774825 matches found
Flowise < 3.0.1 - Remote Command Execution
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...
Selenium Grid < 4.0.0-alpha-7 - Remote Code Execution
Selenium Server Grid before 4.0.0-alpha-7 permits unauthenticated session creation and unsafe capability injection via /wd/hub/session due to missing Origin validation and weak content-type enforcement. id: CVE-2022-28108 info: name: Selenium Grid 4.0.0-alpha-7 - Remote Code Execution author: t0x...
Web-Check < 2.0.1 Screenshot API - OS Command Injection
Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters. id: CVE-2025-32778 info: name: Web-Check 2.0.1 Screenshot API - OS Command Injection author:...
F5 BIG-IP Appliance Mode - Command Injection
When running in Appliance mode, an authenticated user assigned the Administrator role may bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. id: CVE-2022-41800 info: name: F5 BIG-IP Appliance Mode - Command Injection author: dwisiswant0 severity: high description...
F5 BIG-IP iControl - REST Auth Bypass RCE
F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, may allow undisclosed requests to bypass iControl REST authentication. id: CVE-2022-1388 info: name: F5 BIG-IP...
Nette Framework - Remote Code Execution
Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. id: CVE-2020-15227 info: name: Nette Framework - Remote Code Execution author:...
Drupal - Remote Code Execution
Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10 V contain certain field types that do not properly sanitize data from non-form sources, which can lead to arbitrary PHP code execution in some cases. id: CVE-2019-6340 info: name: Drupal - Remote Code Execution author: madrobot severity:...
PHP-FPM Path Info Buffer Underflow - Remote Code Execution
In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgisplitpathinfo directive, a crafted request with an empty PATHINFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote...
react-cve-2025-55182-lab
Setup: git clone https://github.com/alexandre-briongos-wavestone/react-cve-2025-55182-lab cd react-cve-2025-55182-lab sudo docker build -t react-rsc-lab . sudo docker run -p 3000:3000 react-rsc-lab Exploit: curl --path-as-is -i -s -k -X $'POST' \ -H $'Host: localhost:3000' -H $'User-Agent:...
CVE-2021-26855-Exchange-RCE
CVE-2021-26855-Exchange-RCE Microsoft Exchange Proxylogon Exploit Chain EXP Analysis + CVE-2021–26855 + CVE-2021–27065 Reproduction Summary...
secure-by-default-rce-demo
Node.js RCE Mitigation: DevOps as the Last Line of Defense This project demonstrates a critical Remote Code Execution RCE vulnerability in a Next.js application specifically via Server Actions and how infrastructure hardening effectively neutralizes the attack even when the code vulnerability...
CVE-2023-1521
PoC gcc -shared -o libpoc.so poc.c -fPIC export LDPRELOAD=fullpathtolibpoc.so sccache gcc foo.c -o foo...
CVE-2025-25257
CVE-2025-25257 - FortiWeb Vulnerability Checker & Exploit A Python-based tool for checking and exploiting CVE-2025-25257 vulnerability in FortiWeb devices. This vulnerability allows SQL injection and remote code execution through a crafted Authorization header. 📋 Description CVE-2025-25257 is a...
CVE-2026-2898-FunAdmin-Deserialization
CVE-2026-2898 - FunAdmin Insecure Deserialization Summary FunAdmin Disclaimer For educational and authorized testing only...
CVE-2025-24813-Apache-Tomcat-RCE-PoC
CVE-2025-24813 Apache Tomcat RCE PoC Description This is a Proof of Concept PoC for CVE-2025-24813, a Remote Code Execution RCE vulnerability in Apache Tomcat. The vulnerability arises from unsafe deserialization of crafted session files uploaded via HTTP PUT requests, allowing attackers to execu...
CVE-2023-36844
CVE-2023-36844 The "Remote Code Execution in Juniper JunOS within SRX and EX Series products" vulnerability is a security issue that allows an attacker to execute arbitrary code on a targeted Juniper device running JunOS software. This vulnerability could potentially lead to a compromise of the...
Toolshell_CVE-2025-53770
ToolShell → CVE‑2025‑53770 Exploit PoC This package allows: 1. Upload webshell to SharePoint 2. Extract ValidationKey 3. Generate signed ViewState 4. RCE via reverse/bind shell 🔧 Setup git clone cd toolshell-exploit pip3 install -r requirements.txt 🤖 Running Upload the webshell From a SharePoint...
CVE-2024-39248
Exploit Title: SimpCMS v0.1 - Cross Site Scripting XSS CVE: CVE-2024-39248 Exploit Author: Jason Jacobs 0xjasonjacobs - Twitter Vendor Homepage: https://sourceforge.net/projects/simpcms/ Vulnerable endpoint: /SimpCMS/admin.php A cross-site scripting XSS vulnerability in SimpCMS v0.1 allows...
CVE-2025-55182-TOOLS
CVE-2025-55182 Exploit Tool CVE-2025-55182 Comprehensive Exploitation/Detection Tool Developed byMingYi Security Lab Features Vulnerability Detection : Batch scan multiple targets for the vulnerability Path Scanning : Scan common Server Action endpoints to discover vulnerable paths Remote Code...