Scan Engine configuration, allowing attackers to execute arbitrary commands. Features...

CVE-2026-3227-TP-Link-authenticated-RCE

CVE-2026-3227: TP-Link Router OS Command Injection For more Information see https://vulners.com/cve/CVE-2026-3227 A persistent, authenticated OS Command Injection vulnerability in TP-Link router firmware leading to device bricking or potential LAN takeover. Disclaimer : This repository contains...

CVE-2019-10392_EXP

CVE-2019-10392EXP Jenkins Git Client Authenticated RCE CVE-2019-10392Exp Usage usage: Jenkins Git Client 2.8.2. -h -u TARGET -U USERNAME -P PASSWORD -i ITEM -I INTERACTIVE -c COMMAND optional arguments: -h, --help show this help message and exit -u TARGET, --target TARGET Target. -U USERNAME,...

gftrace

gftrace A command line Windows API tracing tool for Golang binaries. Note: This tool is a PoC and a work-in-progress prototype so please treat it as such. Feedbacks are always welcome! How it works? Although Golang programs contains a lot of nuances regarding the way they are built and their...

CVE-2021-38817-Remote-OS-Command-Injection

CVE-2021-38817-Remote-OS-Command-Injection Authenticated Remote OS Command Injection/Remote Code Execution in TastyIgniter v3.0.7 Sendmail web part CVE-2021-38817 An authenticated remote OS command injection vulnerability exists in the TastyIgniter v3.0.7 Restaurtant CMS Sendmail configuration me...

CVE-2023-0861-POC

Analyzing and Reproducing the Command Injection Vulnerability CVE-2023-0861 in NetModule Routers NetModule is an Original Equipment Manufacturer OEM of industrial grade routers that are commonly used in critical infrastructure and industrial control systems. On February 24th, 2023, ONEKEY, a...

CVE-2024-50379-POC

CVE-2024-50379-POC This repository contains a Python script designed to exploit CVE-2024-50379 , a vulnerability that allows attackers to upload a JSP shell to a vulnerable server and execute arbitrary commands remotely. This exploit is particularly useful when the /uploads directory is either...

CVE-2022-26134

CVE-2022-26134 -u URL, --url URL Target URL -c COMMAND, --command COMMAND Command -i LHOST, --lhost LHOST Reverse shell host address -p LPORT, --lport LPORT Reverse shell host port -f FILE, --file FILE Batch scan...

cli

Getting started with the Snyk CLI Introduction to the Snyk CLI Snyk is a developer-first, cloud-native security tool to scan and monitor your software development projects for security vulnerabilities. Snyk scans multiple content types for security issues: Snyk Open Source: Find and automatically...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

tko-subs

tko-subs This tool allows: To check whether a subdomain can be taken over because it has: a dangling CNAME pointing to a CMS provider Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, etc. that can be taken over. a dangling CNAME pointing to a non-existent domain name one or more wrong/typoe...

CVE-2016-2434

CVE-2016-2434...

CVE-2022-46196

CVE-2022-46196 Description This Python code exploits an unauthenticated command injection vulnerability in Cacti versions up to and including 1.2.22. It uses argparse to parse arguments from the command line, requests to get the HTML content of a target Cacti instance, and BeautifulSoup to extrac...

CVE-2022-35914

CVE-2022-35914 PoC References https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr https://github.com/cosad3s/CVE-2022-35914-poc Credit to Sébastien Copin for the PoC I adapted here Check out my full writeup here: https://link.medium.com/tBwDlpQl3Ib Usage pip install -r...

cli

HTTPie CLI: human-friendly HTTP client for the API era HTTPie pronounced aitch-tee-tee-pie is a command-line HTTP client. Its goal is to make CLI interaction with web services as human-friendly as possible. HTTPie is designed for testing, debugging, and generally interacting with APIs & HTTP...