CVE-2024-6783

CVE-2024-6783 - Vue CVE A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript...

CVE-2023-50564

CVE-2023-50564 - Pluck CMS v4.7.18 Exploit Overview This script exploits an authenticated arbitrary file upload vulnerability in Pluck CMS v4.7.18 CVE-2023-50564. By leveraging this vulnerability, an authenticated attacker can upload a malicious PHP file, enabling the execution of arbitrary code ...

CVE-2021-31762

..| CVE-2021-31762 |.. Description : Exploiting a Cross-site request forgery CSRF attack to create a privileged user through the Webmin's add users feature then getting a reverse shell through the Webmin's running process feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021...

httpd-2.4.49

httpd-2.4.49 critical: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 incomplete fix of CVE-2021-41773 CVE-2021-42013...

CVE-2022-22947

CVE-2022-22947 SpringCloudGatewayRCE Code By:Junsheng @Orange Network Security Lab Orange Network Security Lab https://0range.team/ 0x00 Risk Overview This tool is only for authorized security testing. Unauthorized illegal attacks on sites are prohibited. Read online Cybersecurity Law of the...

cve-2025-24893-poc

CVE-2025-24893 — XWiki Unauthenticated RCE PoC Proof-of-Concept exploit for CVE-2025-24893 , a critical unauthenticated Remote Code Execution vulnerability in XWiki. This exploit abuses a Groovy template injection in the SolrSearch endpoint to execute arbitrary commands — including reverse shells...

CVE-2022-24637

CVE-2022-24637 Open Web Analytics 1.7.3 - Remote Code Execution Exploit v2 Working exploit for Open Web Analytics 1.7.3 - RCE enhenced with pentestmonkey's php reverse shell, Fixed issue of not able to find user in cache. Original soruce exploit can be found on here Usage Add your attacker...

CVE-2025-8110

RCE - CVE-2025-59528 Gogs = 0.13.3 Exploit $ python3 CVE-2025-8110.py -h usage: CVE-2025-8110.py -h -u URL -lh HOST -lp PORT -user USERNAME -pass PASSWORD -x CVE-2025-8110 Gogs Exploit options: -h, --help show this help message and exit -u, --url URL Gogs base URL e.g., http://127.0.0.1:3000 -lh,...

CVE-2025-48148

CVE-2025-48148 StoreKeeper for WooCommerce = 14.4.4 - Unauthenticated Arbitrary File Upload 🚀 StoreKeeper for WooCommerce = 14.4.4 - Unauthenticated Arbitrary File Upload Exploit 📝 Description The StoreKeeper for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to...

PRTG-Network-Monitor-18.2.38---Authenticated-Remote-Code-Execution-CVE-2018-9276

Authenticated PRTG network Monitor remote code execution Based on https://www.exploit-db.com/exploits/46527 Usage: simply manually edit the script to include your Target URL, admin username and password like so: TARGET = "http://10.129.15.52" USER = "prtgadmin" PASS = "PrTg@dmin2019" Then insert...

ICT287-CVE-2022-42889

ICT287-CVE-2022-42889 To find full exploit setup and recreation report please find the CVE-2022-42889-Project Vulnerability Exploitation Report file. VM that was used to build and run the exploit isn't included in this repository. Setup and exploit recreation for CVE-2022-42889 Text4Shell...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE Vulnerability 1. Vulnerability Description Zoho ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. CVE-2021-40539 Zoho ManageEngine...

CVE-2024-26574

CVE-2024-26574 Wondershare Filmora v.13.0.51 - Insecure Permissions Privilege Escalation Description: Insecure Permissions vulnerability in Wondershare Filmora and versions below allows a local unprivileged attacker to execute arbitrary code as SYSTEM via a crafted script to the controlable path...

ghostcat

This tool exploits an LFI vulnerability within Apache Tomcat named CVE-2020-1938 to not only view sensitive files, but also to run malicious JSP payloads. It can be downloaded here you will need to run it from the command line Usage: ghostcat target HTTP port AJP port file read/eval...

CVE-2024-11972-POC

Description Name : CVE-2024-11972 CVSSv3 Score : 9.8 Affected Versions : Hunk Companion argparse, requests, urljoin Usage options: -h, --help show this help message and exit -u URL, --url URL Base URL of the WordPress site default: http://localhost/wordpress/. -p PLUGIN, --plugin PLUGIN Plugin na...

CVE-2026-6271

CVE-2026-6271 — Career Section WordPress Plugin RCE Scanner Plugin: Career Section career-section CVE ID: CVE-2026-6271 CVSS Score: 9.8 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Vulnerability Type: Unauthenticated Arbitrary File Upload → Remote Code Execution Affected...

cve-2019-15107

Python usage python cve-2019-15107.py -t https:// -c cmd...

CVE-2024-31982

CVE-2024-31982 Java SSTI - Lead to RCE async async=falsegroovyprintln"Successful Injection"/groovy/ GET /bin/get/Main/DatabaseSearch?outputSyntax=plain&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22Successful%20Injection%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2F HTTP/1.1...

CVE-2025-10230

CVE-2025-10230 — Samba WINS Hook Command Injection The author assumes no liability for misuse or damage caused by this tool. Research is provided strictly for educational and defensive purposes. Description This repository contains a Proof-of-Concept PoC for CVE-2025-10230 , a command-injection...

CVE-2026-12940-Langflow-Unauth-RCE

CVE-2026-12940 — Langflow OSS ≤ 1.10.1 Unauthenticated RCE MCP stdio env-var injection Unauthenticated remote code execution in Langflow OSS through 1.10.1. The environment-variable blocklist that guards MCP stdio server configuration DANGEROUSENVVARS omits SHELLOPTS, BASHOPTS and PS4. Because th...