CVE-2026-24061

Telnet Vulnerability Scanner & Exploiter This Python script main.py is a multi-threaded tool designed to scan a list of target IPs/hostnames and attempt to exploit a specific vulnerability over Telnet. !WARNING This tool is intended for educational purposes and authorized penetration testing only...

mcpjam-cve-2026-23744-validator

MCPJam Inspector Authorized Security Validator A bounded proof-of-concept validator for CVE-2026-23744 affecting vulnerable MCPJam Inspector deployments. This project is an independent, non-destructive validation tool for the previously disclosed CVE-2026-23744. It is not the original vulnerabili...

CVE-2026-40176

CVE-2026-40176 — Composer Perforce Driver Command Injection Proof of Concept A self-contained, OOP-style PHP proof of concept that demonstrates and differentially verifies a command-injection vulnerability in Composer's Perforce repository driver. The PoC runs the same malicious composer.json...

CVE-2026-Pending-Flask-Uploads-Path-Traversal-PoC

CVE-2026-XXXXX Pending: Path Traversal in Flask-Uploads Vulnerability Information Product : Flask-Uploads Version : 0.2.1 and potentially older versions Vulnerability Type : Path Traversal Directory Traversal CWE-ID : CWE-22 Severity : HIGH CVSS 7.5 Impact : Arbitrary File Write, Remote Code...

CVE-2026-Pending-Django-Summernote-RCE

CVE-2026-XXXXX Pending: django-summernote Arbitrary File Upload RCE This repository contains a Proof of Concept PoC for a Conditional Remote Code Execution RCE vulnerability discovered in django-summernote version 0.8.20.0 and earlier. Vulnerability Details Product : django-summernote Version : =...

CVE-2026-Pending-Claude-Desktop-RCE

This repository does not have a README...

CVE-2026-Discord

Critical Vulnerability Report: Discord macOS Client Date : 2026-01-25 Target : Discord Client macOS Stable 0.0.373 Author : Antigravity 🚨 Executive Summary We have identified a critical security vulnerability in the Discord macOS Client Electron-based involving the forced exposure of the Remote...

CVE-2019-10068-PoC

CVE-2019-10068 PoC for Kentico CMS Proof of concept exploit for CVE-2019-10068, leveraging a Deserialization RCE in Kentico CMS to upload a web shell. Legal Disclaimer: This proof-of-concept is provided for educational and authorised security research purposes only. The author is not responsible...

CVE-2025-27636-Practical-Lab

🛡️ CVE-2025-27636 — Laboratorio Práctico de Explotación para Apache Camel 🔍 Resumen CVE-2025-27636 es una vulnerabilidad crítica de Ejecución Remota de Código RCE en Apache Camel , específicamente en el componente camel-exec. Surge de un problema sutil pero peligroso: DefaultHeaderFilterStrategy...

cve-2025-5781_FreePBX

cve-2025-5781FreePBX In August 2025, a critical vulnerability was disclosed in the FreePBX Endpoint module. CVE-2025–57819 allows an unauthenticated attacker to exploit SQL injection in the Endpoint module and, through a chain of database manipulation and scheduled task execution, achieve remote...

Malicious code in verify-contract-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7cfabb396e93e034caeb560ea029e3ca2bde784b8c713d5f8941a2b621dd36 The package ships a single bin entry bin/cli.js that, when invoked, runs whoami and POSTs the package name, username, hostname, and platform to a...

MAL-2026-15598 Malicious code in verify-contract-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7cfabb396e93e034caeb560ea029e3ca2bde784b8c713d5f8941a2b621dd36 The package ships a single bin entry bin/cli.js that, when invoked, runs whoami and POSTs the package name, username, hostname, and platform to a...

log4j-shell-poc

log4shell-poc CVE-2021-44228 Proof-of-concept exploit for the Log4j vulnerability CVE-2021-44228, also known as Log4Shell. This tool generates a malicious Java class, starts an LDAP referral server, and serves the payload over HTTP, allowing a remote attacker to execute arbitrary commands on a...

CVE-2026-17544

CVE-2026-17544 — PHP bcmath OOB write → universal memory-only RCE A weaponized proof-of-concept for CVE-2026-17544 , an out-of-bounds write in PHP's rewritten bcmath extension bcstr2num. This turns the publicly known DoS-only crash into a full, universal, memory-only remote code execution primiti...

MAL-2026-15593 Malicious code in fuels-typegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4dcadcdf880021763232df96239a6a07acd6360bfcd941ae8026a37aee2eb2f The package name resembles the legitimate @fuel-ts/typegen. On execution of the CLI in bin/cli.js, the code collects the local username whoami /...

Malicious code in fuels-typegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4dcadcdf880021763232df96239a6a07acd6360bfcd941ae8026a37aee2eb2f The package name resembles the legitimate @fuel-ts/typegen. On execution of the CLI in bin/cli.js, the code collects the local username whoami /...

MAL-2026-15591 Malicious code in cre-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcc14c964a76dde24165930e971dac9a2a9f36ecae68d596c7bf920cac8e1c29 bin/cli.js collects the current user whoami/os.userInfo, os.hostname, and os.platform and POSTs them, along with URL query parameters carrying the sa...

Malicious code in cre-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcc14c964a76dde24165930e971dac9a2a9f36ecae68d596c7bf920cac8e1c29 bin/cli.js collects the current user whoami/os.userInfo, os.hostname, and os.platform and POSTs them, along with URL query parameters carrying the sa...

Malicious code in verify-contract-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1037ebeeb5eff8da3b46c8275a09151604157ddc24db244d76d27d97bfdddad bin/cli.js executes whoami and reads os.hostname / os.userInfo / os.platform, then POSTs those values to the hardcoded endpoint...

MAL-2026-15599 Malicious code in verify-contract-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1037ebeeb5eff8da3b46c8275a09151604157ddc24db244d76d27d97bfdddad bin/cli.js executes whoami and reads os.hostname / os.userInfo / os.platform, then POSTs those values to the hardcoded endpoint...