exploit-workshop

exploit-workshop In this step by step workshop you'll learn how to exploit various real world vulnerabilities existing in vulnerable versions of packages in a Node.js and Java application. Required software you need to install for this workshop You can do this workshop in 2 different flavours Usi...

CVE-2026-102489

CVE-2026-102489: Zammad Unauthenticated Remote Code Execution This repository contains a proof of concept for CVE-2026-102489, an unauthenticated remote code execution vulnerability in Zammad. The exploit chains a WebSocket information disclosure flaw into authenticated session takeover and...

CVE-2022-22963

CVE-2022-22963-Reverse-Shell-Exploit This is a Python script that exploits CVE-2022-22963, a remote code execution vulnerability in Spring Cloud Function that allows attackers to execute arbitrary code on a vulnerable server. The exploit uses the vulnerable /functionRouter endpoint to execute a...

Log4Shell-PoC

██╗ ██████╗ ██████╗ ██╗ ██╗███████╗██╗ ██╗███████╗██╗ ██╗ ██║ ██╔═══██╗██╔════╝ ██║ ██║██╔════╝██║ ██║██╔════╝██║ ██║ ██║ ██║ ██║██║ ███╗███████║███████╗███████║█████╗ ██║ ██║ ██║ ██║ ██║██║ ██║╚════██║╚════██║██╔══██║██╔══╝ ██║ ██║ ███████╗╚██████╔╝╚██████╔╝ ██║███████║██║...

SSTImap

SSTImap This project is based on Tplmap. SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to be used as an interactive...

CVE-2021-41773

CVE-2021-41773 - Remote Code Execution in Apache 2.4.49 PoC for CVE-2021-41773 as I just found over-complicated exploits and this one goes straight to the Remote Code Execution. Usage Just specify the IP address running the vulnerable Apache 2.4.49 server with -i and the desired system command wi...

langflow-rce-exploit

Langflow RCE Exploit CVE-2025-3248 Remote Code Execution Exploit for Langflow CVE-2025-3248 Features Automatic vulnerability detection Multiple exploitation modes: Interactive shell Single command execution Reverse shell connection File upload capability Colorized user interface Multiple reverse...

CVE-2022-39197

CVE-2022-39197 RCE POC Reference Links https://mp.weixin.qq.com/s/Eb0pQ-1ebLSKPUFC7zS6dg — There’s a great in depth analysis of this vulnerability https://www.agarri.fr/blog/archives/2012/05/11/svgfilesandjavacodeexecution/index.html...

CVE-2021-30005-POC

CVE-2021-30005-POC PoC for CVE-2021-30005. Details The vulnerability resides in the fact that PyCharm would automatically activate a virtual environment found in the project when opened for the first time. This allowed an attacker to create a repository containing a malicious virtual environment...

KubeArmor

KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior such as process execution, file access, and networking operations of pods, containers, and nodes VMs at the system level. KubeArmor leverag...

CVE-2019-0708-RCE

CVE-2019-0708-RCE CVE-2019-0708-RCE We are working on a fully functional exploit join us https://discord.gg/4kc72bZ...

CVE-2020-10977

GitLab v12.4.0-12.8.1 RCE Based entirely on https://github.com/dotPY-hax/gitlabRCE, which did not work for me and the HTML parsing stuff seemed cumbersome so I rewrote it in js. Usage Start a reverse shell handler in the usual way, then run this script with: TARGETURI="https://target"...

webmin_docker_and_exp

Docker-webmin-RCE-lab 1. Dockerfiles for CVE-2019-15107webmin RCE recurrence including v1.890 and v1.920. 2. Exp for each version. Build the image First, clone the files Then cd webmin1.890/1.920docker docker build -t hachp1/webmin . Running the container docker run -d -p 10000:10000 hachp1/webmi...

code-wsl-rce

Proof of Concept for VS Code Remote WSL Remote Code Execution - CVE-2021-43907 See the blog at https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-codes-remote-wsl-for-fun-and-negative-profit. Also https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43907. Building 1. npm install...

CVE-2025-55182-RCE-Exploit

POC for CVE-2025-55182 – Next.js 16.0.6 Remote Code Execution This repository contains a working proof-of-concept POC for CVE-2025-55182 , a critical deserialization vulnerability affecting Next.js 16.0.6. The exploit abuses $@ chunk deserialization and Chunk.prototype.then to gain full control...

Project-CVE-2026-33017

CVE-2026-33017 Langflow Script — Code Explanation coded by: Xer0TLabs x Persephrak Decentralized Syndicate Purpose of this document This document is a high-level explanation of the supplied Python program for review, incident-response, and defensive analysis. It intentionally does not include...

cve-2026-2005

CVE-2026-2005 — PostgreSQL pgcrypto Heap Overflow → RCE Remote code execution via a single SQL query targeting PostgreSQL's pgcrypto extension. The vulnerability is a heap buffer overflow in pgpparsepubencsesskey that allows corruption of PostgreSQL's internal MemoryContext allocator metadata,...

CVE-2026-3854-lab

Flagship Lab 001: From Git Push Options to RCE A local Learning Lab and Research Lab inspired by the publicly documented vulnerability concepts behind CVE-2026-3854. Both experiences use real authenticated Git pushes against ForgeDock, a fictional Git server; the Research Lab. !CAUTION This proje...

WBCE-CMS-Stored-XSS---Pages-Menu

WBCE CMS Stored XSS v1.6.1 Author: Sergio Description: WBCE CMS 1.6.1 is affected by a Cross-Site stored scripting XSS vulnerability that allows attackers to execute arbitrary code via a payload crafted in the Intro Page parameter in the Pages menu. The payload will be executed on the main page...

CVE-2022-42899

CVE-2022-42899 Apache Common Text starting from version 1.5 to 1.9 has Remote code execution vulnerability CVE-2022-42899. final StringSubstitutor interpolator = StringSubstitutor.createInterpolator; interpolator.replace"$script:javascript:java.lang.Runtime.getRuntime.exec'"; // Here you will pas...