CVE-2011-2523-exploit

CVE-2011-2523 Exploit vsFTPd 2.3.4 Backdoor This project demonstrates exploitation of the vsFTPd 2.3.4 backdoor vulnerability CVE-2011-2523 using Python and pwntools. Disclaimer: This project is for educational and authorized penetration testing purposes only. Do NOT use against systems without...

CVE-2025-60655

CVE-2025-60655 - Remote Code Execution RCE via Unrestricted Upload | ---|--- Researchers| DotAdrien Severity| 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Software| Script Pag Description A critical vulnerability in the image upload system allows for Remote Code Execution RCE. The...

CVE-2022-36804-Bitbucket-RCE-Analysis

CVE-2022-36804: Bitbucket Remote Command Execution RCE Technical Analysis & Laboratory Exploitation of Null-Byte Argument Injection Vulnerability Summary CVE-2022-36804 is a high/critical Argument Injection vulnerability within the REST API of Atlassian Bitbucket Server and Data Center. While the...

struts-s2-052-deserialization-rce-lab

Apache Struts S2-052 XML Deserialization RCE This repository demonstrates exploitation of Apache Struts S2-052 CVE-2017-9805 using malicious XML deserialization. The exploit was developed while solving the INE eWPTX Practice Range – Struts XML Deserialization RCE lab. Vulnerability Overview Apach...

CVE-2021-41773---Apache-Path-Traversal---RCE

CVE-2021-41773 — Apache Path Traversal & RCE Internship Task: ITSOLERA PVT LTD — Offensive Security Intern: Areeba Zehra Jafri Team Lead: Muhammad Ahsan Ayaz Date: March 18, 2026 Overview Research and exploitation of CVE-2021-41773 — Path Traversal and Remote Code Execution vulnerability in Apach...

EXPLOIT-CVE-2026-56121

CVE-2026-56121 — Feast Unauthenticated RCE ApplyFeatureView gRPC Deserialization Unauthenticated remote code execution in Feast ⚠️ For authorized security testing and education only. Only run this against the bundled Docker lab or systems you own / are explicitly permitted to test. Unauthorized us...

CVE-2025-5548-POC

CVE-2025-5548-POC Vulnerability Description CVE-2025-5548 is a stack buffer overflow vulnerability identified in FreeFloat FTP Server, a legacy FTP service for Windows systems. The flaw resides in the NOOP command handler, which does not validate input size before copying it into a fixed-size...

rocketcat-cve-2021-22911-exploit

Rocket.Chat CVE-2021-22911 Exploit ⚠️ DISCLAIMER - EDUCATIONAL USE ONLY This exploit is for authorized penetration testing and educational purposes only. Unauthorized access to computer systems is illegal. The author is not responsible for any misuse. 📋 Overview CVE-2021-22911 is a critical...

CVE-2025-49132-PoC

CVE-2025-49132 PoC by Pwndalf Overview This repository contains a Proof of Concept PoC for CVE-2025-49132, a Remote Code Execution RCE vulnerability affecting Pterodactyl Panel -l -p...

cve-2025-55182-poc

CVE-2025-55182 React2Shell Vulnerability Analysis Lab This repository contains a complete environment for analyzing and reproducing CVE-2025-55182 , a critical Remote Code Execution RCE vulnerability in React Server Components RSC affecting React 19.x and Next.js 15.x. ⚠️ WARNING: This project...

Lenovo-CVE-2025-8061

CVE-2025-8061 is a privilege escalation vulnerability in Lenovo's LnvMSRIO.sys driver. The driver exposes IOCTL handlers that allow any user-mode process including unprivileged users to: Read/write arbitrary Model-Specific Registers MSRs Read/write arbitrary physical memory This gives a standard...

CVE-2025-70341

CVE-2025-70341: Insecure Permissions + Arbitrary Code Execution in App-Auto-Patch Summary App-Auto-Patch v3.4.2 creates its working directory with world-writable permissions chmod 777, enabling a local TOCTOU time-of-check-time-of-use race condition. An unprivileged local attacker can exploit thi...

react2shell-CVE-2025-55182

Attack component contains the attack code. Just uncomment it and press the button to pefrom attach. To run your own code on server exploit simply change the value of prefix key in the payload. See the AttackString file for examples...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell response kit Practical material for CVE-2026-1096...

CVE-2025-47812

CVE-2025-47812 — Wing FTP Server Unauthenticated RCE ██╗ ██╗██╗███╗ ██╗ ██████╗ ███████╗████████╗██████╗ ██║ ██║██║████╗ ██║██╔════╝ ██╔════╝╚══██╔══╝██╔══██╗ ██║ █╗ ██║██║██╔██╗ ██║██║ ███╗ █████╗ ██║ ██████╔╝ ██║███╗██║██║██║╚██╗██║██║ ██║ ██╔══╝ ██║ ██╔═══╝ ╚███╔███╔╝██║██║ ╚████║╚██████╔╝ ██║...

CVE-2025-33053_PoC

CVE-2025-33053 POC Exploit Overview The working directory in a .url file can be set to a foreign WebDAV server. When opened by a Windows client, dependencies for the executable defined in the URL field are searched for in the foreign WebDAV share. If an arbitrary executable or DLL is given the sa...

CVE-2022-31491

CVE-2022-31491 Metasploit module and PoC files in this repo. Further Information Voltronic Viewpower/Pro and rebrands/derivatives The UPS management software normally allows a properly Authenticated and Authorized user using a web interface to configure the system to run a single OS command of th...

CVE-2023-43208-PoC

CVE-2023-43208 - Mirth Connect Unauthenticated RCE Requirements Python 3.11 or higher tested on 3.11, 3.12, 3.13 Setup Create a clean virtual environment python3 -m venv .venv source .venv/bin/activate Install pinned dependencies pip install -r requirements.txt Usage Check version only python3...

CVE-2025-66034

CVE-2025-66034 — fontTools varLib Arbitrary File Write → RCE PoC exploit for an Arbitrary File Write + XML Injection vulnerability infontTools.varLib Tested on HackTheBox — VarIaType Vulnerability fontTools.varLib processes .designspace XML files to build variable fonts. Two weaknesses combine to...

bitbucket-test

Docker container to investigate CVE-2022-36804 Recreating a remote code execution vulnerability where Bitbucket fails to sanitize user input, which allows attackers to inject Git flags and execute code remotely. This repository documents how I reproduced the vulnerability CVE-2022-36804, an issue...