cve-2023-40000

cve-2023-40000 That's a PoC of cve-2023-40000. Wordpress LiteSpeed Cache exploit. The CVE could be applied to all LiteSpeed Cache --------------------+"; echo "+----------------------------------------------------------------------+";...

CVE-2025-0868

Penetration Testing Project Report: Exploiting CVE-2025-0868 DocsGPT RCE via JSON Eval 1. Introduction A critical Remote Code Execution RCE flaw CVE-2025-0868 was disclosed on February 20, 2025, in the open-source DocsGPT library, caused by unsafe use of eval when parsing JSON payloads. Key...

proofpoint-CVE-2023-0090

About Security researcher: ly1g3, ly1g3attuta.io GPG fingerprint: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Overview: Remote Code Execution - Unauthenticated RCE CVE: CVE-2023-0090 Timeline: Discovered - ly1g3 Reported - ly1g3 Fixed - Proofpoint...

Mailcow-CVE-2022-31138

Mailcow CVE-2022-31138 RCE and Domain Admin privilege escalation for Mailcow. POC for CVE-2022-31245 can be modified to work with this vulnerability. Reported and fixed: 2022-06 Code Injection, RCE Type: Code Injection CWE-94, RCE, Domain Takeover Affected versions: least 2019 - 2022-06a A flaw...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit A security research tool for detecting and testing the CVE-2025-12735 vulnerability in the expr-eval and expr-eval-fork npm packages. ⚠️ Disclaimer This tool is for authorized security testing and educational purposes only. Unauthorized access to computer...

moodle-rce-calculatedquestions

Scripts to Test Input Validation in Moodle Calculated Questions CVE-2024-43425 This repository contains the companion scripts to the blog post Back to School - Exploiting a Remote Code Execution Vulnerability in Moodle, which describes a remote code execution vulnerability in the Moodle learning...

CVE-2025-2945

CVE-2025-2945 - pgAdmin4 Authenticated RCE Exploit Author: G0D150NE Version: 2.0.0 CVE: CVE-2025-2945 Severity: Critical CVSS 9.9 📌 Description Exploit for pgAdmin4 Remote Code Execution RCE vulnerability affecting versions 8.10 to 9.1. The vulnerability exists in the /sqleditor/querytool/downloa...

dejavu

DejaVu This container runs a web application that analyzes images and returns their metadata using exiftool. Users send the application a URL to an image and the app will retrieve it, analyze it, and return the results. The version of exiftool used by the application is vulnerable to CVE-2021-222...

CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC

CVE-2018-16763 — Fuel CMS 1.4.1 Remote Code Execution PoC Unauthenticated RCE vulnerability in Fuel CMS 1.4.1. The filter parameter in the /fuel/pages/select/ endpoint is passed unsanitized to a eval call in the PHP backend, allowing arbitrary code execution via a crafted payload. Unlike blind...

CVE-2026-99186

In the Linux kernel, the following vulnerability has been resolved: x...

Php-unit-CVE-2017-9841

phpunit Remote Code Execution Vulnerability CVE-2017-9841 Composer is a PHP package management tool. Using Composer to install extension packages will create a vendor folder in the current directory and place all files in it. Usually this directory should be placed outside the web root so that...

perl_spreadsheet_excel_rce_poc

ParseExcel security vulnerabilitiy TL;DR: RCE from logic in parsing format strings. Short explanation on the exploit Root cause of the exploitation comes from calling eval to an unvalidated user input in Utility.pm...

atlas-tj-actions-poc

CVE-2025-54416: tj-actions/branch-names Command Injection PoC This repository demonstrates CVE-2025-54416 , a critical command injection vulnerability in tj-actions/branch-names affecting over 5,000 public repositories. Vulnerability The tj-actions/branch-names GitHub Action versions...

safe-expr-eval

safe-expr-eval Fast and lightweight expression evaluator for JavaScript and TypeScript. A modern expression parser with a familiar API, zero dependencies, and full TypeScript support. Features Fast expression parsing and evaluation Lightweight and dependency-free Full TypeScript support Simple an...

sk-cve-2026-26030-lab

CVE-2026-26030 — Semantic Kernel filter eval RCE lab A self-contained lab reproducing CVE-2026-26030 : prompt-injectable remote code execution via the in-memory vector store search filter in Microsoft Semantic Kernel Python, Ethical lab only. Isolated in dedicated virtualenvs; payloads are harmle...

mpDNS

mpDNS aka multi-purpose DNS Server Simple, configurable DNS Server with multiple useful features Python 3 names.db - holds all custom records see examples Simple wildcards like .example.com Catch unicode dns requests Custom actions aka macro: shellexec::dig google.com +short - Execute shell comma...

CVE-2025-54322-exploit

CVE-2025-54322: XSpeeder SXZOS Pre-Auth RCE Exploit A professional Proof-of-Concept PoC exploit for CVE-2025-54322 , a critical pre-authentication remote code execution vulnerability in XSpeeder SXZOS firmware. This vulnerability was discovered and disclosed by the autonomous AI agent from pwn.ai...

CVE-2026-27384

CVE-2026-27384 CVE-2026-27384 — W3 Total Cache mfunc/eval RCE Scanner Plugin: W3 Total Cache Plugin Slug: w3-total-cache CVE ID: CVE-2026-27384 CVSS Score: 9.8 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Vulnerability Type: Unauthenticated Arbitrary Code Execution Code...

CVE-2025-2945-pgadmin-rce

CVE-2025-2945 — pgAdmin 4 Query Tool Authenticated RCE Proof of concept for CVE-2025-2945, a critical remote code execution vulnerability in pgAdmin 4. Affected versions: 8.10 through 9.1 Fixed in: 9.2 released April 4, 2025 CVSS v3.1: 9.9 Critical Overview The pgAdmin 4 Query Tool exposes an...

red-teaming-auto-mode

Red-teaming Claude Code's auto-mode monitor Code for the paper Red-teaming Claude Code's auto-mode monitor. Production coding-agent monitors e.g. Claude Code's Auto Mode or Codex's Guardian review each action and block unsafe ones in real time. This repository red-teams them under a persistent...