EXPLOIT-CVE-2026-22778

CVE-2026-22778 — vLLM RCE in video processing Vulnerable lab + proof of concept for CVE-2026-22778 CVSS 9.8, an unauthenticated remote code execution chain in vLLM's multimodal ingestion path. | ---|--- CVE| CVE-2026-22778 Advisory| GHSA-4r2x-xpjr-7cvv Affected| vLLM = 0.8.3, vLLM turned...

CVE-2024-57376

CVE-2024-57376 Pre-auth remote code execution exploit for D-Link DSR-250 and DSR-250N Security advisory: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10415 Usage $ python3 exploit.py usage: Example $ python3 exploit.py 192.168.1.1 443 id + fingerprint device: DSR-250...

AntimalwareBlight

Use this PowerShell module to execute PowerShell code at the antimalware-light protection level. This code was highlighted in the Living Off the Walled Garden: Abusing the Features of the Early Launch Antimalware Ecosystem REcon talk as well as Black Hat USA 2022. This module needs to run elevate...

TimeInjector

TimeInjector Time injector is a CVE-2018-14714 exploitation script in bash To tell if the target is vulnerable, the script works by first checking if the target is accessible and if it can establish a login session. After that, it checks for the existence of specific pages and performs a time-bas...

Spring4Shell-Python-Firewall-POC

Python Firewall for Spring4Shell CVE-2022-22965 Mitigation 1. Overview This project is a simple but effective firewall implemented as a Proof-of-Concept POC in Python. It's designed to act as an HTTP server that inspects incoming POST requests to detect and block the specific payload pattern...

tot-react-rce-CVE-2025-55182

Tot React RCE CVE-2025-55182 React-shell Tot React RCE - Next.js tool. Dependencies : aiohttp termcolor optional tabulate optional Install dependencies: pip install -r requirements.txt Example run: python3 main.py -u http://target.com --lang id...

hackviser_labs_CVE-2015-3306

hackviserlabsCVE-2015-3306 This is a customized script to help solve the lab on remote code execution under the CVE-2015-3306 lab. run it using the following command: python3 exploit.py replace with the address you got from starting the lab on the hackviser platform...

CVE-2026-63223-POC

CVE-2026-63223 PoC — CodeIgniter 4 File Upload RCE CVSS 9.8 Critical | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-434 : Unrestricted Upload of File with Dangerous Type Fixed : CodeIgniter 4 v4.7.4 Advisory : GHSA-mmj4-63m4-r6h5 Vulnerability Summary CodeIgniter 4's isimage and mimein file upload...

CVE-2025-10230

CVE-2025-10230: Samba Critical RCE CVSS 10.0 Vulnerability Summary CVE-2025-10230 is a critical remote code execution RCE vulnerability that remained hidden in the Samba codebase for 13 years. The flaw resides in the handling of WINS Windows Internet Name Service registration packets. When...

CVE-2025-3248

CVE-2025-3248 – Execute arbitrary Python code on vulnerable Langflow server. Discovered by: Naveen Sunkavally, Horizon3.ai Status: Public Disclosure Date Reported: 2025-04-07 CVE ID: CVE-2025-3248 🧾 Screenshot 🧩 Summary A critical flaw has been discovered in Langflow that allows malicious actors ...

POC-CVE-2025-66034

fontvarlib.py — CVE-2025-66034 fontTools varLib — Arbitrary File Write + XML Injection → Remote Code Execution Table of Contents Overview Vulnerability Details Attack Chain Requirements Installation Configuration Usage How It Works Vulnerable Code Pre-Exploitation Checklist Tested On Disclaimer...

CVE-2025-55182-NextJS-Scanner-React2Shell-PoC

CVE-2025-55182 Exploitation Tool A comprehensive security research tool for testing Next.js React Server Components Remote Code Execution vulnerability CVE-2025-55182. Overview This toolkit provides automated detection and exploitation capabilities for CVE-2025-55182, a critical RCE vulnerability...

CVE-2023-20887

CVE-2023-20887 POC for CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight unauthenticated RCE Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/ Summary...

CVE-2019-11447_CuteNews-AvatarUploadRCE

CVE-2019-11447 Exploit/PoC - CuteNews 2.1.2 Avatar upload RCE Authenticated Exploit Code for CVE-2019-11447 aka CuteNews 2.1.2 Avatar upload RCE Authenticated Exploit Links: Expected outcome: Login/Register an account, craft user selected PHP file with .gif magic bytes, uploads the file as an...

CVE-2024-53900

CVE-2024-53900 - Mongoose populate.match $where RCE This repository provides a reproducible vulnerable environment and PoC for CVE-2024-53900 , a critical Remote Code Execution RCE vulnerability in Mongoose 8.8.3. 📌 Vulnerability Details CVE : CVE-2024-53900 Affected : Mongoose 8.8.3 Severity :...

CVE-2021-44967

CVE-2021-44967 Exploit Title: LimeSurvey 5.2.4 - Authenticated Remote Code Execution RCE Google Dork: inurl:limesurvey/index.php/admin/authentication/sa/login Date: 05/12/2021 Discovered by: Y1LD1R1M Exploit Author: D3Ext Vendor Homepage: https://www.limesurvey.org/ Software Link:...

CVE-2024-47176

CVE-2024-47176 — Remote Command Execution in CUPS For educational and authorized penetration testing purposes only. Table of Contents Description Affected Systems Related CVEs Prerequisites Setup Usage Disclaimer Description CUPS Common UNIX Printing System is an open-source printing system that...

CVE-2025-49132-PoC

CVE-2025-49132-PoC Proof-of-Concept for CVE-2025-49132 for Remote Code Execution in Pterodactyl Panel -m check Do something funny python3 poc.py -u -m exploit -p -t Technical Details Analyzing the git diff of LocaleController.php between v1.11.10 and v1.11.11 link, we can see that the controller...

CVE-2020-14750

CVE-2020-14750 PoC for vulnerabilities CVE-2020-14750 and cve-2020-14882 To test if a system is vulnerable use: ./test-CVE-2020-14750 hostname:7001 At the moment, in this version, it only guarantees if the host is vulnerable. If the result is negative, it is not a guarantee that it is not...

CVE-2026-84361-poc

CVE-2026-84361: Composer Perforce P4PORT Command Execution PoC Run with Docker Docker Compose provides an isolated image containing vulnerable Composer 2.10.2 and the Perforce p4 client. At runtime it has no network, a read-only root filesystem, no Linux capabilities, and writable tmpfs mounts on...