spring4shell-poc

Spring4Shell POC Description of the vulnerability: https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html Construction of the POC: https://github.com/BobTheShoplifter/Spring4Shell-POC Steps to Build/Run Tested with JDK 11.0.14, Spring Boot 2.6.5, and Apache Tomcat 9.0.60 Run...

CVE-2020-5902-POC-EXP

CVE-2020-5902-POC-EXP Usage python3 f5rce.py scan iplisttxt python3 f5rce.py https://test.cn:443 ifconfig Scan Mode RCE Mode...

nmap-spring4shell

Nmap-spring4shell Log4shell-nmap is an NSE script for detecting Spring4Shell RCE vulnerabilities CVE-2022-22965 in HTTP services. The script injects the correct payload into the application and then executes the following command on the specified endpoint. Vulnerability See here. Usage...

CVE-2021-44228

Log4Shell POC CVE-2021-44228 The scope of this repository is to provide all the components needed to exploit CVE-2021-44228, nicknamed Log4Shell, and to show how to exploit it. The ingredients needed to exploit this vulnerability are the following: 1. An LDAP Server that will redirect the...

CVE-2018-7600-Drupal-0day-RCE

CVE-2018-7600-Drupal-0day-RCE Drupal 0day Remote PHP Code Execution Perl This is a 0day RCE Exploit in Drupal CMS You Can Upload Payload on server. CVE : CVE-2018-7600 Cxsecurity : https://cxsecurity.com/issue/WLB-2018040108 How Run Exploit : 1-git clone...

vulnerable-PDF

vulnerable-PDF = Salaries.pdf - develоpe mode: 08.10.2022 NOTE: This is only for testing and you can open just a calculator, the integrated program of Microsoft. = Or you can use the PDF file to download the calc.exe into a forbidden directory :D WARNING! Only for tests and education =...

CVE-2023-38831

CVE-2023-38831 Exploit - Bait and Switch Archive Generator Overview This Python script is designed to generate a "bait and switch" archive file. It is meant for educational and ethical hacking purposes only. Please ensure that you have the necessary permissions before using this script. A "bait a...

CVE-2026-57491

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise archive extraction does not apply UploadNamePolicy::isAllowedForWrite before ZipArchive::extractTo writes entries into the destination directory. An authenticated user...

CVE-2026-100232

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute...

CVE-2026-33017

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote Code Execution PoC ★ https://github.com/user-attachments/assets/562fc637-6be1-4ab9-a396-bfad56447af7 Environment Setup Use the following commands to build and run the vulnerable Langflow environment: docker build -t...

CVE-2025-32432-exploit-by-P34NUT

CVE-2025-32432 — Craft CMS Pre-Auth RCE Exploit Author: P34NUT2 Vulnerability: Remote Code Execution Pre-Authenticated in Craft CMS CVE: CVE-2025-32432 Target: Any vulnerable Craft CMS instance 3.x / 4.x / 5.x — tested on Hack The Box: Orion ⚠️ Disclaimer This tool is provided strictly for...

CVE-2025-25347

CVE-2025-25347 Overview This tool is used to test the vulnerability CVE-2025-25347 in QingLong Panel, an open-source platform for task automation management. This vulnerability allows Remote Code Execution RCE because the panel does not implement adequate input validation and access control on...

CVE-2021-42013-Apache-RCE-Poc-Exp

Vulnerability Name Apache Remote Code Execution CVE-2021-42013 Vulnerability Description Apache HTTP Server is an open-source web server from the Apache Software Foundation. It is fast, reliable, and extensible via a simple API. It was discovered that the fix for CVE-2021-41773 in Apache HTTP...

Mybb-XSS_SQL_RCE-POC

Mybb-XSSSQLRCE-POC Mybb associate CVE-2021-27890 & CVE-2021-27889 to RCE poc Before Use: There are two files here: 1.js and attacklisten.py You should modify these two file: 1.js: modify the mybb forum url and attack url: var bashurl = 'http://192.168.92.164/mybb/mybb-mybb1825' mybb forum url var...

dubiousdisk

dubious disk - the porygon-z that's super effective against secure boot! CVE-2022-30203, CVE-2023-21560, CVE-2023-28269, CVE-2023-28249, and more... Overly permissive code in the Windows boot environment allows for overwriting arbitrary memory, and therefore, arbitrary code execution. Exploitro...

CVE-2019-19609-EXPLOIT

CVE-2019-19609-EXPLOIT Exploit for CVE-2019-19609 in Strapi Remote code execution in strapi-3.0.0-beta.17.7 or earlier. I was faced with a scenario with this vulnerability, but without a public exploit. I decided to create my own and share it here. Instalation git clone...

Dolibarr-17.0.0-Exploit-CVE-2023-30253

Readme.md CVE-2023-30253 CVE-2023-30253 is a security flaw in Dolibarr software that enables authenticated users to execute remote code by utilizing an uppercase manipulation technique in injected data. Impact This vulnerability can lead to unauthorized remote code execution by malicious actors,...

Log4Shell-Payloads

🚨 Log4Shell Payloads Collection A curated list of Log4Shell / Log4J exploitation payloads targeting: CVE-2021-45046 CVE-2022-42889 🔗 By @nav1n0x 🔥 One-Liner Payloads ✅ Oneliner 1 cat vulnerable-hosts.txt | sed 's/https?:////' | xargs -I echo...

CVE-2020-23839

CVE-2020-23839 | GetSimple CMS v3.3.16 - Reflected XSS to RCE Exploit Author: Bobby Cooke boku Vulnerability Statistics OWASP Top Ten 2017: A7:2017-Cross-Site Scripting XSS CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - Type 1: Reflected XSS CVSS Base...

cve-2024-4367-PoC-fixed

cve-2024-4367-PoC-fixed PDF.js is a JavaScript-based PDF viewer maintained by Mozilla. This vulnerability allows an attacker to execute arbitrary JavaScript code immediately after opening a malicious PDF file. This affects all Firefox users 126, as Firefox uses PDF.js to display PDF files, but al...